systex | 6409c4ddc8f547f724995f0b1c0ca6f42b6ddb2f2cf0cfe3427f4e8c24b6fc42

Analysis

max time kernel
149s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 17:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_8d607f92c089247b5c3b71e34cfb999d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Size 365KB
Sample260706-wkhv3aex3m
SHA256 6409c4ddc8f547f724995f0b1c0ca6f42b6ddb2f2cf0cfe3427f4e8c24b6fc42
MD5 8d607f92c089247b5c3b71e34cfb999d
SHA1 4260edc94b0ea77276c7e82df878f0fd777b795f
SHA512 1171511d566483d5bde16a343accfa6d88f92a32611ed8a12dab17040551c3131ac7574eabc6712cc67167bcd08d85b1ca63386315df12fc294642997a6d1437
SSDEEP 3072:MuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:MuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F1847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
5104	pkhcausmkecxupmk.exe
1516	pkhcausmkecxupmk.sys
4300	CreateProcess.exe
712	mkecxupnhc.exe
2720	CreateProcess.exe
4452	CreateProcess.exe
4840	i_mkecxupnhc.exe
5716	zxrpjhczus.sys
4316	CreateProcess.exe
4836	pjhczupmec.exe
5792	CreateProcess.exe
2688	CreateProcess.exe
1908	i_pjhczupmec.exe
3392	eztrmjebzt.sys
2780	CreateProcess.exe
3600	omgeywrojh.exe
1312	CreateProcess.exe
1020	CreateProcess.exe
4076	i_omgeywrojh.exe
2456	geywtomgey.sys
2040	CreateProcess.exe
5988	eywrojgbzt.exe
1556	CreateProcess.exe
1384	CreateProcess.exe
3564	i_eywrojgbzt.exe
2572	vtoljbywqo.sys
2768	CreateProcess.exe
2080	igbvtnljdb.exe
1860	CreateProcess.exe
2644	CreateProcess.exe
4880	i_igbvtnljdb.exe
4812	ljgaytqljd.sys
848	CreateProcess.exe
5320	igaysqoigd.exe
1420	CreateProcess.exe
5716	CreateProcess.exe
4840	i_igaysqoigd.exe
6048	xvtnlfdavs.sys
4208	CreateProcess.exe
3856	sqkidavtnl.exe
1284	CreateProcess.exe
3960	CreateProcess.exe
3064	i_sqkidavtnl.exe
860	vpnkfdxvpn.sys
3220	CreateProcess.exe
1592	xspnhfaxvp.exe
4864	CreateProcess.exe
2256	CreateProcess.exe
404	i_xspnhfaxvp.exe
5952	spnhfzxspk.sys
2856	CreateProcess.exe
760	jhfcxrpnhc.exe
1956	CreateProcess.exe
1472	CreateProcess.exe
5112	i_jhfcxrpnhc.exe
5316	rpjhczxrpj.sys
756	CreateProcess.exe
1800	rpkhcaurpj.exe
5620	CreateProcess.exe
1744	CreateProcess.exe
4688	i_rpkhcaurpj.exe
3580	jhezwuomke.sys
4592	CreateProcess.exe
404	hbzwurmjhb.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkecxupnhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhczupmec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhczupmec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywrojgbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbzwurmjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kifaxsqnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uspnhfcxus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkecxupnhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgeywrojh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywrojgbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xspnhfaxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcxsmkhfax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pkhcausmkecxupmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igaysqoigd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhfcxrpnhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgeywrojh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkidavtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkidavtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpkhcaurpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbzwurmjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgeywuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kifaxsqnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebzxupmkhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igbvtnljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igaysqoigd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xspnhfaxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbytqoljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbytqoljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlfdbytqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnlfdaysnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-06_8d607f92c089247b5c3b71e34cfb999d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgeywuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnlfdaysnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uspnhfcxus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igbvtnljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhfcxrpnhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpkhcaurpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fcxsmkhfax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebzxupmkhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlfdbytqli.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1616	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1244	ipconfig.exe
3064	ipconfig.exe
2368	ipconfig.exe
5136	ipconfig.exe
2980	ipconfig.exe
3064	ipconfig.exe
4208	ipconfig.exe
5012	ipconfig.exe
2308	ipconfig.exe
4832	ipconfig.exe
4564	ipconfig.exe
4496	ipconfig.exe
5160	ipconfig.exe
5736	ipconfig.exe
2020	ipconfig.exe
6048	ipconfig.exe
3364	ipconfig.exe
1732	ipconfig.exe
3640	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134278343339349798"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3047816590-610495838-277027736-1000\{E9AC0CF6-BE9C-4FB0-B0AD-747CCEB45A85}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1056	2026-07-06_8d607f92c089247b5c3b71e34cfb999d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1056	2026-07-06_8d607f92c089247b5c3b71e34cfb999d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1056	2026-07-06_8d607f92c089247b5c3b71e34cfb999d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1056	2026-07-06_8d607f92c089247b5c3b71e34cfb999d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1056	2026-07-06_8d607f92c089247b5c3b71e34cfb999d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1056	2026-07-06_8d607f92c089247b5c3b71e34cfb999d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1056	2026-07-06_8d607f92c089247b5c3b71e34cfb999d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1056	2026-07-06_8d607f92c089247b5c3b71e34cfb999d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1056	2026-07-06_8d607f92c089247b5c3b71e34cfb999d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1056	2026-07-06_8d607f92c089247b5c3b71e34cfb999d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1056	2026-07-06_8d607f92c089247b5c3b71e34cfb999d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1056	2026-07-06_8d607f92c089247b5c3b71e34cfb999d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1056	2026-07-06_8d607f92c089247b5c3b71e34cfb999d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1056	2026-07-06_8d607f92c089247b5c3b71e34cfb999d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1056	2026-07-06_8d607f92c089247b5c3b71e34cfb999d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1056	2026-07-06_8d607f92c089247b5c3b71e34cfb999d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1056	2026-07-06_8d607f92c089247b5c3b71e34cfb999d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1056	2026-07-06_8d607f92c089247b5c3b71e34cfb999d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1056	2026-07-06_8d607f92c089247b5c3b71e34cfb999d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1056	2026-07-06_8d607f92c089247b5c3b71e34cfb999d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1056	2026-07-06_8d607f92c089247b5c3b71e34cfb999d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1056	2026-07-06_8d607f92c089247b5c3b71e34cfb999d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1056	2026-07-06_8d607f92c089247b5c3b71e34cfb999d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1056	2026-07-06_8d607f92c089247b5c3b71e34cfb999d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1056	2026-07-06_8d607f92c089247b5c3b71e34cfb999d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1056	2026-07-06_8d607f92c089247b5c3b71e34cfb999d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1056	2026-07-06_8d607f92c089247b5c3b71e34cfb999d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1056	2026-07-06_8d607f92c089247b5c3b71e34cfb999d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1056	2026-07-06_8d607f92c089247b5c3b71e34cfb999d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1056	2026-07-06_8d607f92c089247b5c3b71e34cfb999d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1056	2026-07-06_8d607f92c089247b5c3b71e34cfb999d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1056	2026-07-06_8d607f92c089247b5c3b71e34cfb999d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1056	2026-07-06_8d607f92c089247b5c3b71e34cfb999d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1056	2026-07-06_8d607f92c089247b5c3b71e34cfb999d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1056	2026-07-06_8d607f92c089247b5c3b71e34cfb999d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1056	2026-07-06_8d607f92c089247b5c3b71e34cfb999d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1056	2026-07-06_8d607f92c089247b5c3b71e34cfb999d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1056	2026-07-06_8d607f92c089247b5c3b71e34cfb999d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1056	2026-07-06_8d607f92c089247b5c3b71e34cfb999d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1056	2026-07-06_8d607f92c089247b5c3b71e34cfb999d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1056	2026-07-06_8d607f92c089247b5c3b71e34cfb999d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1056	2026-07-06_8d607f92c089247b5c3b71e34cfb999d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1056	2026-07-06_8d607f92c089247b5c3b71e34cfb999d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1056	2026-07-06_8d607f92c089247b5c3b71e34cfb999d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1056	2026-07-06_8d607f92c089247b5c3b71e34cfb999d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1056	2026-07-06_8d607f92c089247b5c3b71e34cfb999d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1056	2026-07-06_8d607f92c089247b5c3b71e34cfb999d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1056	2026-07-06_8d607f92c089247b5c3b71e34cfb999d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1056	2026-07-06_8d607f92c089247b5c3b71e34cfb999d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1056	2026-07-06_8d607f92c089247b5c3b71e34cfb999d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1056	2026-07-06_8d607f92c089247b5c3b71e34cfb999d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1056	2026-07-06_8d607f92c089247b5c3b71e34cfb999d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1056	2026-07-06_8d607f92c089247b5c3b71e34cfb999d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1056	2026-07-06_8d607f92c089247b5c3b71e34cfb999d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1056	2026-07-06_8d607f92c089247b5c3b71e34cfb999d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1056	2026-07-06_8d607f92c089247b5c3b71e34cfb999d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5104	pkhcausmkecxupmk.exe
5104	pkhcausmkecxupmk.exe
5104	pkhcausmkecxupmk.exe
5104	pkhcausmkecxupmk.exe
5104	pkhcausmkecxupmk.exe
5104	pkhcausmkecxupmk.exe
5104	pkhcausmkecxupmk.exe
5104	pkhcausmkecxupmk.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	4840	i_mkecxupnhc.exe
Token: SeDebugPrivilege	1908	i_pjhczupmec.exe
Token: SeDebugPrivilege	4076	i_omgeywrojh.exe
Token: SeDebugPrivilege	3564	i_eywrojgbzt.exe
Token: SeDebugPrivilege	4880	i_igbvtnljdb.exe
Token: SeDebugPrivilege	4840	i_igaysqoigd.exe
Token: SeDebugPrivilege	3064	i_sqkidavtnl.exe
Token: SeDebugPrivilege	404	i_xspnhfaxvp.exe
Token: SeDebugPrivilege	5112	i_jhfcxrpnhc.exe
Token: SeDebugPrivilege	4688	i_rpkhcaurpj.exe
Token: SeDebugPrivilege	1536	i_hbzwurmjhb.exe
Token: SeDebugPrivilege	3864	i_jgeywuomge.exe
Token: SeDebugPrivilege	4456	i_jdbytqoljd.exe
Token: SeDebugPrivilege	4800	i_nlfdbytqli.exe
Token: SeDebugPrivilege	3064	i_qnlfdaysnl.exe
Token: SeDebugPrivilege	4812	i_kifaxsqnif.exe
Token: SeDebugPrivilege	5316	i_uspnhfcxus.exe
Token: SeDebugPrivilege	4476	i_fcxsmkhfax.exe
Token: SeDebugPrivilege	5668	i_ebzxupmkhb.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2160	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 5104	1056	2026-07-06_8d607f92c089247b5c3b71e34cfb999d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	88
PID 1056 wrote to memory of 1868	1056	2026-07-06_8d607f92c089247b5c3b71e34cfb999d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	89
PID 1868 wrote to memory of 2160	1868	iexplore.exe	90
PID 2160 wrote to memory of 4228	2160	msedge.exe	91
PID 2160 wrote to memory of 2464	2160	msedge.exe	93
PID 2160 wrote to memory of 1616	2160	msedge.exe	94
PID 2160 wrote to memory of 2464	2160	msedge.exe	93
PID 2160 wrote to memory of 2464	2160	msedge.exe	93
PID 2160 wrote to memory of 4160	2160	msedge.exe	95
PID 2160 wrote to memory of 4160	2160	msedge.exe	95
PID 2160 wrote to memory of 696	2160	msedge.exe	96
PID 2160 wrote to memory of 696	2160	msedge.exe	96
PID 2160 wrote to memory of 696	2160	msedge.exe	96
PID 2160 wrote to memory of 5852	2160	msedge.exe	97
PID 2160 wrote to memory of 5852	2160	msedge.exe	97
PID 2160 wrote to memory of 5852	2160	msedge.exe	97
PID 2160 wrote to memory of 3964	2160	msedge.exe	99
PID 2160 wrote to memory of 5544	2160	msedge.exe	98
PID 2160 wrote to memory of 3964	2160	msedge.exe	99
PID 2160 wrote to memory of 3964	2160	msedge.exe	99
PID 2160 wrote to memory of 5544	2160	msedge.exe	98
PID 2160 wrote to memory of 5544	2160	msedge.exe	98
PID 2160 wrote to memory of 2784	2160	msedge.exe	100
PID 2160 wrote to memory of 2784	2160	msedge.exe	100
PID 5104 wrote to memory of 4300	5104	pkhcausmkecxupmk.exe	104
PID 712 wrote to memory of 2720	712	mkecxupnhc.exe	107
PID 2160 wrote to memory of 5972	2160	msedge.exe	111
PID 2160 wrote to memory of 5728	2160	msedge.exe	110
PID 2160 wrote to memory of 5972	2160	msedge.exe	111
PID 2160 wrote to memory of 5728	2160	msedge.exe	110
PID 2160 wrote to memory of 5092	2160	msedge.exe	113
PID 5104 wrote to memory of 4452	5104	pkhcausmkecxupmk.exe	116
PID 5104 wrote to memory of 4316	5104	pkhcausmkecxupmk.exe	120
PID 4836 wrote to memory of 5792	4836	pjhczupmec.exe	122
PID 5104 wrote to memory of 2688	5104	pkhcausmkecxupmk.exe	125
PID 5104 wrote to memory of 2780	5104	pkhcausmkecxupmk.exe	129
PID 3600 wrote to memory of 1312	3600	omgeywrojh.exe	131
PID 5104 wrote to memory of 1020	5104	pkhcausmkecxupmk.exe	134
PID 2160 wrote to memory of 1256	2160	msedge.exe	136
PID 2160 wrote to memory of 1256	2160	msedge.exe	136
PID 2160 wrote to memory of 5368	2160	msedge.exe	137
PID 2160 wrote to memory of 5368	2160	msedge.exe	137
PID 5104 wrote to memory of 2040	5104	pkhcausmkecxupmk.exe	141
PID 5988 wrote to memory of 1556	5988	eywrojgbzt.exe	143
PID 5104 wrote to memory of 1384	5104	pkhcausmkecxupmk.exe	146
PID 2160 wrote to memory of 4852	2160	msedge.exe	148
PID 2160 wrote to memory of 3916	2160	msedge.exe	149
PID 2160 wrote to memory of 3528	2160	msedge.exe	150
PID 5104 wrote to memory of 2768	5104	pkhcausmkecxupmk.exe	153
PID 2080 wrote to memory of 1860	2080	igbvtnljdb.exe	155
PID 5104 wrote to memory of 2644	5104	pkhcausmkecxupmk.exe	158
PID 5104 wrote to memory of 848	5104	pkhcausmkecxupmk.exe	162
PID 5320 wrote to memory of 1420	5320	igaysqoigd.exe	164
PID 5104 wrote to memory of 5716	5104	pkhcausmkecxupmk.exe	167
PID 5104 wrote to memory of 4208	5104	pkhcausmkecxupmk.exe	171
PID 3856 wrote to memory of 1284	3856	sqkidavtnl.exe	173
PID 5104 wrote to memory of 3960	5104	pkhcausmkecxupmk.exe	176
PID 5104 wrote to memory of 3220	5104	pkhcausmkecxupmk.exe	180
PID 1592 wrote to memory of 4864	1592	xspnhfaxvp.exe	182
PID 5104 wrote to memory of 2256	5104	pkhcausmkecxupmk.exe	185
PID 2160 wrote to memory of 5464	2160	msedge.exe	187
PID 2160 wrote to memory of 5464	2160	msedge.exe	187
PID 5104 wrote to memory of 2856	5104	pkhcausmkecxupmk.exe	193
PID 760 wrote to memory of 1956	760	jhfcxrpnhc.exe	195

C:\Users\Admin\AppData\Local\Temp\2026-07-06_8d607f92c089247b5c3b71e34cfb999d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_8d607f92c089247b5c3b71e34cfb999d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Temp\pkhcausmkecxupmk.exe
  C:\Temp\pkhcausmkecxupmk.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5104
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mkecxupnhc.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4300
  - - C:\Temp\mkecxupnhc.exe
      C:\Temp\mkecxupnhc.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:712
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2720
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4496
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mkecxupnhc.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4452
  - - C:\Temp\i_mkecxupnhc.exe
      C:\Temp\i_mkecxupnhc.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4840
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pjhczupmec.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4316
  - - C:\Temp\pjhczupmec.exe
      C:\Temp\pjhczupmec.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4836
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5792
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5160
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pjhczupmec.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2688
  - - C:\Temp\i_pjhczupmec.exe
      C:\Temp\i_pjhczupmec.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1908
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\omgeywrojh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2780
  - - C:\Temp\omgeywrojh.exe
      C:\Temp\omgeywrojh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3600
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1312
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1244
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_omgeywrojh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1020
  - - C:\Temp\i_omgeywrojh.exe
      C:\Temp\i_omgeywrojh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4076
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\eywrojgbzt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2040
  - - C:\Temp\eywrojgbzt.exe
      C:\Temp\eywrojgbzt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5988
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1556
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4208
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_eywrojgbzt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1384
  - - C:\Temp\i_eywrojgbzt.exe
      C:\Temp\i_eywrojgbzt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3564
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\igbvtnljdb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2768
  - - C:\Temp\igbvtnljdb.exe
      C:\Temp\igbvtnljdb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2080
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1860
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5012
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_igbvtnljdb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2644
  - - C:\Temp\i_igbvtnljdb.exe
      C:\Temp\i_igbvtnljdb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4880
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\igaysqoigd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:848
  - - C:\Temp\igaysqoigd.exe
      C:\Temp\igaysqoigd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5320
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1420
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2308
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_igaysqoigd.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5716
  - - C:\Temp\i_igaysqoigd.exe
      C:\Temp\i_igaysqoigd.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4840
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqkidavtnl.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4208
  - - C:\Temp\sqkidavtnl.exe
      C:\Temp\sqkidavtnl.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3856
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1284
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3364
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqkidavtnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3960
  - - C:\Temp\i_sqkidavtnl.exe
      C:\Temp\i_sqkidavtnl.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3064
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xspnhfaxvp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3220
  - - C:\Temp\xspnhfaxvp.exe
      C:\Temp\xspnhfaxvp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1592
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4864
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1732
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xspnhfaxvp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2256
  - - C:\Temp\i_xspnhfaxvp.exe
      C:\Temp\i_xspnhfaxvp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:404
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jhfcxrpnhc.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2856
  - - C:\Temp\jhfcxrpnhc.exe
      C:\Temp\jhfcxrpnhc.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:760
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1956
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5736
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jhfcxrpnhc.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1472
  - - C:\Temp\i_jhfcxrpnhc.exe
      C:\Temp\i_jhfcxrpnhc.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5112
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rpkhcaurpj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:756
  - - C:\Temp\rpkhcaurpj.exe
      C:\Temp\rpkhcaurpj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1800
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5620
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3064
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rpkhcaurpj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1744
  - - C:\Temp\i_rpkhcaurpj.exe
      C:\Temp\i_rpkhcaurpj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4688
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hbzwurmjhb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4592
  - - C:\Temp\hbzwurmjhb.exe
      C:\Temp\hbzwurmjhb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:404
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3264
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2020
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hbzwurmjhb.exe ups_ins
    3⤵
    PID:3768
  - - C:\Temp\i_hbzwurmjhb.exe
      C:\Temp\i_hbzwurmjhb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1536
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jgeywuomge.exe ups_run
    3⤵
    PID:5872
  - - C:\Temp\jgeywuomge.exe
      C:\Temp\jgeywuomge.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5740
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4840
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6048
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jgeywuomge.exe ups_ins
    3⤵
    PID:5360
  - - C:\Temp\i_jgeywuomge.exe
      C:\Temp\i_jgeywuomge.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3864
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jdbytqoljd.exe ups_run
    3⤵
    PID:3948
  - - C:\Temp\jdbytqoljd.exe
      C:\Temp\jdbytqoljd.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:928
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3492
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3640
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jdbytqoljd.exe ups_ins
    3⤵
    PID:5248
  - - C:\Temp\i_jdbytqoljd.exe
      C:\Temp\i_jdbytqoljd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4456
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nlfdbytqli.exe ups_run
    3⤵
    PID:5336
  - - C:\Temp\nlfdbytqli.exe
      C:\Temp\nlfdbytqli.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1036
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1888
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2368
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nlfdbytqli.exe ups_ins
    3⤵
    PID:904
  - - C:\Temp\i_nlfdbytqli.exe
      C:\Temp\i_nlfdbytqli.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4800
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qnlfdaysnl.exe ups_run
    3⤵
    PID:1164
  - - C:\Temp\qnlfdaysnl.exe
      C:\Temp\qnlfdaysnl.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2788
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1052
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5136
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qnlfdaysnl.exe ups_ins
    3⤵
    PID:860
  - - C:\Temp\i_qnlfdaysnl.exe
      C:\Temp\i_qnlfdaysnl.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3064
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kifaxsqnif.exe ups_run
    3⤵
    PID:1792
  - - C:\Temp\kifaxsqnif.exe
      C:\Temp\kifaxsqnif.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3564
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2444
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2980
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kifaxsqnif.exe ups_ins
    3⤵
    PID:4268
  - - C:\Temp\i_kifaxsqnif.exe
      C:\Temp\i_kifaxsqnif.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4812
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\uspnhfcxus.exe ups_run
    3⤵
    PID:3764
  - - C:\Temp\uspnhfcxus.exe
      C:\Temp\uspnhfcxus.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2428
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5112
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4832
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_uspnhfcxus.exe ups_ins
    3⤵
    PID:3140
  - - C:\Temp\i_uspnhfcxus.exe
      C:\Temp\i_uspnhfcxus.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5316
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fcxsmkhfax.exe ups_run
    3⤵
    PID:4328
  - - C:\Temp\fcxsmkhfax.exe
      C:\Temp\fcxsmkhfax.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1808
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5340
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4564
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fcxsmkhfax.exe ups_ins
    3⤵
    PID:2820
  - - C:\Temp\i_fcxsmkhfax.exe
      C:\Temp\i_fcxsmkhfax.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4476
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ebzxupmkhb.exe ups_run
    3⤵
    PID:5240
  - - C:\Temp\ebzxupmkhb.exe
      C:\Temp\ebzxupmkhb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3248
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3780
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3064
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ebzxupmkhb.exe ups_ins
    3⤵
    PID:5268
  - - C:\Temp\i_ebzxupmkhb.exe
      C:\Temp\i_ebzxupmkhb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5668
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x2cc,0x7ffdff27c188,0x7ffdff27c194,0x7ffdff27c1a0
      4⤵
      PID:4228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1900,i,16067935143405354676,8629949830578299979,262144 --field-trial-handle=2548,i,15857868842181746416,7577602183600161209,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:2
      4⤵
      PID:2464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2192,i,4660369177909475614,17995448413861195631,524288 --field-trial-handle=2548,i,15857868842181746416,7577602183600161209,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:11
      4⤵
      System Time Discovery
      PID:1616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2720,i,472337164226215529,10991168730749558370,524288 --field-trial-handle=2548,i,15857868842181746416,7577602183600161209,262144 --variations-seed-version --mojo-platform-channel-handle=3220 /prefetch:13
      4⤵
      PID:4160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3604,i,7362002213069834149,5094922952623313317,2097152 --field-trial-handle=2548,i,15857868842181746416,7577602183600161209,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
      4⤵
      PID:696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3608,i,7175406051308530327,3677232928498725190,2097152 --field-trial-handle=2548,i,15857868842181746416,7577602183600161209,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:1
      4⤵
      PID:5852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4324,i,11975892480876319166,2547354770856021397,2097152 --field-trial-handle=2548,i,15857868842181746416,7577602183600161209,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:1
      4⤵
      PID:5544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4340,i,9416700021404198692,14906911938500272620,2097152 --field-trial-handle=2548,i,15857868842181746416,7577602183600161209,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:9
      4⤵
      PID:3964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3664,i,17961199711653620904,8421562790173216152,524288 --field-trial-handle=2548,i,15857868842181746416,7577602183600161209,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
      4⤵
      PID:2784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,11849923300961146121,11488962929129279873,524288 --field-trial-handle=2548,i,15857868842181746416,7577602183600161209,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:14
      4⤵
      PID:5728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,8639228782369552685,16606866302839887179,524288 --field-trial-handle=2548,i,15857868842181746416,7577602183600161209,262144 --variations-seed-version --mojo-platform-channel-handle=3780 /prefetch:14
      4⤵
      PID:5972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,9824710781550329077,16518794228639320017,524288 --field-trial-handle=2548,i,15857868842181746416,7577602183600161209,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:14
      4⤵
      PID:1860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,9824710781550329077,16518794228639320017,524288 --field-trial-handle=2548,i,15857868842181746416,7577602183600161209,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:14
      4⤵
      PID:5092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,17103617479336004134,504661942688130548,524288 --field-trial-handle=2548,i,15857868842181746416,7577602183600161209,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:14
      4⤵
      PID:1256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,13310273890957857420,1822378753652422968,524288 --field-trial-handle=2548,i,15857868842181746416,7577602183600161209,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:14
      4⤵
      PID:5368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1300,i,16891844344394816297,5617062617967033881,524288 --field-trial-handle=2548,i,15857868842181746416,7577602183600161209,262144 --variations-seed-version --mojo-platform-channel-handle=1436 /prefetch:14
      4⤵
      PID:4852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1120,i,8076918433313642653,15502870060634533444,524288 --field-trial-handle=2548,i,15857868842181746416,7577602183600161209,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:14
      4⤵
      PID:3916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1304,i,7329726001662124109,14007719960451421292,524288 --field-trial-handle=2548,i,15857868842181746416,7577602183600161209,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:14
      4⤵
      PID:3528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,1245896018657547132,2107072728065944806,524288 --field-trial-handle=2548,i,15857868842181746416,7577602183600161209,262144 --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:14
      4⤵
      PID:5464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5764,i,6386174988546086497,17446824251110153869,262144 --field-trial-handle=2548,i,15857868842181746416,7577602183600161209,262144 --variations-seed-version --mojo-platform-channel-handle=800 /prefetch:10
      4⤵
      PID:1804

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5360

C:\Temp\pkhcausmkecxupmk.sys
C:\Temp\pkhcausmkecxupmk.sys
1⤵
- Executes dropped EXE
PID:1516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:708

C:\Temp\zxrpjhczus.sys
C:\Temp\zxrpjhczus.sys
1⤵
- Executes dropped EXE
PID:5716

C:\Temp\eztrmjebzt.sys
C:\Temp\eztrmjebzt.sys
1⤵
- Executes dropped EXE
PID:3392

C:\Temp\geywtomgey.sys
C:\Temp\geywtomgey.sys
1⤵
- Executes dropped EXE
PID:2456

C:\Temp\vtoljbywqo.sys
C:\Temp\vtoljbywqo.sys
1⤵
- Executes dropped EXE
PID:2572

C:\Temp\ljgaytqljd.sys
C:\Temp\ljgaytqljd.sys
1⤵
- Executes dropped EXE
PID:4812

C:\Temp\xvtnlfdavs.sys
C:\Temp\xvtnlfdavs.sys
1⤵
- Executes dropped EXE
PID:6048

C:\Temp\vpnkfdxvpn.sys
C:\Temp\vpnkfdxvpn.sys
1⤵
- Executes dropped EXE
PID:860

C:\Temp\spnhfzxspk.sys
C:\Temp\spnhfzxspk.sys
1⤵
- Executes dropped EXE
PID:5952

C:\Temp\rpjhczxrpj.sys
C:\Temp\rpjhczxrpj.sys
1⤵
- Executes dropped EXE
PID:5316

C:\Temp\jhezwuomke.sys
C:\Temp\jhezwuomke.sys
1⤵
- Executes dropped EXE
PID:3580

C:\Temp\jhbztrljdb.sys
C:\Temp\jhbztrljdb.sys
1⤵
PID:4800

C:\Temp\wromgdbwto.sys
C:\Temp\wromgdbwto.sys
1⤵
PID:696

C:\Temp\yvtqoigayv.sys
C:\Temp\yvtqoigayv.sys
1⤵
PID:5832

C:\Temp\vqnigdyvqn.sys
C:\Temp\vqnigdyvqn.sys
1⤵
PID:6132

C:\Temp\nlfdxvpnhf.sys
C:\Temp\nlfdxvpnhf.sys
1⤵
PID:3916

C:\Temp\kfcxvpnhfz.sys
C:\Temp\kfcxvpnhfz.sys
1⤵
PID:1436

C:\Temp\fcxvpnhfzu.sys
C:\Temp\fcxvpnhfzu.sys
1⤵
PID:4424

C:\Temp\hezxupmhfz.sys
C:\Temp\hezxupmhfz.sys
1⤵
PID:4088

C:\Temp\mgecwuomjh.sys
C:\Temp\mgecwuomjh.sys
1⤵
PID:936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

eywrojgbzt.exe

Path C:\Temp\eywrojgbzt.exe
Size 365KB
SHA256 b9cfc51b4bfc6636fda8e2d23a06ef0092f01e8077eea815c51676a98bc71520
MD5 c4d466b2f4f614bde761feca6d3fcda8
SHA1 75ac2ae38dfd1a56e505afefabe515c1356c005a
SHA512 c4b61f55cead9b17a03b227855cd56dbe42c187c3f8fdcc7539ab59c2bfb93fbc4b3db0ab7d564248c6e0f9b9a97e13665b52a3fd5c9a267a6dad7e17d05c965
SSDEEP 3072:BuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:BuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T189847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eztrmjebzt.sys

Path C:\Temp\eztrmjebzt.sys
Size 293KB
SHA256 a0fa0d4a6da26c3b83464ff63d69017e2afc831fdd778e513265a63a9ac56c91
MD5 799ed6882135d4f54acdcf2478abe757
SHA1 e8df137a117817063200b993a7a2da4b5eb7010c
SHA512 a957b3b3c91f6f67481c076d2ea32a40de97d9e3054f0fa00650c710a3fa728dcc5ee29f6c989548fa37da8b25cd54e8def2ab8b82b94811ca0ccaca8fce527c
SSDEEP 3072:/tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:/IJjiJcbI03GBc3ucY5DCSj
TLSH
T1EE545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geywtomgey.sys

Path C:\Temp\geywtomgey.sys
Size 293KB
SHA256 7e92aeac6978afb42580790929f59dc730a0d21f163fd2a269c5dfab450c5097
MD5 378525aff09ff9cc00fa56a0244bba51
SHA1 3650021d47049085fffdc83e134a61a3b1573789
SHA512 b8c84089bf9304a2d0c31f3988ffc280f6cf55abbb921875b7d96a0bfaf8a8df2af2c25fd5b54740a76c0f538245acf89a34cda36d1900396358acaa80e35684
SSDEEP 3072:ftKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:fIJjiJcbI03GBc3ucY5DCSj
TLSH
T1EC545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_eywrojgbzt.exe

Path C:\Temp\i_eywrojgbzt.exe
Size 365KB
SHA256 501adc4051d11b267aba506ac4acaab0145f6fbd09290dc3ff4aa74186673463
MD5 072bcd2c0f55d09f9766a7ba2883f2cb
SHA1 1f3d5e837dca4f992902522cf64a7c1cb1918231
SHA512 b8e3df2d4714e1a75d27f56b13b17735f18dfcd4de28a06b3c2a222b49901fa76d2b774e415cd1cf1f2309011bd5bac26184f943600c02274c1756d29f3fd62a
SSDEEP 3072:cuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:cuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T195847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_igbvtnljdb.exe

Path C:\Temp\i_igbvtnljdb.exe
Size 365KB
SHA256 c54ed3242497acd9e6d9f28360c56d7cdac4956b59c351478eae41615a66ac83
MD5 1d0b902d3fad2a195b6bf7226a44d05d
SHA1 60059e2bb30ed16a26e4c60940abfd093865fde5
SHA512 1f8cc755cbf157a8701feb16b0045d95e009865f5b1b3ea51cdc47b4a18b9c154f330a300477195de79e0768bcc1f3357c3747c681f36a03f30ab8dea69f6418
SSDEEP 3072:nuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:nuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F5847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mkecxupnhc.exe

Path C:\Temp\i_mkecxupnhc.exe
Size 365KB
SHA256 a95387a55f0432198d3739c862219b9bc5515be1e472c4bf63f93c43a946e24c
MD5 ef19a0cb986f7b00ad58c94c4391993f
SHA1 75fd3c30e2e1bb51cd6bc7720605cfe952058cde
SHA512 46f0736532bd69cb8e1c68cd8c48a95c832c1ddb73d5851d677b0d918545619a7b8fda708fbbcfb423c8b159b2c03756a18a668c48b02634ae09d3accd99b615
SSDEEP 3072:kuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:kuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T10A847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_omgeywrojh.exe

Path C:\Temp\i_omgeywrojh.exe
Size 365KB
SHA256 96e9feaa5d07e17eeb5b5b1d5774f3328fa2b43cc5a55d12624cc83794b72349
MD5 ae59729ec4b4bef292a9c755d443e85b
SHA1 e970129a1fbad306c6ee8bae2ab8a969e7f47295
SHA512 b0ebc7c33d5e48e2e97f9af29185b6b8ed7085c6875f4a501d4990da5d35a0bb21d7365b76bdd74b58bae4af642c9f8eeca90a14b69a0e5a7b2cfc77c87acd4d
SSDEEP 3072:BuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:BuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T11F847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pjhczupmec.exe

Path C:\Temp\i_pjhczupmec.exe
Size 365KB
SHA256 44584db569c4fa738bf202f8b2de543e3e92eaa07d93f4dda05f52a650f92ff0
MD5 9addcf8f4b42b32e4be7835a7fce8853
SHA1 e021758d5b1e4fde8e6f50150c2c48e30e42742c
SHA512 3d6712c2381334ec8052d129fea5c5300f137a41ba9eb86ced390d7109219e9e70c9364cbc083107c9b1fe54405fc517781f2526ec5507c1e798bf0b415c3951
SSDEEP 3072:ruxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:ruxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F2847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igaysqoigd.exe

Path C:\Temp\igaysqoigd.exe
Size 365KB
SHA256 fb93dfa955cc094b53137936df2ea3b617ff83f5e40f5053472e3a205770df20
MD5 3f14783d836eee6b5df7064bcfa8ed3c
SHA1 0768164cc43b8a18a652d7e5b6e505393815dff4
SHA512 aaf4667bf348b70ca50dd09fa4c689434d3dbbcee76d75fd9407155c2024dd6ee396ac0b838e8f8dc7d8b0cfc03ab68a30639624c1b20409c815a788ea91287e
SSDEEP 3072:tuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:tuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T195847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igbvtnljdb.exe

Path C:\Temp\igbvtnljdb.exe
Size 365KB
SHA256 c196cc984432a14f3f90e386c228e9ebf829c26e626dc8024b03a976d401c86c
MD5 e222e4de55d13299999740a46829b496
SHA1 f20397fb158c5b7b0cc6121f8d55449ce8008d5f
SHA512 692afaea7c75fac0adc65774f499de9f98857dec080b76407e4d903cf7e53040b03616d4dc74bfe3a7bb47e1b37bbdebda57d4e320824c926ee0ae2f5c536358
SSDEEP 3072:9uxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:9uxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T11E847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljgaytqljd.sys

Path C:\Temp\ljgaytqljd.sys
Size 293KB
SHA256 ae7c12bc1f21b7c1f5fd8f7f18e22f7fb16197b57e9b9ea5c2a59bbdb62c3926
MD5 d6b1cad099be61aa139c9c573b2e9e6d
SHA1 a73d4f84a223c8e423142dcf85ae3a8f7307b4d8
SHA512 52565466789cae6defd0024443817b2684a13e247df5f20f20d0099d098325561d7e06b58d54ee5a2ced81046d194a9fc47c79457ed7cc08b5a3260d3abef602
SSDEEP 3072:VtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:VIJjiJcbI03GBc3ucY5DCSj
TLSH
T101545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkecxupnhc.exe

Path C:\Temp\mkecxupnhc.exe
Size 365KB
SHA256 8824ddffd4c35a06b8ec81e4f4e9dcb337f50de6821bb036545431f11347c8b1
MD5 541e87bd35a6f7b7fba85f34dcb7e8cf
SHA1 9a1b8c1f099e7fbb4c4812574b7e73238065148f
SHA512 abdc5b274eb05f8d0dbdc72d40228149310e43a5a0b2081f163d83591d457cb145850d9f085a6872741f560df5ec177e67efc5b5ad5e6f33751a849b7b47fbc1
SSDEEP 3072:IuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:IuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T177847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omgeywrojh.exe

Path C:\Temp\omgeywrojh.exe
Size 365KB
SHA256 02a913f2af94d5502dc4b74eb842975cb8b4f51b911ca994774771a55a1c5ee8
MD5 d65986e0c630d95131abeff49e1210b8
SHA1 e54c02f8cf1c914b02efd3488b0986440419488d
SHA512 03a11c841f2c96a7fd4a487314a94935fb4f136b2243f09abc42f2ded60d68ba7b5603f772943c354c1ff0b35ae200991e33c30ae2c4b9a368e7bcc390e6b51e
SSDEEP 3072:uuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:uuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T183847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pjhczupmec.exe

Path C:\Temp\pjhczupmec.exe
Size 365KB
SHA256 da5a04b8ed05554959df81ac5a63207d699be38dd08c6e816ffdcde45b4cbb8f
MD5 373f7b40e2ed0ceb51156ee033750dd0
SHA1 3e68a59ae8fb32bc69a721f3571fecab72546575
SHA512 018e183fae8bcdf32898d3ca0516ac16713bfa58c924e6c158eee260fdac28afe3f4f563dda51c0835b6c325c5ca52ed42fdfae987057f78e811b272966ee173
SSDEEP 3072:/uxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:/uxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T19F847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkhcausmkecxupmk.exe

Path C:\Temp\pkhcausmkecxupmk.exe
Size 365KB
SHA256 98e8c14d331609c56f603636e47add9a94318d230d09150a546ccef7ea5347b6
MD5 3a3274dda566d2383cd98c94d42d5c24
SHA1 b363137df4b77a990a8666ff327ad22507db9371
SHA512 0ad4b722858297b6571f6f286fc46a07606ae8486adaf2fc6a5362e52f50761b8a7fc6681782790b01b4f3cc711d9e3dc311b6a16cefc06d713321829ae89e6c
SSDEEP 3072:QuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:QuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T195847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkhcausmkecxupmk.sys

Path C:\Temp\pkhcausmkecxupmk.sys
Size 293KB
SHA256 fa1afa22afdd9a8247db4166eef57a727c51c32253d081f77eb9e4fe7b252cd3
MD5 f7beb242699deedf48fc39a9e34a87ca
SHA1 b5a0d261df54ad19f7dd694f365e7e6fed0cb703
SHA512 e6a32df98bcea6416f0dbf3616d456bab2f91d912c5b2051afc52bd54a3bcd93238dbf88e630d488905d21ddeb14567b81e23c0844927cf6725d01b7479f9c57
SSDEEP 3072:+tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:+IJjiJcbI03GBc3ucY5DCSj
TLSH
T16B545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtoljbywqo.sys

Path C:\Temp\vtoljbywqo.sys
Size 293KB
SHA256 36a72d1a5808f7cbf571aefd136313d1ccba1a9cbf1108b7279c470f31e9c4a0
MD5 cba3a2829f984329b64656d31d55cbc5
SHA1 5766a561974fae40b4fc8ec0405b158e16ba4afa
SHA512 db8473d05456cd85823f0797577ff4fae4b03352cc9e80ebe5caad8a8c78db47fbfc0c3762c126f84a48fa2eb0a39ee543ce3c648191c23a8dff0a86dcc7c913
SSDEEP 3072:2tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:2IJjiJcbI03GBc3ucY5DCSj
TLSH
T1BA545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxrpjhczus.sys

Path C:\Temp\zxrpjhczus.sys
Size 293KB
SHA256 7df8b752924fab3dc47b08f90767cdafe440f75aff6df48c242b2db7746f4918
MD5 a7ebb6bda36d44a7a39f5564d0712084
SHA1 99a52c8d2bb776317680075bf2f31e12f8a64f1c
SHA512 c7cad7a8359af4f0432dd5058593f429d1dda8ad8aeeee8c1b66e8047490310531f86e4c144cbfeec5823c3bef885e40ef8182468d7dc46c6bb2b363a2f3a0bc
SSDEEP 3072:RtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:RIJjiJcbI03GBc3ucY5DCSj
TLSH
T1C3545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 233c07bfff48b5fbad30cd7d90579abd0886400017cd6e7fb037e5626abb1a4d
MD5 71fa6328268340b183c55defa643c474
SHA1 7c004defb21dc2981b3091495c900e02b34e3a86
SHA512 e5b634d358633981cd343c3da26ee18738fb6c54b2334814637e0a9a45343d14770fed7a09c63d55dd190bf7ef111664ba5872f5d5ce925e6bee783e166c75b7
TLSH
T1D4D080F437A5F505C786617357D0574173650872101647095151D02CCC645DD63DB1DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2fd9384e79508a77111bb6310e9414898358885ca508610502ff6f1a15ad704f
MD5 714e68787bb5a6d2fd82139f833a5d0d
SHA1 f7a22adc92641d05515b3ae096da910924f11c1a
SHA512 b133f27abfa4ed5bdbd3eaf997e0664f0627537d4882fdaa63c0b1b301219d07f8ba46857db9a196b1210c29ed9f79e6cfd8c688d502b118a21640805665f762
TLSH
T16DD080F43795F605C786617357D0574173750872241647095051D01CCC645DD63DB1EF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 5d6b2e149ce3e5380c06b236bb2201f0e957977d5050845a047d8764aeab43cb
MD5 ac6fb213955e9b15a88715799dcec5ba
SHA1 8c44595c4464147fef590f942e1f41e26987b04c
SHA512 a24bb55f6013d58371cf3342716563e06ba00b0c4319ee35ebac65ec36d56188dca093750f80e185ac8773c9585d2c8e0c0c0ceee78510deb0c0481919dd9357
TLSH
T15E7192D938E70A21E3D700B760F6578A33F08CBD60872E245789AF37A40E704E0C211D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5951b0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5951b0.TMP
Size 3KB
SHA256 de31042b377c1aa12a868850b33679491fa9a943d7363e7ce1ab9944910931f1
MD5 83ea39cf34f983e3f47966dcf6ec58de
SHA1 f0ce7fb176b09cf0a66bcb38e9414d0367b8cfb5
SHA512 5e78b76e720410f2a4507179ecdaeb21a65a1e2bec30a7ef1fd8ffbf7930bab60261de22112eb029ba176f72dfc071d2aad49f6b586b86bf53df5466eeab7241
TLSH
T1817171D938D70A21E7D740B760F6678A37F09CBD61872E255789AF37A40E704E0D215D
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 157ef4819af57a4cca4a9a330a07ef47c30adf92fe5b60e733cfd7f03253504b
MD5 fa172de74fcb43e218fffa1f4031c8fb
SHA1 ba98bd1c31a5edf740394e8c1900845c9fcaaa90
SHA512 c458ecebc140f339786d214303d24513e977e52e70cfe9fc63d7587f54c810005b1c6ee31a320b823fa260154bf4ffe04f218e318f334dd6ec306f41f3678288
TLSH
T1B151BEF7C3E8863D8A1156F0BB186E2BCE2D0914832C3D5AC9E4AF1B93E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 46fd5eb19691905f014ef1748f90f18c97c82526aa8a12971a8de2035f949a80
MD5 5c2755e674e7f65e5cf3c8e3ca52b11f
SHA1 5ffc55c52cde52c562e885dbe8e0a11929165128
SHA512 72dd3bbed3215ba9a7b28de744a09eacec2ca7b8b1acdcd75e45371ed3b68a92bfeb2d91300a0c9779c6b3711cc60c73a704513a8e5c06485e8f1427c464cb2e
SSDEEP 192:sxR9R3yM/jK1Ml8wcN/f+s/1UzdfCrJzoA8pi/g6+WNIYyWJDGtIgtJ:sxR9fCN/f+s/1c4Ui/5ISU3
TLSH
T18852C916AA285937CCDBD20DFA51BF53D6F91563E2900E44AAFCCA1C01E7ADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 65f5cb9171bb8f62f831294d8a5d62b9ab467fc7bbe39f530082644f3c66b8e0
MD5 69979aecf87f9deccbb6c5e2d11c57f8
SHA1 72e386552a96526a63c4d52ee01aeb1739ee2bc5
SHA512 3baee68ae0f4c48be17a9461e241344b2ac0a70fd85dde1a254c8c60126fd51e09e8d3cac048e460ea68546a550a4816b5e2c7ee6710b29a1cb94f44a7991517
SSDEEP 192:sxROR3yM/jK1Ml8wcN/f+sm1UzdfCrlzoA8p9o/g6+WNCPc/Yy3JDGtIgDdJ:sxRO5CN/f+sm1c4IS/5l/PUj
TLSH
T12C62D916AA245937CCDBD20DFA51BF53D6F95562E2900F44AAFCCA1C02E7ADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 d8aefaa8bff89957e3ec6afc2f151dc7d6bfede03514381a34f8d69fb45fd5a9
MD5 6f4a2ff6ecb45ac38ce2b66bd09f908b
SHA1 f8e716cade8b51f66cf0dc0fd2ebb5620fd0cd33
SHA512 00e44603d3fb19a8a36f11d1e871912fbfe228ea649e7ff91a267c7952828ecfdf50aaa263120dac1b6fe34f64d65bef37f9526f42c54e6d7484a8aa26a483ce
SSDEEP 192:sxROR3yM/jK1Ml8UQCcN/f+sm1UrqZUfzoA8pro/g6+WNCPc/YybJDGtIgD/J:sxRO5qxN/f+sm1g8U20/5l/DUN
TLSH
T10762C716A9245977CCDBD20DFA51BF53D6F85462E2940F48AAFCCA1C01E7ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 3a50fb94c8eefabbbc140c9fac7ff3f0d8a2250af7f1dc0d21943768c56bdb11
MD5 1d1a5a87e3bb3b9c976c367544f4dfef
SHA1 8975b4c4a142ae9869e85a2804572fccb632cd2d
SHA512 40eb3c6be2fe885d6ed0417fb4191d09e6e3691da995bfd4fa1918805f1e3a307bc9d60286ade88045abe2ecdade7cd792b455569f0fe6ff03ae2e762a6882f1
SSDEEP 768:AIox/O7pLuL7p0WguMfnA8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOccipro5alKVJ:AIox/OE7p0WguMfnAu1jazXiC5aUz
TLSH
T15EE2DB3B680CCB7E4F8449DCEC29BE9A6DA801CB96D8CD9447FA850C03C67EF55164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 4e73022422a125f1ec9a96ec8b548539e27e6f2e8abf633c757a3176ec959811
MD5 3dc47911c41a6309f5909572203a0e32
SHA1 bae3b6cb9a74552426decd6b12aa2ed84fb03bc8
SHA512 7ee5a83a779fda87282a827570a8052bcedd844b95d1ce4373f7d855faed76b92e05df2d853ec075adfe141302f7fea680ece74334d4f57e79de708e8573e305
SSDEEP 96:KAleKuoCCQgKt27nwVRnlV5WhOUgZ5K4QgX5cfXWJVKHm7KmgZ:8RzunwVRnlV0hOlZzQgXGfXWJVKHm7Kh
TLSH
T1B0913205767A1B443C3D2A1A8368886F528230A23097B92F37A850E67F27E155FFD9D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59edd1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59edd1.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 450c1676493eab5300a9dd5449def8230d7872eaa6b33fdca8e166b5463520d5
MD5 67c449c83495300f3f83c2375bdb446c
SHA1 52c787f46306f6feae79748b2ad05b1d0d926111
SHA512 92949c322d2d8c010834bc508eb4b2461b6ef86cef6d1df6a507df0cba7cfe76edf92800e18e19a24645dcc9bbbf1db00a5cabe3ceac8fa5b5f0825020cfc740
SSDEEP 768:9rv+4UNbdF3hu4QOJIm0l/hUAFjQIMyOV3N5E9MM4+8r0mL:9bsbf36hNFUIpONNm6Drv
TLSH
T1CF03BF32B8A4DAB39CFBD6C5760672437FF441A395C50A84C9EE6B4C824B5DD231BC62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 7f3a9aab97be5cc2dd063a842444f684742f162ae588ef3db529b3a79bf5b863
MD5 78b8403ea8e20beeac5ba6d6af9f812f
SHA1 215c93500c5460c53353aa31549b5fecd9323eff
SHA512 90e97bafca0cce485519772bcda3862eaa0c6264cf888a2bb20e81d438d902fa3edf6df70bbb918addfd5acd6ea3b693f0816faf3487e9c0597cdff0b4dee155
SSDEEP 768:grv+4UNbd53PRgJw2cQOJIm0Qy/hUAFjQIMyOV3N5E9Ei+8r0mz:gbsbD32bhNFUIpONNmHDr/
TLSH
T16813CF31B8A5DE735CFBD689B60672837FF411A788C50A84C9DE6B4C46476CE231BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 ef7ca2cd756cb23f00e8cd0855994ce7ab2deb731bfb89ad20ad8cbcdaa1f3e9
MD5 7b5e69a3f6fbaffa50d750fdb7b1764f
SHA1 152f02219e3419bfb81d49a4d263e8d20868462e
SHA512 3103e7c91c9ec4788ddea799c372f9ce04ec9e6a55f623b5f4a57625193e1d36ea538d273b48bf5d7ef01e518bf501a0721da8c22f449670d42bd9fc95a87c71
SSDEEP 768:eFKj+9j3gwgmRgJx2ZrOJIm0Qv/hUAFjQIMyOV3N5E9Eib9M83:m9j3IFhNFUIpONNmHb+Q
TLSH
T1961339F1A8D3CA76D8AE8787A73D6E469EFCC167B4845884B7C95D0CCC821BFC246815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 2678f674053c18a332abea5bf6634b0044ae650710f12cb2c708cd7c9ad64e9d
MD5 f67510511b01144b9b451d5275881c15
SHA1 c00bebad5069ba7ac3c513293ac6fb300fae2d57
SHA512 2abb9f0d8c79c0439f81b20c4489072bbc59878a13548af925e7b33c892fe4866af8f8c30e5a99d6345786af49faf5fb4cd8cda37b6f66595a8eb686b80f3770
SSDEEP 768:ej+9/3HRgJO2cQOJIm0QE/hUAFjQIMyOV3N5E9Eib9M83:d9/3+rhNFUIpONNmHb+Q
TLSH
T153F2AF31B891DFA34CEBD2C9B6167687AFF411BB84851E84C9DEAB0D06832DD1357C29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 af74e59cfed153e9d08cdf804f8503a263996ac0eaa6b6a510bed4dc878234c1
MD5 9f8c3c09f24df9e9ddb30712491892a8
SHA1 e646638f32d4c7e1533543f936874f52dd8e1ced
SHA512 015c0c61a345a05dd94af53d6e251d50547e296e6ae0e49ae721eb0cf4aa3491a5fa9bbc684cd48d75a3bd16820f87a67948afbb42355135f63de8430cc8e27e
SSDEEP 768:0rv+4UNbd53bRgJw2cQOJIm0Qn/hUAFjQIMyOV3N5E9Ei+8r0mz:0bsbD3iYhNFUIpONNmHDr/
TLSH
T14613CF31B8A5DE735CFBD685B60672837FF410A788C10A84C9DE6B4C46476DE231BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

975168d5-766f-4507-b7c0-d23aa0cd9eee.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\975168d5-766f-4507-b7c0-d23aa0cd9eee.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f9ad70d5-e780-4cb1-9d62-5bdbbc757597.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f9ad70d5-e780-4cb1-9d62-5bdbbc757597.tmp
Size 41KB
SHA256 2ccc00db1cc94e84ffdc3482271f89d492fc2f42bad7e0429300684b3b6fb2a4
MD5 e3a860027dfb2032b4b95bfb41cff266
SHA1 4957a249e70789dfc3ee4878cf4778d7686060de
SHA512 c1f8dee72f13f6d74f27d962a615c47e5e06d41026f8c2ebfa0c03fa6284479a4e3e605effd7392df650e045e8d8fb52fdd800636f0d103e190916232405c13f
SSDEEP 768:Rrv+4UNbd53XRgJO2cQOJIm0QE/hUAFjQIMyOV3N5E9Eib9MD:RbsbD3urhNFUIpONNmHb+D
TLSH
T11113CF31B8A4DFB35CFBD285B60676877FF411AB88850A84C9DEAB0C46471DD235BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2160_367624873\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 bacc6ed24a91939d1e19676add430b4208b9a7254072d38513fdfc18b034fb39
MD5 7cd2543d48e33ef59a4d57f386e33922
SHA1 52326a24abaf936718c5f3fc195460608c60f116
SHA512 1191728302c9a2d42f5076701e9841740ea4274115c8123b6988369fce9c102c3b406ade1e7b907518f58f5c572603a7aff8d9a381c312951fd7586012f9e97f
TLSH
T11171238357AEC9F3C1DA5FF102835648F2FB22780733702147525956AB34B3A58B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/696-418-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/860-344-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/936-451-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1436-443-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1516-63-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2456-270-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2572-292-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3392-206-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3580-388-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3916-426-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4088-447-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4424-434-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4800-400-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4800-414-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4812-329-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5316-379-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5716-159-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5832-417-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5952-359-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6048-340-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6132-422-0x0000000000010000-0x00000000000AB000-memory.dmp

Download