systex | a2211e0b5cd39140c8a821b9c95909615514b0a42ef6f48a09416c07c5187cf4

Analysis

max time kernel
150s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 16:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-01_928a46317f2939aec4698ef703d88072_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Size 376KB
Sample260701-vefcbact21
SHA256 a2211e0b5cd39140c8a821b9c95909615514b0a42ef6f48a09416c07c5187cf4
MD5 928a46317f2939aec4698ef703d88072
SHA1 e9af1ab0672cae6b73ff526934f1db46953f92e2
SHA512 6fe03aa99532f7a620b5d4ec2588c9d7b5443ff0d4f6bd073c4b4da75af07e6b45899c8414a1c0f602b929df88b79bd2a103b44f6daf4ef923308a61e78eb504
SSDEEP 3072:OZaLpGaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:aaLItIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B8847C04BA94F0F6D995043800EBAF36A67EB4281726CBC7E354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
5644	yvqoigdyvtqoigay.exe
840	yvqoigdyvtqoigay.sys
1104	CreateProcess.exe
2148	ljdaytnfbn.exe
2996	CreateProcess.exe
6752	CreateProcess.exe
416	i_ljdaytnfbn.exe
7140	qnlfdxvqnl.sys
4552	CreateProcess.exe
3108	faysqkifdx.exe
5692	CreateProcess.exe
1772	CreateProcess.exe
5192	i_faysqkifdx.exe
2696	nhfdxvsnlf.sys
4804	CreateProcess.exe
5384	nhfcavsnlf.exe
5456	CreateProcess.exe
6844	CreateProcess.exe
5004	i_nhfcavsnlf.exe
3944	cxupnhfzxs.sys
5060	CreateProcess.exe
5860	cxvpnhfzxr.exe
3808	CreateProcess.exe
5396	CreateProcess.exe
5632	i_cxvpnhfzxr.exe
7136	mkhczusmkh.sys
2080	CreateProcess.exe
4184	rmkecxupmh.exe
6768	CreateProcess.exe
4560	CreateProcess.exe
5940	i_rmkecxupmh.exe
5168	urmjhecwup.sys
4880	CreateProcess.exe
7100	wusebzwrpj.exe
3008	CreateProcess.exe
6564	CreateProcess.exe
4208	i_wusebzwrpj.exe
3556	gezwrojhbz.sys
6548	CreateProcess.exe
2372	bywrojhbzt.exe
856	CreateProcess.exe
4404	CreateProcess.exe
3704	i_bywrojhbzt.exe
716	jdbwtoljeb.sys
6860	CreateProcess.exe
1636	gbywtrljeb.exe
260	CreateProcess.exe
6204	CreateProcess.exe
1512	i_gbywtrljeb.exe
4980	bytqoigdbz.sys
6524	CreateProcess.exe
2840	wqolgdywqo.exe
4384	CreateProcess.exe
4356	CreateProcess.exe
724	i_wqolgdywqo.exe
5388	igaytqljdb.sys
6708	CreateProcess.exe
6728	aywqoigayt.exe
3924	CreateProcess.exe
6704	CreateProcess.exe
2760	i_aywqoigayt.exe
6900	ifdyvqniga.sys
5180	CreateProcess.exe
2352	dysqkidavs.exe

Loads dropped DLL 1 IoCs

pid	Process
3500	msedge.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1932670170\crs.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1932670170\kp_pinslist.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1932670170\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_869577628\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1950479803\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1950479803\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_1932670170\ct_config.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3500_869577628\well_known_domains.dll	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvqoigdyvtqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqolgdywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgeywqoigb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdaytnfbn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faysqkifdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjgebzurmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrojhbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxvpnhfzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wusebzwrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wusebzwrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbywtrljeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywqoiytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgeywqoigb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snkifdxvsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfcavsnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bywrojhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbywtrljeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dxvpnhfzxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkecwupnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hczxusmkhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjgebzurmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faysqkifdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfcavsnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmkecxupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bywrojhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aywqoigayt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aywqoigayt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxvpnhfzxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-01_928a46317f2939aec4698ef703d88072_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cxvpnhfzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmkecxupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dysqkidavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkecwupnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hczxusmkhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrojhbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnlfdxvqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqolgdywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dysqkidavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnlfdxvqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snkifdxvsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdaytnfbn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywqoiytq.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2344	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
816	ipconfig.exe
3416	ipconfig.exe
2660	ipconfig.exe
7092	ipconfig.exe
1224	ipconfig.exe
2120	ipconfig.exe
6080	ipconfig.exe
7044	ipconfig.exe
1340	ipconfig.exe
6560	ipconfig.exe
6400	ipconfig.exe
1944	ipconfig.exe
2908	ipconfig.exe
3052	ipconfig.exe
572	ipconfig.exe
5460	ipconfig.exe
3972	ipconfig.exe
2812	ipconfig.exe
6904	ipconfig.exe
3492	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1935666426-3801330415-1166019131-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134273984440669971"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1935666426-3801330415-1166019131-1000\{1C7D42DC-A148-4CD4-92FC-8823BC28D708}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6012	2026-07-01_928a46317f2939aec4698ef703d88072_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6012	2026-07-01_928a46317f2939aec4698ef703d88072_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6012	2026-07-01_928a46317f2939aec4698ef703d88072_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6012	2026-07-01_928a46317f2939aec4698ef703d88072_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6012	2026-07-01_928a46317f2939aec4698ef703d88072_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6012	2026-07-01_928a46317f2939aec4698ef703d88072_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6012	2026-07-01_928a46317f2939aec4698ef703d88072_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6012	2026-07-01_928a46317f2939aec4698ef703d88072_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6012	2026-07-01_928a46317f2939aec4698ef703d88072_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6012	2026-07-01_928a46317f2939aec4698ef703d88072_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6012	2026-07-01_928a46317f2939aec4698ef703d88072_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6012	2026-07-01_928a46317f2939aec4698ef703d88072_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6012	2026-07-01_928a46317f2939aec4698ef703d88072_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6012	2026-07-01_928a46317f2939aec4698ef703d88072_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6012	2026-07-01_928a46317f2939aec4698ef703d88072_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6012	2026-07-01_928a46317f2939aec4698ef703d88072_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6012	2026-07-01_928a46317f2939aec4698ef703d88072_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6012	2026-07-01_928a46317f2939aec4698ef703d88072_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6012	2026-07-01_928a46317f2939aec4698ef703d88072_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6012	2026-07-01_928a46317f2939aec4698ef703d88072_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6012	2026-07-01_928a46317f2939aec4698ef703d88072_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6012	2026-07-01_928a46317f2939aec4698ef703d88072_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6012	2026-07-01_928a46317f2939aec4698ef703d88072_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6012	2026-07-01_928a46317f2939aec4698ef703d88072_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6012	2026-07-01_928a46317f2939aec4698ef703d88072_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6012	2026-07-01_928a46317f2939aec4698ef703d88072_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6012	2026-07-01_928a46317f2939aec4698ef703d88072_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6012	2026-07-01_928a46317f2939aec4698ef703d88072_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6012	2026-07-01_928a46317f2939aec4698ef703d88072_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6012	2026-07-01_928a46317f2939aec4698ef703d88072_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6012	2026-07-01_928a46317f2939aec4698ef703d88072_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6012	2026-07-01_928a46317f2939aec4698ef703d88072_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6012	2026-07-01_928a46317f2939aec4698ef703d88072_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6012	2026-07-01_928a46317f2939aec4698ef703d88072_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6012	2026-07-01_928a46317f2939aec4698ef703d88072_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6012	2026-07-01_928a46317f2939aec4698ef703d88072_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6012	2026-07-01_928a46317f2939aec4698ef703d88072_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6012	2026-07-01_928a46317f2939aec4698ef703d88072_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6012	2026-07-01_928a46317f2939aec4698ef703d88072_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6012	2026-07-01_928a46317f2939aec4698ef703d88072_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5644	yvqoigdyvtqoigay.exe
5644	yvqoigdyvtqoigay.exe
6012	2026-07-01_928a46317f2939aec4698ef703d88072_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6012	2026-07-01_928a46317f2939aec4698ef703d88072_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5644	yvqoigdyvtqoigay.exe
5644	yvqoigdyvtqoigay.exe
6012	2026-07-01_928a46317f2939aec4698ef703d88072_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6012	2026-07-01_928a46317f2939aec4698ef703d88072_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5644	yvqoigdyvtqoigay.exe
5644	yvqoigdyvtqoigay.exe
6012	2026-07-01_928a46317f2939aec4698ef703d88072_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6012	2026-07-01_928a46317f2939aec4698ef703d88072_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5644	yvqoigdyvtqoigay.exe
6012	2026-07-01_928a46317f2939aec4698ef703d88072_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5644	yvqoigdyvtqoigay.exe
6012	2026-07-01_928a46317f2939aec4698ef703d88072_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5644	yvqoigdyvtqoigay.exe
5644	yvqoigdyvtqoigay.exe
6012	2026-07-01_928a46317f2939aec4698ef703d88072_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6012	2026-07-01_928a46317f2939aec4698ef703d88072_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5644	yvqoigdyvtqoigay.exe
5644	yvqoigdyvtqoigay.exe
6012	2026-07-01_928a46317f2939aec4698ef703d88072_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6012	2026-07-01_928a46317f2939aec4698ef703d88072_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe

Suspicious behavior: LoadsDriver 21 IoCs

pid	Process
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3500	msedge.exe
3500	msedge.exe
3500	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	416	i_ljdaytnfbn.exe
Token: SeDebugPrivilege	5192	i_faysqkifdx.exe
Token: SeDebugPrivilege	5004	i_nhfcavsnlf.exe
Token: SeDebugPrivilege	5632	i_cxvpnhfzxr.exe
Token: SeDebugPrivilege	5940	i_rmkecxupmh.exe
Token: SeDebugPrivilege	4208	i_wusebzwrpj.exe
Token: SeDebugPrivilege	3704	i_bywrojhbzt.exe
Token: SeDebugPrivilege	1512	i_gbywtrljeb.exe
Token: SeDebugPrivilege	724	i_wqolgdywqo.exe
Token: SeDebugPrivilege	2760	i_aywqoigayt.exe
Token: SeDebugPrivilege	1932	i_dysqkidavs.exe
Token: SeDebugPrivilege	5736	i_dxvpnhfzxs.exe
Token: SeDebugPrivilege	2004	i_mkecwupnhf.exe
Token: SeDebugPrivilege	3588	i_hczxusmkhf.exe
Token: SeDebugPrivilege	5356	i_pjgebzurmk.exe
Token: SeDebugPrivilege	6492	i_wrojhbztrl.exe
Token: SeDebugPrivilege	4540	i_geywqoiytq.exe
Token: SeDebugPrivilege	7148	i_lgeywqoigb.exe
Token: SeDebugPrivilege	2564	i_tnlfdxvqni.exe
Token: SeDebugPrivilege	1048	i_snkifdxvsn.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3500	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6012 wrote to memory of 5644	6012	2026-07-01_928a46317f2939aec4698ef703d88072_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 6012 wrote to memory of 5816	6012	2026-07-01_928a46317f2939aec4698ef703d88072_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 5816 wrote to memory of 3500	5816	iexplore.exe	91
PID 3500 wrote to memory of 3104	3500	msedge.exe	92
PID 3500 wrote to memory of 2608	3500	msedge.exe	94
PID 3500 wrote to memory of 2344	3500	msedge.exe	93
PID 3500 wrote to memory of 2608	3500	msedge.exe	94
PID 3500 wrote to memory of 2608	3500	msedge.exe	94
PID 3500 wrote to memory of 6572	3500	msedge.exe	95
PID 3500 wrote to memory of 6572	3500	msedge.exe	95
PID 3500 wrote to memory of 3216	3500	msedge.exe	96
PID 3500 wrote to memory of 3216	3500	msedge.exe	96
PID 3500 wrote to memory of 3216	3500	msedge.exe	96
PID 3500 wrote to memory of 5028	3500	msedge.exe	97
PID 3500 wrote to memory of 5028	3500	msedge.exe	97
PID 3500 wrote to memory of 5028	3500	msedge.exe	97
PID 3500 wrote to memory of 3660	3500	msedge.exe	100
PID 3500 wrote to memory of 3660	3500	msedge.exe	100
PID 3500 wrote to memory of 2620	3500	msedge.exe	101
PID 3500 wrote to memory of 2620	3500	msedge.exe	101
PID 5644 wrote to memory of 1104	5644	yvqoigdyvtqoigay.exe	102
PID 3500 wrote to memory of 4384	3500	msedge.exe	106
PID 2148 wrote to memory of 2996	2148	ljdaytnfbn.exe	108
PID 5644 wrote to memory of 6752	5644	yvqoigdyvtqoigay.exe	113
PID 5644 wrote to memory of 4552	5644	yvqoigdyvtqoigay.exe	117
PID 3108 wrote to memory of 5692	3108	faysqkifdx.exe	119
PID 5644 wrote to memory of 1772	5644	yvqoigdyvtqoigay.exe	122
PID 5644 wrote to memory of 4804	5644	yvqoigdyvtqoigay.exe	126
PID 5384 wrote to memory of 5456	5384	nhfcavsnlf.exe	128
PID 5644 wrote to memory of 6844	5644	yvqoigdyvtqoigay.exe	131
PID 5644 wrote to memory of 5060	5644	yvqoigdyvtqoigay.exe	135
PID 5860 wrote to memory of 3808	5860	cxvpnhfzxr.exe	137
PID 5644 wrote to memory of 5396	5644	yvqoigdyvtqoigay.exe	141
PID 3500 wrote to memory of 2872	3500	msedge.exe	145
PID 3500 wrote to memory of 5760	3500	msedge.exe	146
PID 3500 wrote to memory of 5748	3500	msedge.exe	147
PID 5644 wrote to memory of 2080	5644	yvqoigdyvtqoigay.exe	148
PID 4184 wrote to memory of 6768	4184	rmkecxupmh.exe	150
PID 5644 wrote to memory of 4560	5644	yvqoigdyvtqoigay.exe	153
PID 5644 wrote to memory of 4880	5644	yvqoigdyvtqoigay.exe	157
PID 7100 wrote to memory of 3008	7100	wusebzwrpj.exe	159
PID 5644 wrote to memory of 6564	5644	yvqoigdyvtqoigay.exe	162
PID 5644 wrote to memory of 6548	5644	yvqoigdyvtqoigay.exe	166
PID 2372 wrote to memory of 856	2372	bywrojhbzt.exe	168
PID 5644 wrote to memory of 4404	5644	yvqoigdyvtqoigay.exe	171
PID 5644 wrote to memory of 6860	5644	yvqoigdyvtqoigay.exe	175
PID 1636 wrote to memory of 260	1636	gbywtrljeb.exe	177
PID 5644 wrote to memory of 6204	5644	yvqoigdyvtqoigay.exe	180
PID 3500 wrote to memory of 3772	3500	msedge.exe	184
PID 3500 wrote to memory of 3772	3500	msedge.exe	184
PID 5644 wrote to memory of 6524	5644	yvqoigdyvtqoigay.exe	187
PID 2840 wrote to memory of 4384	2840	wqolgdywqo.exe	189
PID 5644 wrote to memory of 4356	5644	yvqoigdyvtqoigay.exe	192
PID 5644 wrote to memory of 6708	5644	yvqoigdyvtqoigay.exe	196
PID 6728 wrote to memory of 3924	6728	aywqoigayt.exe	198
PID 5644 wrote to memory of 6704	5644	yvqoigdyvtqoigay.exe	201
PID 5644 wrote to memory of 5180	5644	yvqoigdyvtqoigay.exe	205
PID 2352 wrote to memory of 1160	2352	dysqkidavs.exe	207
PID 5644 wrote to memory of 1880	5644	yvqoigdyvtqoigay.exe	210
PID 3500 wrote to memory of 3748	3500	msedge.exe	212
PID 3500 wrote to memory of 3748	3500	msedge.exe	212
PID 5644 wrote to memory of 4796	5644	yvqoigdyvtqoigay.exe	215
PID 3328 wrote to memory of 1484	3328	dxvpnhfzxs.exe	217
PID 5644 wrote to memory of 5168	5644	yvqoigdyvtqoigay.exe	220

C:\Users\Admin\AppData\Local\Temp\2026-07-01_928a46317f2939aec4698ef703d88072_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-01_928a46317f2939aec4698ef703d88072_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6012
- C:\Temp\yvqoigdyvtqoigay.exe
  C:\Temp\yvqoigdyvtqoigay.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5644
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljdaytnfbn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1104
  - - C:\Temp\ljdaytnfbn.exe
      C:\Temp\ljdaytnfbn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2148
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2996
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:7044
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljdaytnfbn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6752
  - - C:\Temp\i_ljdaytnfbn.exe
      C:\Temp\i_ljdaytnfbn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:416
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\faysqkifdx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4552
  - - C:\Temp\faysqkifdx.exe
      C:\Temp\faysqkifdx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3108
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5692
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:816
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_faysqkifdx.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1772
  - - C:\Temp\i_faysqkifdx.exe
      C:\Temp\i_faysqkifdx.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5192
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nhfcavsnlf.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4804
  - - C:\Temp\nhfcavsnlf.exe
      C:\Temp\nhfcavsnlf.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5384
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5456
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5460
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nhfcavsnlf.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6844
  - - C:\Temp\i_nhfcavsnlf.exe
      C:\Temp\i_nhfcavsnlf.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5004
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cxvpnhfzxr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5060
  - - C:\Temp\cxvpnhfzxr.exe
      C:\Temp\cxvpnhfzxr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5860
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3808
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3416
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cxvpnhfzxr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5396
  - - C:\Temp\i_cxvpnhfzxr.exe
      C:\Temp\i_cxvpnhfzxr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5632
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rmkecxupmh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2080
  - - C:\Temp\rmkecxupmh.exe
      C:\Temp\rmkecxupmh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4184
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6768
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2660
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rmkecxupmh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4560
  - - C:\Temp\i_rmkecxupmh.exe
      C:\Temp\i_rmkecxupmh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5940
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wusebzwrpj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4880
  - - C:\Temp\wusebzwrpj.exe
      C:\Temp\wusebzwrpj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:7100
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3008
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1340
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wusebzwrpj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6564
  - - C:\Temp\i_wusebzwrpj.exe
      C:\Temp\i_wusebzwrpj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4208
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bywrojhbzt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6548
  - - C:\Temp\bywrojhbzt.exe
      C:\Temp\bywrojhbzt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2372
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:856
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6560
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bywrojhbzt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4404
  - - C:\Temp\i_bywrojhbzt.exe
      C:\Temp\i_bywrojhbzt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3704
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gbywtrljeb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6860
  - - C:\Temp\gbywtrljeb.exe
      C:\Temp\gbywtrljeb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1636
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:260
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6400
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gbywtrljeb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6204
  - - C:\Temp\i_gbywtrljeb.exe
      C:\Temp\i_gbywtrljeb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1512
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wqolgdywqo.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6524
  - - C:\Temp\wqolgdywqo.exe
      C:\Temp\wqolgdywqo.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2840
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4384
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2120
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wqolgdywqo.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4356
  - - C:\Temp\i_wqolgdywqo.exe
      C:\Temp\i_wqolgdywqo.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:724
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\aywqoigayt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6708
  - - C:\Temp\aywqoigayt.exe
      C:\Temp\aywqoigayt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6728
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3924
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1944
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_aywqoigayt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6704
  - - C:\Temp\i_aywqoigayt.exe
      C:\Temp\i_aywqoigayt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2760
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dysqkidavs.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5180
  - - C:\Temp\dysqkidavs.exe
      C:\Temp\dysqkidavs.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2352
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1160
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:7092
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dysqkidavs.exe ups_ins
    3⤵
    PID:1880
  - - C:\Temp\i_dysqkidavs.exe
      C:\Temp\i_dysqkidavs.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1932
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dxvpnhfzxs.exe ups_run
    3⤵
    PID:4796
  - - C:\Temp\dxvpnhfzxs.exe
      C:\Temp\dxvpnhfzxs.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3328
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1484
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3972
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dxvpnhfzxs.exe ups_ins
    3⤵
    PID:5168
  - - C:\Temp\i_dxvpnhfzxs.exe
      C:\Temp\i_dxvpnhfzxs.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5736
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mkecwupnhf.exe ups_run
    3⤵
    PID:2088
  - - C:\Temp\mkecwupnhf.exe
      C:\Temp\mkecwupnhf.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1340
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5720
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2812
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mkecwupnhf.exe ups_ins
    3⤵
    PID:3236
  - - C:\Temp\i_mkecwupnhf.exe
      C:\Temp\i_mkecwupnhf.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2004
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hczxusmkhf.exe ups_run
    3⤵
    PID:4208
  - - C:\Temp\hczxusmkhf.exe
      C:\Temp\hczxusmkhf.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5656
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3568
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2908
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hczxusmkhf.exe ups_ins
    3⤵
    PID:1632
  - - C:\Temp\i_hczxusmkhf.exe
      C:\Temp\i_hczxusmkhf.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3588
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pjgebzurmk.exe ups_run
    3⤵
    PID:1120
  - - C:\Temp\pjgebzurmk.exe
      C:\Temp\pjgebzurmk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6744
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6536
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6904
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pjgebzurmk.exe ups_ins
    3⤵
    PID:1384
  - - C:\Temp\i_pjgebzurmk.exe
      C:\Temp\i_pjgebzurmk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5356
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wrojhbztrl.exe ups_run
    3⤵
    PID:3116
  - - C:\Temp\wrojhbztrl.exe
      C:\Temp\wrojhbztrl.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3864
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5388
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3052
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wrojhbztrl.exe ups_ins
    3⤵
    PID:4276
  - - C:\Temp\i_wrojhbztrl.exe
      C:\Temp\i_wrojhbztrl.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6492
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\geywqoiytq.exe ups_run
    3⤵
    PID:5776
  - - C:\Temp\geywqoiytq.exe
      C:\Temp\geywqoiytq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1748
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5536
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:572
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_geywqoiytq.exe ups_ins
    3⤵
    PID:5760
  - - C:\Temp\i_geywqoiytq.exe
      C:\Temp\i_geywqoiytq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4540
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lgeywqoigb.exe ups_run
    3⤵
    PID:1344
  - - C:\Temp\lgeywqoigb.exe
      C:\Temp\lgeywqoigb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2428
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3940
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6080
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lgeywqoigb.exe ups_ins
    3⤵
    PID:996
  - - C:\Temp\i_lgeywqoigb.exe
      C:\Temp\i_lgeywqoigb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:7148
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tnlfdxvqni.exe ups_run
    3⤵
    PID:6336
  - - C:\Temp\tnlfdxvqni.exe
      C:\Temp\tnlfdxvqni.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:7144
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3324
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1224
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tnlfdxvqni.exe ups_ins
    3⤵
    PID:4948
  - - C:\Temp\i_tnlfdxvqni.exe
      C:\Temp\i_tnlfdxvqni.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2564
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\snkifdxvsn.exe ups_run
    3⤵
    PID:5684
  - - C:\Temp\snkifdxvsn.exe
      C:\Temp\snkifdxvsn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:7104
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6308
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3492
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_snkifdxvsn.exe ups_ins
    3⤵
    PID:1568
  - - C:\Temp\i_snkifdxvsn.exe
      C:\Temp\i_snkifdxvsn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1048
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ff85a30c188,0x7ff85a30c194,0x7ff85a30c1a0
      4⤵
      PID:3104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2104,i,13277337772710822891,9542603426002610302,524288 --field-trial-handle=2644,i,8574027840265410725,7111521580220235972,262144 --variations-seed-version --mojo-platform-channel-handle=2684 /prefetch:11
      4⤵
      System Time Discovery
      PID:2344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1828,i,12003270421747464976,11797874226516693247,262144 --field-trial-handle=2644,i,8574027840265410725,7111521580220235972,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:2
      4⤵
      PID:2608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2408,i,5271523317725466284,4635633559200173496,524288 --field-trial-handle=2644,i,8574027840265410725,7111521580220235972,262144 --variations-seed-version --mojo-platform-channel-handle=2784 /prefetch:13
      4⤵
      PID:6572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3600,i,6696471459893742982,12401626982556131102,2097152 --field-trial-handle=2644,i,8574027840265410725,7111521580220235972,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
      4⤵
      PID:3216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3412,i,15040542976833856460,3972452412590528123,2097152 --field-trial-handle=2644,i,8574027840265410725,7111521580220235972,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
      4⤵
      PID:5028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,15715949528788354387,12842887574140092500,524288 --field-trial-handle=2644,i,8574027840265410725,7111521580220235972,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:14
      4⤵
      PID:3660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,15989260027064587873,9113286956414652741,524288 --field-trial-handle=2644,i,8574027840265410725,7111521580220235972,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:14
      4⤵
      PID:2620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5740,i,5501644726559790597,5641090402335721987,524288 --field-trial-handle=2644,i,8574027840265410725,7111521580220235972,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:14
      4⤵
      PID:6640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5740,i,5501644726559790597,5641090402335721987,524288 --field-trial-handle=2644,i,8574027840265410725,7111521580220235972,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:14
      4⤵
      PID:4384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,6103426295889678402,13772597936358340471,524288 --field-trial-handle=2644,i,8574027840265410725,7111521580220235972,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:14
      4⤵
      PID:2872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,1349941551328963731,4719624542350536210,524288 --field-trial-handle=2644,i,8574027840265410725,7111521580220235972,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:14
      4⤵
      PID:5760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,1343447145531146658,7007978719816076462,524288 --field-trial-handle=2644,i,8574027840265410725,7111521580220235972,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:14
      4⤵
      PID:5748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3156,i,6662896534452413293,945308695725833846,524288 --field-trial-handle=2644,i,8574027840265410725,7111521580220235972,262144 --variations-seed-version --mojo-platform-channel-handle=3392 /prefetch:14
      4⤵
      PID:3772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,634073389617020860,12455711318700167639,524288 --field-trial-handle=2644,i,8574027840265410725,7111521580220235972,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
      4⤵
      PID:3748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,2056782835173030827,15580846663056305924,524288 --field-trial-handle=2644,i,8574027840265410725,7111521580220235972,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:14
      4⤵
      PID:6448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5448,i,2007998661469495360,8951405839329973105,262144 --field-trial-handle=2644,i,8574027840265410725,7111521580220235972,262144 --variations-seed-version --mojo-platform-channel-handle=1484 /prefetch:10
      4⤵
      PID:4368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3892,i,918707219660423445,10636800970492679590,524288 --field-trial-handle=2644,i,8574027840265410725,7111521580220235972,262144 --variations-seed-version --mojo-platform-channel-handle=3900 /prefetch:14
      4⤵
      PID:6372

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1932

C:\Temp\yvqoigdyvtqoigay.sys
C:\Temp\yvqoigdyvtqoigay.sys
1⤵
- Executes dropped EXE
PID:840

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3420

C:\Temp\qnlfdxvqnl.sys
C:\Temp\qnlfdxvqnl.sys
1⤵
- Executes dropped EXE
PID:7140

C:\Temp\nhfdxvsnlf.sys
C:\Temp\nhfdxvsnlf.sys
1⤵
- Executes dropped EXE
PID:2696

C:\Temp\cxupnhfzxs.sys
C:\Temp\cxupnhfzxs.sys
1⤵
- Executes dropped EXE
PID:3944

C:\Temp\mkhczusmkh.sys
C:\Temp\mkhczusmkh.sys
1⤵
- Executes dropped EXE
PID:7136

C:\Temp\urmjhecwup.sys
C:\Temp\urmjhecwup.sys
1⤵
- Executes dropped EXE
PID:5168

C:\Temp\gezwrojhbz.sys
C:\Temp\gezwrojhbz.sys
1⤵
- Executes dropped EXE
PID:3556

C:\Temp\jdbwtoljeb.sys
C:\Temp\jdbwtoljeb.sys
1⤵
- Executes dropped EXE
PID:716

C:\Temp\bytqoigdbz.sys
C:\Temp\bytqoigdbz.sys
1⤵
- Executes dropped EXE
PID:4980

C:\Temp\igaytqljdb.sys
C:\Temp\igaytqljdb.sys
1⤵
- Executes dropped EXE
PID:5388

C:\Temp\ifdyvqniga.sys
C:\Temp\ifdyvqniga.sys
1⤵
- Executes dropped EXE
PID:6900

C:\Temp\xusqkifzxv.sys
C:\Temp\xusqkifzxv.sys
1⤵
PID:7160

C:\Temp\usmkfcxupn.sys
C:\Temp\usmkfcxupn.sys
1⤵
PID:6172

C:\Temp\czurpjhfzx.sys
C:\Temp\czurpjhfzx.sys
1⤵
PID:5336

C:\Temp\rpjhbzwuom.sys
C:\Temp\rpjhbzwuom.sys
1⤵
PID:2504

C:\Temp\bzwjhbztrm.sys
C:\Temp\bzwjhbztrm.sys
1⤵
PID:2548

C:\Temp\jdbztrojge.sys
C:\Temp\jdbztrojge.sys
1⤵
PID:6456

C:\Temp\lgdbvtnljd.sys
C:\Temp\lgdbvtnljd.sys
1⤵
PID:3404

C:\Temp\vtnlfdyvqo.sys
C:\Temp\vtnlfdyvqo.sys
1⤵
PID:7056

C:\Temp\cavsnlfdxv.sys
C:\Temp\cavsnlfdxv.sys
1⤵
PID:5068

C:\Temp\hfaxsqkifa.sys
C:\Temp\hfaxsqkifa.sys
1⤵
PID:3840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bywrojhbzt.exe

Path C:\Temp\bywrojhbzt.exe
Size 376KB
SHA256 cb9180e72a0c5d00ed8381c5b292b870b49bc15f598d59f5d6c1c9f69687a71a
MD5 872ac82d5c75843f875a0319fdbdedf2
SHA1 fba589ab23547a63a6da4bd538b2fcb0e7976abc
SHA512 912ab97545594bc3c86e46a4e21e7deeeae3432dbdedddf3858386830c24718fe0b858d822d505ac3385ecd8586bd8b3eb7244d9c4d028d8a6210d63f43813e4
SSDEEP 3072:8ZaLpGaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:EaLItIJjiJcbI03GBc3ucY5DCSjX
TLSH
T195847C04BA94F0F6D995043800EBAF36A67EB4241726CBC7E354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cxupnhfzxs.sys

Path C:\Temp\cxupnhfzxs.sys
Size 293KB
SHA256 0ac0c68f05c3f2bed2887583cf914753e5be51f6f7e7729e033a26037aa66275
MD5 f3db25d6de87f22c4d449fa400f77d7a
SHA1 1548b008f67db30daab6ab7a0e9fb3db9fd60317
SHA512 843df9c358987451e27dc45da78335c7b93cb182ced80c5027650853a6bd67ead9b3f364cd6793e8488ceb7bd8df960c3cabe80d166b6715bc3154a6855d7118
SSDEEP 3072:stKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:sIJjiJcbI03GBc3ucY5DCSj
TLSH
T1AD545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cxvpnhfzxr.exe

Path C:\Temp\cxvpnhfzxr.exe
Size 376KB
SHA256 3a1fdb4adfcac3861ac5562801894ef9ec7f94033166b57bfae987046c51132e
MD5 50ec0dfe2e93314716a3f7d3b56b07b7
SHA1 ddf853d8226220156b892e7fa513432e0b9ad7b2
SHA512 b4a67dec6c29f036e0f8bb2c53aa9926fb3eb86f5dd35674905236b7fb00f3fb535acc4aaa56c970eb997826442adf4c04a2ba351971307fb66e8848e98a6fc5
SSDEEP 3072:JZaLpGaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:PaLItIJjiJcbI03GBc3ucY5DCSjX
TLSH
T118847C04BA94F0F6D995043800EBAF36A67EB4281726CBC7E354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

faysqkifdx.exe

Path C:\Temp\faysqkifdx.exe
Size 376KB
SHA256 fe13cb5ba0f4a30a1502b032f7fae3ab61941bc119206cbddbdcaf36626acf5d
MD5 8f74c1b6e4876c12b4470e8fee9dd96b
SHA1 fbb4fda9788373fae36c56e0e59243c89659e525
SHA512 5b028b97992fa45dd33e1e49a984497a2cf8406bbe1f82b1b146072c04e9120af536593a2888588498248ddfb404e6544be1008be46a8ad87473ec583745cc5d
SSDEEP 3072:iZaLpGaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:WaLItIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B9847C04BA94F0F6D995043800EBAF36A67EB4281726CBC7E354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gezwrojhbz.sys

Path C:\Temp\gezwrojhbz.sys
Size 293KB
SHA256 4e0a96002ed6193f3df95b94e5396fc4857289dfd647d5b3f2d95dc9def0b5bc
MD5 5e521c56849a14411943cf14af3c3d69
SHA1 6c0bf1e35e91b827a997da40bc339e9ad738ff00
SHA512 ccc3fd0ab248dee6b65077d1eb8811b7a2e03e88733b3a64cbd9ceb34265675d0baea20c77b82fb5eed47c36656c04ed574ed04d99a746b36f7579fb9880660c
SSDEEP 3072:QtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:QIJjiJcbI03GBc3ucY5DCSj
TLSH
T1CD545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_cxvpnhfzxr.exe

Path C:\Temp\i_cxvpnhfzxr.exe
Size 376KB
SHA256 f7dc486e24f15a49181ab8aeff98e8c8969e8baf196ad3c3529f45ea29b0c7e5
MD5 15e85d29f10149b1fe12a527df2a4ab3
SHA1 dfacfd852cadba3bc82ab525e55b91503644e1ac
SHA512 8ccb9a1929de8c9d46bfbe353ca413097a6c1451743c3874e11f051e3af3d48d8d6103a544e27a76f1895205e2e16ea7d345a3dea49d164dd39766a8fea8b521
SSDEEP 3072:CZaLpGaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:2aLItIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F1847C04BA94F0F6D995043800EBAF36A67EB4281726CBC7E354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_faysqkifdx.exe

Path C:\Temp\i_faysqkifdx.exe
Size 376KB
SHA256 64c039e1704cfc2ca43236dc34e4faf4ffab224635409ca9fb6952b3e8f87526
MD5 5600dc72d7980f9ce3d43d73ab87bf79
SHA1 fbe57448759fdf2c0557944bdc8be2c514f15f88
SHA512 30d42cc18a1f2ba5502b4f0ae47c9272c7d2adbe2f885c70d64c330fce9eac96d5d38b87665b2b7731aff0e168c320e28787a0da84b0e7860cad37949ea7e257
SSDEEP 3072:KZaLpGaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:OaLItIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1BA847C04BA94F0F6D995043800EBAF36A67EB4281726CBC7E354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ljdaytnfbn.exe

Path C:\Temp\i_ljdaytnfbn.exe
Size 376KB
SHA256 fa86509023ac5ac879aca533055f6a308619e4349fd2dd84a86bc0bafbb3706e
MD5 23f73d8771ada12bdd13863cee7359f1
SHA1 37e4820f66fd1d0b941f6829210e3bbb311d1f10
SHA512 140e2d2f21c4f2e292f2687c4994add1ab932507862d200a16c6ba43f3c3a4e580315d0a94b9b38aac875ea1c70d7cd3e365e6c880dbc986c688a8b34ca02143
SSDEEP 3072:sZaLpGaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:0aLItIJjiJcbI03GBc3ucY5DCSjX
TLSH
T18C847C04BA94F0F6D995043800EBAF36A67EB4281726CBC7E354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nhfcavsnlf.exe

Path C:\Temp\i_nhfcavsnlf.exe
Size 376KB
SHA256 b0a3b94d93d9211e8540acfdee5d745a448fae9b6c20d024e138c0e0d619834b
MD5 5ca9af6df923a2a0f96537ed8992ed39
SHA1 eb35192c8f2750f1096a79b3941ea1fa5e6d16b2
SHA512 f728c5b870a413a891a59b3823dc15e44d6fb95f2a7defaaab7c7e92ab6d9b4e284567a19be579377b10fac18114358ad73428c44910bbca7bdb3a8155625b75
SSDEEP 3072:/ZaLpGaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:haLItIJjiJcbI03GBc3ucY5DCSjX
TLSH
T123847C04BA94F0F6D995043800EBAF36A67EB4281726CBC7E354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rmkecxupmh.exe

Path C:\Temp\i_rmkecxupmh.exe
Size 376KB
SHA256 0d256c1aaeebcbd30f8ac8c732480819d5a6d9bcda1482f2946e022a17ffaa1a
MD5 31e804a6309f062adb20d6e2a4a534e3
SHA1 dc05af9e20f54fd366ec60a9a24ef55632c63617
SHA512 9652f62012c43e9eb7aa918b2389f8e1d1968b36e84006a113a20cf8f7ddc3fcecf77eb645bab1d4e66efa4dd65b5c478d00e44e9446968f9a9c67c661b80b08
SSDEEP 3072:lZaLpGaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:DaLItIJjiJcbI03GBc3ucY5DCSjX
TLSH
T16C847C04BA94F0F6D995043800EBAF36A67EB4241726CBC7E354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wusebzwrpj.exe

Path C:\Temp\i_wusebzwrpj.exe
Size 376KB
SHA256 d3059216247be0e93bc772e937d86eea7ea661ae50c859a53ada3ad33d779062
MD5 858bfd6e9e50cee69565ee41bb50ce5b
SHA1 919ddd6877a9c19c7618ae034bf32f50cdb1e83c
SHA512 3ab61716443258e4f0d9f4e8c72ed6ce981e636f19080e0c509bb928dfb1f6684602902673cc43fe12af1e09b2248e16ed5cfad45f97122435fb528e00c60799
SSDEEP 3072:HZaLpGaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:5aLItIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B1847C04BA94F0F6D995043800EBAF36A67EB4281726CBC7E354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljdaytnfbn.exe

Path C:\Temp\ljdaytnfbn.exe
Size 376KB
SHA256 c3619f7ee9843b2d8494499b5617c36b40bd46de2662892af6370f50f84a708f
MD5 bcc5388b7b200c1ce2b4d6a23ba97555
SHA1 0ec0856ee1c91fa99df230aa725bf94053d0f41b
SHA512 24f4c02355dccb1c037b967a45d81cc50ca7f5eb9be7891cb3c81a944967a1b2ded45854169e01d2996f6aff4d27961b2cb2a3596f02e4865fef2ec5f7384732
SSDEEP 3072:+ZaLpGaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:KaLItIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F5847C04BA94F0F6D995043800EBAF36A67EB4281726CBC7E354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkhczusmkh.sys

Path C:\Temp\mkhczusmkh.sys
Size 293KB
SHA256 d0c3f699420742a67cb69b694a5af2a2fad02c1e3343d3e05b4c3037814bc891
MD5 0301fa147715ffc8153e306bfac89dee
SHA1 f1982e6b392b101613d57e086caa15bd2f378dd3
SHA512 261b82f7f5633bb1ed5a6578a23aa69fb8fdb0d7eaf34c14701138d017bbe48f0033be6264045b680c1516c916a23364de4f06856f1170e438fc739119c6abfa
SSDEEP 3072:otKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:oIJjiJcbI03GBc3ucY5DCSj
TLSH
T182545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nhfcavsnlf.exe

Path C:\Temp\nhfcavsnlf.exe
Size 376KB
SHA256 9c8899a6cb4536eacba27ec8c9baca217429651f18d500fe8ecf87976dcfafa4
MD5 692478b376dd8672f534c74e9c6123e6
SHA1 fb8d6ae261d33a8687ad1abc57a895c414ff4da1
SHA512 1336c483d9575937d0df60178ac96d98ebca0fd1e8c05cceae980a5ca1b811c9dacf5d437a80b36977476583192bc2b283b882c1d18c8def1bf49c37fb69c1b9
SSDEEP 3072:NZaLpGaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:baLItIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A3847C04BA94F0F6D995043800EBAF36A67EB4281726CBC7E354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nhfdxvsnlf.sys

Path C:\Temp\nhfdxvsnlf.sys
Size 293KB
SHA256 53418b3e45eb9a483b9d71b599a37c5d0b365418558dcd46970cacc7a9820884
MD5 f9f980f6a965c1c4faeda2b5ffe40349
SHA1 1b5c026543e73787158827469719be134219bf38
SHA512 47aeb34b5e7b5402510b32953afed2cf89c8465975dc630f04838b36f7fb6357128bcc325bbd20618de90135737aa6447d57ff40fae459c60d0f52e16e1f5ea3
SSDEEP 3072:UtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:UIJjiJcbI03GBc3ucY5DCSj
TLSH
T183545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qnlfdxvqnl.sys

Path C:\Temp\qnlfdxvqnl.sys
Size 293KB
SHA256 323c2020bdd6596412e9306521824c45c84dec9926d104329fa30bd8e1f48793
MD5 1834ee095f32d837a79e9a3c957ada88
SHA1 61d7c629aa7a5b9cc237067eaba0b9f7efe976a1
SHA512 4614415c9f113eea433e76d3462fd232842f491dff6f1cc028f96f579af5225c757bb322befc4e5a71c58c8b3b86198db6ce53d94bb7629c5555267726ac4acc
SSDEEP 3072:JtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:JIJjiJcbI03GBc3ucY5DCSj
TLSH
T13E545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmkecxupmh.exe

Path C:\Temp\rmkecxupmh.exe
Size 376KB
SHA256 83aa19f3f94c83eacd25c721c651b8a2044e9985685ccc56138547839bf51dfb
MD5 7fad7a246a9ff876eed4c610ad0d7fc5
SHA1 2048a43fe0607716d6f18c26e5166956d27e7a99
SHA512 aaa2016fd3723988533b7bce6948b6a0cef62fd90d0e3f409786dc5eec07911f0c41017075ba45e7d0a77c745ffb3a462130c858387284a4498fe00716cb1c52
SSDEEP 3072:vZaLpGaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:RaLItIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F4847C04BA94F0F6D995043800EBAF36A67EB4281726CBC7E354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urmjhecwup.sys

Path C:\Temp\urmjhecwup.sys
Size 293KB
SHA256 fd329a8a470eee89a124d88c1d5d62d8615b2af8194f84fe23b23856a682674c
MD5 533e14e594a73ed1098212aee8f1a3bc
SHA1 35b5cd614212722951a34431967803427f7b7877
SHA512 c78b9185ca38f2e0bfcdd40cc56a0089d261e5924c6c150186b83e2043c550509be4b495b6367795200d3d03dba2724c2ef9b5d5b78c4352ce51fd5bb0c38818
SSDEEP 3072:YtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:YIJjiJcbI03GBc3ucY5DCSj
TLSH
T146545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wusebzwrpj.exe

Path C:\Temp\wusebzwrpj.exe
Size 376KB
SHA256 99648728017f1d0b27278f9c35a344bb78da9909f3c104b4ad6cc5e993287b8e
MD5 c0c4bbcab99042d5b3ff404c1d514f20
SHA1 3ec8dca3e29df4b6cb8413dc4f3a29bcce4a1d1e
SHA512 383d1935e0713b2b7b6bfe4c628b1b96a8f797d757049c4f46e221910db45dc5a14a1ba04817d79e77ee4919ecc0ef240545998e5514396529f63a243933ecbf
SSDEEP 3072:WZaLpGaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:SaLItIJjiJcbI03GBc3ucY5DCSjX
TLSH
T16A847C04BA94F0F6D995043800EBAF36A67EB4281726CBC7E354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yvqoigdyvtqoigay.exe

Path C:\Temp\yvqoigdyvtqoigay.exe
Size 376KB
SHA256 bf88985f932004feb49fa22023379b67cd0c0605d56cd6dcf30894034ff3c92b
MD5 0b0afb568b5afabc550363c83e548ccb
SHA1 ac2be8e7b9a35633a3f63ded903a31a17a3d4e5b
SHA512 3188c3985be2b449df457d559928ce1d30faa5bb7a7b63f34fc5213ba34ea8b83d2515f8b1eb34afd98252193827f6c6d8da03467c92ff97e1958c037cdbd963
SSDEEP 3072:OZaLpGaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:aaLItIJjiJcbI03GBc3ucY5DCSjX
TLSH
T131847C04BA94F0F6D995043800EBAF36A67EB4281726CBC7E354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yvqoigdyvtqoigay.sys

Path C:\Temp\yvqoigdyvtqoigay.sys
Size 293KB
SHA256 6880c5282e25477d67c468bee1490347465e982ec23ce4f357d8bb428a6301b3
MD5 c24c5fcc2523ca08e0a1e4a5976e0ab8
SHA1 de8de8c5d992670c6da35801d9eb723aebef7398
SHA512 6da9d6f13519eccacd23c89dab6a959dde505b8dd1a86915603a162242072ef40d833a626b0b611470b6da4d3e92074e8198030844f5251a0fa3946f584bf650
SSDEEP 3072:KtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:KIJjiJcbI03GBc3ucY5DCSj
TLSH
T1D5545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9ac04be28534ffc90f065c5357ca3a80ca723726cde5efb88f8a7e1a6b44baca
MD5 b73ee45352458e50358c0ccfe08f6cf9
SHA1 c9670f21ef5a19258323e88f363ca274d9b861a3
SHA512 a0988cd4a43f2f8fe9ab537054ce760518819b4a5b241855d7dd15687bd71afc74fa5b853542182d12a3a9aebcf68ff8590341f7237f1283b2b611b7b5610238
TLSH
T11DD012143718648BCD1A2571D8318381A666846125598F4560A1924D9D69493539A396
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7207f4c246d3ac882ff42358926e52b8316dd22bb03c5644ebc6f2dbc1168a28
MD5 b7329a74f1fa351c02d17b8e2692e575
SHA1 ef3d4b0eaaee583b5233cc6fc44fd331077feaf2
SHA512 650d63f3a2e065e3c2e4933483e10d79ab609f116a4e0bf7e107adff2025a85d1c77c68f86e7604724ab7da540f31911cd91f5e49bbae26354b6446fe249827e
TLSH
T146D012143718648BC91A2571D4318381A6668421215A8F4564A1D24D9D69493A39A392
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 8c4b769c1e7c5f26039ea4be106634cc912eb02aad1b0f2d75b356b0294a628c
MD5 a4f289a957aab40ba7039a912912fcf2
SHA1 02b7edea627ec0efa57ad2abab0f9ed649a6bddf
SHA512 39e208ce589363d4f9856d117971515078d4be279b9351733bcec0cf950bbf8957b0b1edd9ec10a79ba7b87f727a797cfa30d996106a7f581850433668c94f1c
TLSH
T1A5E022A6C861EC2F08F91B192170569FEB54131A2B40594BBB3C820C8FB163F098692C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 05ff902fa94d0f79bf993234187bc520a11ead59e6f29d8105f85a6096d18625
MD5 fb8f58b4f504fa1a23d52d8070c45ee6
SHA1 97de32226ca533e8165d16f2a350f6e1ec6d5732
SHA512 e6f205f18e4e3a4aca77e12f84bcdf24254d1a08ac87f6aa346baafe7accbd1faf13399f8a06445bff1195872ce021a9c15e586232578c92d5c67892698db9be
TLSH
T14E51CEF7C3E8866DD90195F0BA187E2BCE1D0915832C3D5AC8E4EF1B93E2471E141A9E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 4c257eac80a7d261813134b92308528335093bbc3b76208e1ea5a335161007db
MD5 c44ff542617c279483fff8fbf94c81f7
SHA1 fb040e06cab04dccce8c9fa5d179d95e460a0585
SHA512 b618f34e31310632bf1e52cdb1afb07207a182c7c0ab70a973c644087d94dc1e1c17547e70a99a017a9bd1fda9d28f80dc54c29bfb4d247baeddc510df0f3512
SSDEEP 192:sxRVN0RIYVyMqZjK1Ml8UQY5cYw/fRWsYGxdF5xAZUBMUEZzoA8prVA/g6+WNCVO:sxRMgqpP/fUs3BbeUBVG/5m/Ck4
TLSH
T1BD720A166924597BCCD7D219FA85BF93D6F85573A2904E04AAFC8B0C01E76ED221383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 6ed6010661f9d1cda6230721fa7098defcb8bd0dfd5d2ec5d36cdcb2b3fbe9a8
MD5 8a9086b485448f954624744abb3078d8
SHA1 a89ed8007dd9b01e1ad1780f0bbe36b767ccd233
SHA512 b08277b130369f724d79ccdde2a021db0d5997ca5776b7052eb4bca50bd39f009be93990abe0cef2a902c5cc5c061d8c086995a6d79c30c5fc7e3567f551bb52
SSDEEP 192:sxRVN0RIYVyMqZjK1Ml8wcYw/fRWsXxdFFAZUBMUEZzoA8prVA/g6+WNCV7B/YUi:sxRMgCP/fUsXBFeUBVG/5m/Lj2
TLSH
T11B72FA1A6964597B8CD7D219FA95BF53D7F81523A2904E04AEFC8B0C01E76ED221383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 830e5e48e0a944c8b72cd594c459742b6e98555ef96136f9ab6e31742c762e1b
MD5 5003273f96bd82a46289a7c2e167105d
SHA1 4b5a15c742680cbe71ca41cabf553a1ee94c4833
SHA512 998e8fb9412d7021723d09dc67061d6f71179067ef15103a5b5188b69988d249e10c93294a06da7b3232f038574a882e69dd3a2c04fd53abface5f0a93838dc1
SSDEEP 768:4eOlrA7pLuL7P6WgSYf9S8F1+UoAYDCx9Tuqh0VfUC9xbog/OVNFpuOGirocq:4eOlrME7P6WgSYf9Su1jaWFpTG5l
TLSH
T17AE2FD3B680CC77E4F80499CED29BD9A6DE802CF5AD8C95447EA440C03C66EF561A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 2f51101c9bb9c558d48c690f56244d8743896ee0386465ff7adb8d6e136282e5
MD5 eb02dea1fd926085ef35761351e8f771
SHA1 97c32f8fbe8cb20de303c77614c9e1c8144ab8e7
SHA512 af651c444cb206894ff84788799e1a35ab1ec7061f472cb8bf33345d0ce827291937fbb7457964ddcb95509a09e32dbc95f22301e60fb30848b62bdd9daacd4a
SSDEEP 384:9WhIEeUI94LU82K3iXGuTQIVlgBFTzTyLuFVdv3n+FNmP13ObHd59wh8r/j931Iu:UVI1zrZi+JK9ALXES7ME
TLSH
T154B29D5171BA1B01383D280D93B9D41F1A4630A230DEA97B7BA935E56F67F000EFDAD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 a83a3729babbb6f6dead10d795bbed8f79aa0abe3f2deb894aced40a8aece698
MD5 faa674c998ba94594d8bbc423a7447eb
SHA1 f25e6e1a9740b18a0910298f4de540ed54816ae5
SHA512 9be68f23fef96d2d5d2cad06bafb0116570d6a9bb757490dc4e95a40005c19a404f4d450fe0645d8f4e4fbbb58f5eae4cf1a403fa0611d5ec0a95d0cf39b2092
SSDEEP 768:nF1j+9gqwgN11vn9FGKQa88Kf4mTGf78Kzvp:O9gohT8bfhA7tzvp
TLSH
T1A8C25C36E865CE77ACE74BD9B3067657EEE012B3C5885ED4E6C81D4C00D729E134B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 185aa449d2259159649c8f0967491198203ec69cedf2247f20ea609e199f78a8
MD5 136a924d8a42e9bb4b06abe59b633071
SHA1 1df2c51a95a959ae194567a4fef8f96a899c04c9
SHA512 176f890e7cc4cba2de40df772facc03e10a95a7bc64c82288e5e7aad7ac5ba1037179c7d82d3e000aa01ca33dd6f727c571407729daf351e2c61617de9600f8a
SSDEEP 768:FF1j+9gqwgY51vn9FGKQa88Kf4mTGf78Kzvj:M9gllT8bfhA7tzvj
TLSH
T1B0C25C36E8A5CE77ACE74BD9B7067657EEE012B3C5885ED4EAC81D4C00D729E130B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 95dfb3880bab948c7ab1f7267fc891d1c7e5432249fabdec78a5ead341cf6884
MD5 afd8c78c6cd0dd8a0e4ff09537753a33
SHA1 f6d8a0f1dd94735af431899c64ec56a47da1dac7
SHA512 7fba8e064392600521cafea187e5e4fb8ded28d60e6929a8b08a164f591fa16ac2dd867316c58e986256d1bd170f1f337f6f58b8a2ea765cf4921248d9a95e11
SSDEEP 768:mF1j+9nqwgNQ1vn9FGKQa88Kf4myOf78Kzvp:T9noAT8bf0Y7tzvp
TLSH
T1ACE2B3F198D78A76D8EE4B87633D6E469EFCC163B5484994B7C81D0CCC821BFD20A806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 068be36954371fd768eb9b51756d10e0501824151fd3fdb3b2e8d9686708776c
MD5 13d99ea4fbd32f08f961fb486b19e3bc
SHA1 a6a43f9274709d710f3531a4c62111a62d01bc32
SHA512 b2108f747fddcaef028db5cabba934069bb115163e603e997496fad718f873f3af07b0f287c67a6fee7fbc21d70cc5ba4ab9af79fa5feb33f8e2190cad8ff116
TLSH
T1713142E098382DC5C4FE09BEB48B39FC98E9C226F594347D6854EC55927E64D618083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 5e928b01cf758898144dc4a5f44d3475c3c9ddbf38e15ed59901f8888d2e0ae8
MD5 73f29c4a7b45e24b6f97fb65acd44ca5
SHA1 a093226d8dc1a56fc5c1f46c0259a92fed735419
SHA512 4746c23fbd06677022ebbce1dc4856d1e0f4d5dccd64c9b655a51a3a82da5d6706a39f22445d75688ba2d8e15d72151a6bd9db6fd0ea06615836ed617e4bf793
TLSH
T1913161E0583829D5C4BE09BEB48738FC94E8C726F4A4307D6848E998867A24DA18183F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 bf68e938527b44f24ff29cbc568b0725f9c70c6968eff7123bd820a1ebb5695e
MD5 68a9a58a4c0cb41c7a5b811bcd56cb55
SHA1 09caddf9420d4379551224d0112002fcdba0e281
SHA512 83f53b4f65a5d0db35d96c7bcf8ef23b81fb69ac0c67d0cf369545159d10b93ca9f04fb5dc22e71b2725dd81d3f8ceda10e5003822ddc4bf2f00063c18f5f9db
TLSH
T12E3166E059383DC1C4BE09BFB45739FC98E9C216F954357D6444EC95913E14E618083F
MD5 SHA1 SHA512 TLSH

Submit Download

e18db39a-e2f9-4b1a-9bb8-63c696a7d2d6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e18db39a-e2f9-4b1a-9bb8-63c696a7d2d6.tmp
Size 27KB
SHA256 488bf5d594428ef24c3c05e0ecaa478dd3773ac0aecab79decb7c6615c2210fc
MD5 692d193df6e177230275872aa3a28d97
SHA1 acd4ba96f41deca8e21b2186bfa0fa82da8bf6ad
SHA512 0cca07dca64b738e40b1fed84f891e7cbcb0212da01d6bc1b55babfb766cbb8e6c741764a4c584cc97b06cb71b2ed331f0933b36fe3dd3970187bc621fa7a1ef
SSDEEP 768:ZF1j+9KLwgRT1vn9FGKQa88Kf4mHGfmn12bfJz:o9KDvT8bf1A0yJz
TLSH
T19AC24B36D864CE67ACE78FD9B74A7656EEE012B3C58C5AD4EAC80D4C00D729E130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 d752d660c241002fb2611acb1e670bc5243b0d2646560c9d843941038584cb83
MD5 5e71b9a9d15d6fe1f2741dc5cafd4a6c
SHA1 0f363ab044622840582302bcd949c59b60261d26
SHA512 9b7ff516323256393f0bd8fb182075b9bf486c7ddea043970c3ebc7bb86445ddff3fa808a1b1352a13d86edd1858c9e435904476c030f467d4ced7f49f4ee590
TLSH
T1B971239357A9C6F2C5DE5FF102839244F2FB22780763302007A65586EB30E7A54F8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/716-280-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/840-61-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2504-342-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2548-379-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2696-190-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3404-384-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3556-274-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3840-427-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3944-210-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4980-284-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5068-407-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5168-238-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5336-337-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5388-288-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6172-339-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6456-378-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6900-305-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/7056-396-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/7136-222-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/7140-155-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/7160-334-0x0000000000010000-0x00000000000AB000-memory.dmp

Download