systex | 444d8519e88f295fe0fa60a6f5cc318f1a49485430975bcb63c34d2a9777c155

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 11:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-08_ee56864636d6c253f840ecf71a0d6324_amadey_darkgate_elex_smoke-loader_stop.exe
Size 384KB
Sample260708-m5rt2afw2k
SHA256 444d8519e88f295fe0fa60a6f5cc318f1a49485430975bcb63c34d2a9777c155
MD5 ee56864636d6c253f840ecf71a0d6324
SHA1 ca3ac8930fe7397bf14e1bbbb1f52a4d99a4d8a4
SHA512 8653334e69fbe405db761553067ece1f6937dc1f817b697c67d63937014b38839fe5342ea8dba11cf8b7f23a0df168ff0638f9b0c8c9e21a00e612fd44c00820
SSDEEP 3072:B9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:LctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E0846B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
3784	gdyvqoigaysqlidb.exe
4032	gdyvqoigaysqlidb.sys
5372	CreateProcess.exe
3360	igdyvqojgy.exe
5740	CreateProcess.exe
6080	CreateProcess.exe
2448	i_igdyvqojgy.exe
2580	tqlavtnifd.sys
3244	CreateProcess.exe
828	xvpnifayvq.exe
4032	CreateProcess.exe
4832	CreateProcess.exe
3148	i_xvpnifayvq.exe
4020	dxvpnifayv.sys
952	CreateProcess.exe
3996	aqkicausnk.exe
4416	CreateProcess.exe
4592	CreateProcess.exe
2224	i_aqkicausnk.exe
3324	pnkfcausqk.sys
5872	CreateProcess.exe
5244	pnkfcausnk.exe
5452	CreateProcess.exe
2952	CreateProcess.exe
5100	i_pnkfcausnk.exe
3400	pmkezxupmh.sys
1836	CreateProcess.exe
3004	nhfzxrpjhc.exe
4344	CreateProcess.exe
2172	CreateProcess.exe
3804	i_nhfzxrpjhc.exe
3396	heuomheczu.sys
5144	CreateProcess.exe
4528	wurmhecwuo.exe
948	CreateProcess.exe
5932	CreateProcess.exe
1420	i_wurmhecwuo.exe
1052	hezwuomjhb.sys
6072	CreateProcess.exe
5780	hezwjhbztr.exe
5944	CreateProcess.exe
5744	CreateProcess.exe
1080	i_hezwjhbztr.exe
4964	geywqojgbz.sys
5328	CreateProcess.exe
700	geywtomjeb.exe
4768	CreateProcess.exe
1572	CreateProcess.exe
3884	i_geywtomjeb.exe
1328	lgdbytqolg.sys
3616	CreateProcess.exe
5180	dywqoigbyt.exe
3308	CreateProcess.exe
3140	CreateProcess.exe
2164	i_dywqoigbyt.exe
4516	gaytqljdbo.sys
5588	CreateProcess.exe
4404	sqoidaysql.exe
4020	CreateProcess.exe
5972	CreateProcess.exe
6008	i_sqoidaysql.exe
3176	qoigaysqli.sys
5456	CreateProcess.exe
2592	kigaysqdav.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaytqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igdyvqojgy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnifayvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wurmhecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywtomjeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfaxspkifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecxusmkfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbvtoigey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdyvqoigaysqlidb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aqkicausnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aqkicausnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnkfcausnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfaxspkifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezwrpjhezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hezwjhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hezwjhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dywqoigbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqoidaysql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gebztrojgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnkfcausnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfzxrpjhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kigaysqdav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywtomjeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dywqoigbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecxusmkfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezwrpjhezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbvtoigey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gaytqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igayvqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-08_ee56864636d6c253f840ecf71a0d6324_amadey_darkgate_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igdyvqojgy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnifayvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfzxrpjhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kigaysqdav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igayvqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvqnifay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wurmhecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqoidaysql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zurpjhczus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zurpjhczus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gebztrojgb.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2636	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5436	ipconfig.exe
1260	ipconfig.exe
5812	ipconfig.exe
3032	ipconfig.exe
3996	ipconfig.exe
2596	ipconfig.exe
5908	ipconfig.exe
3752	ipconfig.exe
3884	ipconfig.exe
4792	ipconfig.exe
5996	ipconfig.exe
3352	ipconfig.exe
2832	ipconfig.exe
3272	ipconfig.exe
5724	ipconfig.exe
1280	ipconfig.exe
124	ipconfig.exe
2896	ipconfig.exe
2324	ipconfig.exe
3308	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134279822027772374"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2626306573-1585762579-411806764-1000\{BB34F2E5-71CC-47CC-B384-21E719FADFD8}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5184	2026-07-08_ee56864636d6c253f840ecf71a0d6324_amadey_darkgate_elex_smoke-loader_stop.exe
5184	2026-07-08_ee56864636d6c253f840ecf71a0d6324_amadey_darkgate_elex_smoke-loader_stop.exe
5184	2026-07-08_ee56864636d6c253f840ecf71a0d6324_amadey_darkgate_elex_smoke-loader_stop.exe
5184	2026-07-08_ee56864636d6c253f840ecf71a0d6324_amadey_darkgate_elex_smoke-loader_stop.exe
5184	2026-07-08_ee56864636d6c253f840ecf71a0d6324_amadey_darkgate_elex_smoke-loader_stop.exe
5184	2026-07-08_ee56864636d6c253f840ecf71a0d6324_amadey_darkgate_elex_smoke-loader_stop.exe
5184	2026-07-08_ee56864636d6c253f840ecf71a0d6324_amadey_darkgate_elex_smoke-loader_stop.exe
5184	2026-07-08_ee56864636d6c253f840ecf71a0d6324_amadey_darkgate_elex_smoke-loader_stop.exe
5184	2026-07-08_ee56864636d6c253f840ecf71a0d6324_amadey_darkgate_elex_smoke-loader_stop.exe
5184	2026-07-08_ee56864636d6c253f840ecf71a0d6324_amadey_darkgate_elex_smoke-loader_stop.exe
5184	2026-07-08_ee56864636d6c253f840ecf71a0d6324_amadey_darkgate_elex_smoke-loader_stop.exe
5184	2026-07-08_ee56864636d6c253f840ecf71a0d6324_amadey_darkgate_elex_smoke-loader_stop.exe
5184	2026-07-08_ee56864636d6c253f840ecf71a0d6324_amadey_darkgate_elex_smoke-loader_stop.exe
5184	2026-07-08_ee56864636d6c253f840ecf71a0d6324_amadey_darkgate_elex_smoke-loader_stop.exe
5184	2026-07-08_ee56864636d6c253f840ecf71a0d6324_amadey_darkgate_elex_smoke-loader_stop.exe
5184	2026-07-08_ee56864636d6c253f840ecf71a0d6324_amadey_darkgate_elex_smoke-loader_stop.exe
5184	2026-07-08_ee56864636d6c253f840ecf71a0d6324_amadey_darkgate_elex_smoke-loader_stop.exe
5184	2026-07-08_ee56864636d6c253f840ecf71a0d6324_amadey_darkgate_elex_smoke-loader_stop.exe
5184	2026-07-08_ee56864636d6c253f840ecf71a0d6324_amadey_darkgate_elex_smoke-loader_stop.exe
5184	2026-07-08_ee56864636d6c253f840ecf71a0d6324_amadey_darkgate_elex_smoke-loader_stop.exe
5184	2026-07-08_ee56864636d6c253f840ecf71a0d6324_amadey_darkgate_elex_smoke-loader_stop.exe
5184	2026-07-08_ee56864636d6c253f840ecf71a0d6324_amadey_darkgate_elex_smoke-loader_stop.exe
5184	2026-07-08_ee56864636d6c253f840ecf71a0d6324_amadey_darkgate_elex_smoke-loader_stop.exe
5184	2026-07-08_ee56864636d6c253f840ecf71a0d6324_amadey_darkgate_elex_smoke-loader_stop.exe
5184	2026-07-08_ee56864636d6c253f840ecf71a0d6324_amadey_darkgate_elex_smoke-loader_stop.exe
5184	2026-07-08_ee56864636d6c253f840ecf71a0d6324_amadey_darkgate_elex_smoke-loader_stop.exe
5184	2026-07-08_ee56864636d6c253f840ecf71a0d6324_amadey_darkgate_elex_smoke-loader_stop.exe
5184	2026-07-08_ee56864636d6c253f840ecf71a0d6324_amadey_darkgate_elex_smoke-loader_stop.exe
5184	2026-07-08_ee56864636d6c253f840ecf71a0d6324_amadey_darkgate_elex_smoke-loader_stop.exe
5184	2026-07-08_ee56864636d6c253f840ecf71a0d6324_amadey_darkgate_elex_smoke-loader_stop.exe
5184	2026-07-08_ee56864636d6c253f840ecf71a0d6324_amadey_darkgate_elex_smoke-loader_stop.exe
5184	2026-07-08_ee56864636d6c253f840ecf71a0d6324_amadey_darkgate_elex_smoke-loader_stop.exe
5184	2026-07-08_ee56864636d6c253f840ecf71a0d6324_amadey_darkgate_elex_smoke-loader_stop.exe
5184	2026-07-08_ee56864636d6c253f840ecf71a0d6324_amadey_darkgate_elex_smoke-loader_stop.exe
5184	2026-07-08_ee56864636d6c253f840ecf71a0d6324_amadey_darkgate_elex_smoke-loader_stop.exe
5184	2026-07-08_ee56864636d6c253f840ecf71a0d6324_amadey_darkgate_elex_smoke-loader_stop.exe
5184	2026-07-08_ee56864636d6c253f840ecf71a0d6324_amadey_darkgate_elex_smoke-loader_stop.exe
5184	2026-07-08_ee56864636d6c253f840ecf71a0d6324_amadey_darkgate_elex_smoke-loader_stop.exe
5184	2026-07-08_ee56864636d6c253f840ecf71a0d6324_amadey_darkgate_elex_smoke-loader_stop.exe
5184	2026-07-08_ee56864636d6c253f840ecf71a0d6324_amadey_darkgate_elex_smoke-loader_stop.exe
5184	2026-07-08_ee56864636d6c253f840ecf71a0d6324_amadey_darkgate_elex_smoke-loader_stop.exe
5184	2026-07-08_ee56864636d6c253f840ecf71a0d6324_amadey_darkgate_elex_smoke-loader_stop.exe
5184	2026-07-08_ee56864636d6c253f840ecf71a0d6324_amadey_darkgate_elex_smoke-loader_stop.exe
5184	2026-07-08_ee56864636d6c253f840ecf71a0d6324_amadey_darkgate_elex_smoke-loader_stop.exe
5184	2026-07-08_ee56864636d6c253f840ecf71a0d6324_amadey_darkgate_elex_smoke-loader_stop.exe
5184	2026-07-08_ee56864636d6c253f840ecf71a0d6324_amadey_darkgate_elex_smoke-loader_stop.exe
5184	2026-07-08_ee56864636d6c253f840ecf71a0d6324_amadey_darkgate_elex_smoke-loader_stop.exe
5184	2026-07-08_ee56864636d6c253f840ecf71a0d6324_amadey_darkgate_elex_smoke-loader_stop.exe
5184	2026-07-08_ee56864636d6c253f840ecf71a0d6324_amadey_darkgate_elex_smoke-loader_stop.exe
5184	2026-07-08_ee56864636d6c253f840ecf71a0d6324_amadey_darkgate_elex_smoke-loader_stop.exe
5184	2026-07-08_ee56864636d6c253f840ecf71a0d6324_amadey_darkgate_elex_smoke-loader_stop.exe
5184	2026-07-08_ee56864636d6c253f840ecf71a0d6324_amadey_darkgate_elex_smoke-loader_stop.exe
5184	2026-07-08_ee56864636d6c253f840ecf71a0d6324_amadey_darkgate_elex_smoke-loader_stop.exe
5184	2026-07-08_ee56864636d6c253f840ecf71a0d6324_amadey_darkgate_elex_smoke-loader_stop.exe
5184	2026-07-08_ee56864636d6c253f840ecf71a0d6324_amadey_darkgate_elex_smoke-loader_stop.exe
5184	2026-07-08_ee56864636d6c253f840ecf71a0d6324_amadey_darkgate_elex_smoke-loader_stop.exe
3784	gdyvqoigaysqlidb.exe
3784	gdyvqoigaysqlidb.exe
3784	gdyvqoigaysqlidb.exe
3784	gdyvqoigaysqlidb.exe
3784	gdyvqoigaysqlidb.exe
3784	gdyvqoigaysqlidb.exe
3784	gdyvqoigaysqlidb.exe
3784	gdyvqoigaysqlidb.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe
3856	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	2448	i_igdyvqojgy.exe
Token: SeDebugPrivilege	3148	i_xvpnifayvq.exe
Token: SeDebugPrivilege	2224	i_aqkicausnk.exe
Token: SeDebugPrivilege	5100	i_pnkfcausnk.exe
Token: SeDebugPrivilege	3804	i_nhfzxrpjhc.exe
Token: SeDebugPrivilege	1420	i_wurmhecwuo.exe
Token: SeDebugPrivilege	1080	i_hezwjhbztr.exe
Token: SeDebugPrivilege	3884	i_geywtomjeb.exe
Token: SeDebugPrivilege	2164	i_dywqoigbyt.exe
Token: SeDebugPrivilege	6008	i_sqoidaysql.exe
Token: SeDebugPrivilege	2436	i_kigaysqdav.exe
Token: SeDebugPrivilege	4624	i_hfaxspkifa.exe
Token: SeDebugPrivilege	3068	i_ecxusmkfzx.exe
Token: SeDebugPrivilege	2516	i_zurpjhczus.exe
Token: SeDebugPrivilege	616	i_ezwrpjhezw.exe
Token: SeDebugPrivilege	3860	i_gebztrojgb.exe
Token: SeDebugPrivilege	5764	i_jdbvtoigey.exe
Token: SeDebugPrivilege	2284	i_gaytqoigay.exe
Token: SeDebugPrivilege	3408	i_igayvqoiga.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3856	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5184 wrote to memory of 3784	5184	2026-07-08_ee56864636d6c253f840ecf71a0d6324_amadey_darkgate_elex_smoke-loader_stop.exe	88
PID 5184 wrote to memory of 1608	5184	2026-07-08_ee56864636d6c253f840ecf71a0d6324_amadey_darkgate_elex_smoke-loader_stop.exe	89
PID 1608 wrote to memory of 3856	1608	iexplore.exe	90
PID 3856 wrote to memory of 3764	3856	msedge.exe	91
PID 3856 wrote to memory of 2636	3856	msedge.exe	92
PID 3856 wrote to memory of 2540	3856	msedge.exe	93
PID 3856 wrote to memory of 2540	3856	msedge.exe	93
PID 3856 wrote to memory of 2540	3856	msedge.exe	93
PID 3856 wrote to memory of 4604	3856	msedge.exe	94
PID 3856 wrote to memory of 4604	3856	msedge.exe	94
PID 3856 wrote to memory of 6124	3856	msedge.exe	96
PID 3856 wrote to memory of 2504	3856	msedge.exe	97
PID 3856 wrote to memory of 6124	3856	msedge.exe	96
PID 3856 wrote to memory of 6124	3856	msedge.exe	96
PID 3856 wrote to memory of 2504	3856	msedge.exe	97
PID 3856 wrote to memory of 2504	3856	msedge.exe	97
PID 3856 wrote to memory of 3744	3856	msedge.exe	98
PID 3856 wrote to memory of 3744	3856	msedge.exe	98
PID 3856 wrote to memory of 3744	3856	msedge.exe	98
PID 3856 wrote to memory of 4528	3856	msedge.exe	99
PID 3856 wrote to memory of 4528	3856	msedge.exe	99
PID 3856 wrote to memory of 4528	3856	msedge.exe	99
PID 3856 wrote to memory of 5752	3856	msedge.exe	100
PID 3856 wrote to memory of 5752	3856	msedge.exe	100
PID 3856 wrote to memory of 3316	3856	msedge.exe	104
PID 3856 wrote to memory of 3316	3856	msedge.exe	104
PID 3856 wrote to memory of 2212	3856	msedge.exe	105
PID 3856 wrote to memory of 2212	3856	msedge.exe	105
PID 3784 wrote to memory of 5372	3784	gdyvqoigaysqlidb.exe	106
PID 3360 wrote to memory of 5740	3360	igdyvqojgy.exe	109
PID 3856 wrote to memory of 4488	3856	msedge.exe	113
PID 3856 wrote to memory of 5232	3856	msedge.exe	114
PID 3856 wrote to memory of 5232	3856	msedge.exe	114
PID 3856 wrote to memory of 5772	3856	msedge.exe	115
PID 3856 wrote to memory of 5772	3856	msedge.exe	115
PID 3784 wrote to memory of 6080	3784	gdyvqoigaysqlidb.exe	119
PID 3784 wrote to memory of 3244	3784	gdyvqoigaysqlidb.exe	123
PID 828 wrote to memory of 4032	828	xvpnifayvq.exe	125
PID 3784 wrote to memory of 4832	3784	gdyvqoigaysqlidb.exe	128
PID 3784 wrote to memory of 952	3784	gdyvqoigaysqlidb.exe	132
PID 3996 wrote to memory of 4416	3996	aqkicausnk.exe	134
PID 3784 wrote to memory of 4592	3784	gdyvqoigaysqlidb.exe	137
PID 3784 wrote to memory of 5872	3784	gdyvqoigaysqlidb.exe	141
PID 5244 wrote to memory of 5452	5244	pnkfcausnk.exe	143
PID 3784 wrote to memory of 2952	3784	gdyvqoigaysqlidb.exe	147
PID 3856 wrote to memory of 4328	3856	msedge.exe	149
PID 3856 wrote to memory of 4736	3856	msedge.exe	150
PID 3856 wrote to memory of 1940	3856	msedge.exe	151
PID 3784 wrote to memory of 1836	3784	gdyvqoigaysqlidb.exe	154
PID 3004 wrote to memory of 4344	3004	nhfzxrpjhc.exe	156
PID 3784 wrote to memory of 2172	3784	gdyvqoigaysqlidb.exe	159
PID 3784 wrote to memory of 5144	3784	gdyvqoigaysqlidb.exe	163
PID 4528 wrote to memory of 948	4528	wurmhecwuo.exe	165
PID 3784 wrote to memory of 5932	3784	gdyvqoigaysqlidb.exe	168
PID 3784 wrote to memory of 6072	3784	gdyvqoigaysqlidb.exe	172
PID 5780 wrote to memory of 5944	5780	hezwjhbztr.exe	174
PID 3784 wrote to memory of 5744	3784	gdyvqoigaysqlidb.exe	177
PID 3784 wrote to memory of 5328	3784	gdyvqoigaysqlidb.exe	181
PID 700 wrote to memory of 4768	700	geywtomjeb.exe	183
PID 3784 wrote to memory of 1572	3784	gdyvqoigaysqlidb.exe	186
PID 3856 wrote to memory of 5000	3856	msedge.exe	188
PID 3856 wrote to memory of 5000	3856	msedge.exe	188
PID 3784 wrote to memory of 3616	3784	gdyvqoigaysqlidb.exe	194
PID 5180 wrote to memory of 3308	5180	dywqoigbyt.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-07-08_ee56864636d6c253f840ecf71a0d6324_amadey_darkgate_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_ee56864636d6c253f840ecf71a0d6324_amadey_darkgate_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5184
- C:\Temp\gdyvqoigaysqlidb.exe
  C:\Temp\gdyvqoigaysqlidb.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3784
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\igdyvqojgy.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5372
  - - C:\Temp\igdyvqojgy.exe
      C:\Temp\igdyvqojgy.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3360
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5740
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3996
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_igdyvqojgy.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6080
  - - C:\Temp\i_igdyvqojgy.exe
      C:\Temp\i_igdyvqojgy.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2448
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvpnifayvq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3244
  - - C:\Temp\xvpnifayvq.exe
      C:\Temp\xvpnifayvq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:828
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4032
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2324
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xvpnifayvq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4832
  - - C:\Temp\i_xvpnifayvq.exe
      C:\Temp\i_xvpnifayvq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3148
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\aqkicausnk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:952
  - - C:\Temp\aqkicausnk.exe
      C:\Temp\aqkicausnk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3996
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4416
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5996
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_aqkicausnk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4592
  - - C:\Temp\i_aqkicausnk.exe
      C:\Temp\i_aqkicausnk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2224
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pnkfcausnk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5872
  - - C:\Temp\pnkfcausnk.exe
      C:\Temp\pnkfcausnk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5244
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5452
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3352
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pnkfcausnk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2952
  - - C:\Temp\i_pnkfcausnk.exe
      C:\Temp\i_pnkfcausnk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5100
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nhfzxrpjhc.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1836
  - - C:\Temp\nhfzxrpjhc.exe
      C:\Temp\nhfzxrpjhc.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3004
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4344
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3308
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nhfzxrpjhc.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2172
  - - C:\Temp\i_nhfzxrpjhc.exe
      C:\Temp\i_nhfzxrpjhc.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3804
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wurmhecwuo.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5144
  - - C:\Temp\wurmhecwuo.exe
      C:\Temp\wurmhecwuo.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4528
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:948
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2596
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wurmhecwuo.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5932
  - - C:\Temp\i_wurmhecwuo.exe
      C:\Temp\i_wurmhecwuo.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1420
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hezwjhbztr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6072
  - - C:\Temp\hezwjhbztr.exe
      C:\Temp\hezwjhbztr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5780
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5944
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5908
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hezwjhbztr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5744
  - - C:\Temp\i_hezwjhbztr.exe
      C:\Temp\i_hezwjhbztr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1080
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\geywtomjeb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5328
  - - C:\Temp\geywtomjeb.exe
      C:\Temp\geywtomjeb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:700
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4768
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5436
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_geywtomjeb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1572
  - - C:\Temp\i_geywtomjeb.exe
      C:\Temp\i_geywtomjeb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3884
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dywqoigbyt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3616
  - - C:\Temp\dywqoigbyt.exe
      C:\Temp\dywqoigbyt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5180
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3308
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2896
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dywqoigbyt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3140
  - - C:\Temp\i_dywqoigbyt.exe
      C:\Temp\i_dywqoigbyt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2164
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqoidaysql.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5588
  - - C:\Temp\sqoidaysql.exe
      C:\Temp\sqoidaysql.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4404
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4020
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2832
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqoidaysql.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5972
  - - C:\Temp\i_sqoidaysql.exe
      C:\Temp\i_sqoidaysql.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6008
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kigaysqdav.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5456
  - - C:\Temp\kigaysqdav.exe
      C:\Temp\kigaysqdav.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2592
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4360
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3752
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kigaysqdav.exe ups_ins
    3⤵
    PID:5652
  - - C:\Temp\i_kigaysqdav.exe
      C:\Temp\i_kigaysqdav.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2436
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hfaxspkifa.exe ups_run
    3⤵
    PID:960
  - - C:\Temp\hfaxspkifa.exe
      C:\Temp\hfaxspkifa.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1452
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5796
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3272
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hfaxspkifa.exe ups_ins
    3⤵
    PID:3276
  - - C:\Temp\i_hfaxspkifa.exe
      C:\Temp\i_hfaxspkifa.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4624
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ecxusmkfzx.exe ups_run
    3⤵
    PID:3184
  - - C:\Temp\ecxusmkfzx.exe
      C:\Temp\ecxusmkfzx.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:560
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2896
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5724
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ecxusmkfzx.exe ups_ins
    3⤵
    PID:4012
  - - C:\Temp\i_ecxusmkfzx.exe
      C:\Temp\i_ecxusmkfzx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3068
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zurpjhczus.exe ups_run
    3⤵
    PID:5704
  - - C:\Temp\zurpjhczus.exe
      C:\Temp\zurpjhczus.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2268
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3892
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4792
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zurpjhczus.exe ups_ins
    3⤵
    PID:2920
  - - C:\Temp\i_zurpjhczus.exe
      C:\Temp\i_zurpjhczus.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2516
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ezwrpjhezw.exe ups_run
    3⤵
    PID:4292
  - - C:\Temp\ezwrpjhezw.exe
      C:\Temp\ezwrpjhezw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1120
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1532
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1260
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ezwrpjhezw.exe ups_ins
    3⤵
    PID:2460
  - - C:\Temp\i_ezwrpjhezw.exe
      C:\Temp\i_ezwrpjhezw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:616
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gebztrojgb.exe ups_run
    3⤵
    PID:3256
  - - C:\Temp\gebztrojgb.exe
      C:\Temp\gebztrojgb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4640
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3468
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5812
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gebztrojgb.exe ups_ins
    3⤵
    PID:3372
  - - C:\Temp\i_gebztrojgb.exe
      C:\Temp\i_gebztrojgb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3860
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jdbvtoigey.exe ups_run
    3⤵
    PID:992
  - - C:\Temp\jdbvtoigey.exe
      C:\Temp\jdbvtoigey.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6108
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2020
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3884
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jdbvtoigey.exe ups_ins
    3⤵
    PID:6016
  - - C:\Temp\i_jdbvtoigey.exe
      C:\Temp\i_jdbvtoigey.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5764
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gaytqoigay.exe ups_run
    3⤵
    PID:1620
  - - C:\Temp\gaytqoigay.exe
      C:\Temp\gaytqoigay.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5668
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4112
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3032
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gaytqoigay.exe ups_ins
    3⤵
    PID:2164
  - - C:\Temp\i_gaytqoigay.exe
      C:\Temp\i_gaytqoigay.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2284
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\igayvqoiga.exe ups_run
    3⤵
    PID:5004
  - - C:\Temp\igayvqoiga.exe
      C:\Temp\igayvqoiga.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:936
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6092
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1280
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_igayvqoiga.exe ups_ins
    3⤵
    PID:3092
  - - C:\Temp\i_igayvqoiga.exe
      C:\Temp\i_igayvqoiga.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3408
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fdxvqnifay.exe ups_run
    3⤵
    PID:616
  - - C:\Temp\fdxvqnifay.exe
      C:\Temp\fdxvqnifay.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4508
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4056
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:124
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2cc,0x304,0x7ff86c1bc188,0x7ff86c1bc194,0x7ff86c1bc1a0
      4⤵
      PID:3764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,17734139652910829308,4243702797498846862,524288 --field-trial-handle=2704,i,10469158580641016207,6106149438836705429,262144 --variations-seed-version --mojo-platform-channel-handle=2812 /prefetch:11
      4⤵
      System Time Discovery
      PID:2636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,16771355232404687405,9570903926716389498,262144 --field-trial-handle=2704,i,10469158580641016207,6106149438836705429,262144 --variations-seed-version --mojo-platform-channel-handle=2688 /prefetch:2
      4⤵
      PID:2540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2232,i,1637408769862014026,6977621437515726296,524288 --field-trial-handle=2704,i,10469158580641016207,6106149438836705429,262144 --variations-seed-version --mojo-platform-channel-handle=2852 /prefetch:13
      4⤵
      PID:4604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3552,i,28249958303147596,9248098576775082026,2097152 --field-trial-handle=2704,i,10469158580641016207,6106149438836705429,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
      4⤵
      PID:6124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3556,i,4285155020667766478,9113346058492123878,2097152 --field-trial-handle=2704,i,10469158580641016207,6106149438836705429,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
      4⤵
      PID:2504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,9868930600094282500,7585696872294705768,2097152 --field-trial-handle=2704,i,10469158580641016207,6106149438836705429,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:1
      4⤵
      PID:3744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,2240756607886683924,3519065666257050616,2097152 --field-trial-handle=2704,i,10469158580641016207,6106149438836705429,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:9
      4⤵
      PID:4528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,14128058816963840706,10291979850699533150,524288 --field-trial-handle=2704,i,10469158580641016207,6106149438836705429,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:14
      4⤵
      PID:5752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5628,i,17930063701824224159,15973116306054125457,524288 --field-trial-handle=2704,i,10469158580641016207,6106149438836705429,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:14
      4⤵
      PID:3316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5632,i,9810848449052988412,16426673517051557327,524288 --field-trial-handle=2704,i,10469158580641016207,6106149438836705429,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:14
      4⤵
      PID:2212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3628,i,15175827005254137103,15233982841543113700,524288 --field-trial-handle=2704,i,10469158580641016207,6106149438836705429,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:14
      4⤵
      PID:948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3628,i,15175827005254137103,15233982841543113700,524288 --field-trial-handle=2704,i,10469158580641016207,6106149438836705429,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:14
      4⤵
      PID:4488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6352,i,11023896963508595911,13772555155743881162,524288 --field-trial-handle=2704,i,10469158580641016207,6106149438836705429,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:14
      4⤵
      PID:5232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,4774858883903162761,5312141497380184629,524288 --field-trial-handle=2704,i,10469158580641016207,6106149438836705429,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:14
      4⤵
      PID:5772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4852,i,4931770441282473341,17989959972647561856,524288 --field-trial-handle=2704,i,10469158580641016207,6106149438836705429,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:14
      4⤵
      PID:4328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4300,i,7693914341391549573,15702932376291892438,524288 --field-trial-handle=2704,i,10469158580641016207,6106149438836705429,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:14
      4⤵
      PID:4736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4256,i,14700473646346333625,12785026140584498220,524288 --field-trial-handle=2704,i,10469158580641016207,6106149438836705429,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:14
      4⤵
      PID:1940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,3544435045302791433,2301012315646444420,524288 --field-trial-handle=2704,i,10469158580641016207,6106149438836705429,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:14
      4⤵
      PID:5000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5700,i,4772229108907003238,851211069555407708,262144 --field-trial-handle=2704,i,10469158580641016207,6106149438836705429,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:10
      4⤵
      PID:956

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3400

C:\Temp\gdyvqoigaysqlidb.sys
C:\Temp\gdyvqoigaysqlidb.sys
1⤵
- Executes dropped EXE
PID:4032

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3756

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2876

C:\Temp\tqlavtnifd.sys
C:\Temp\tqlavtnifd.sys
1⤵
- Executes dropped EXE
PID:2580

C:\Temp\dxvpnifayv.sys
C:\Temp\dxvpnifayv.sys
1⤵
- Executes dropped EXE
PID:4020

C:\Temp\pnkfcausqk.sys
C:\Temp\pnkfcausqk.sys
1⤵
- Executes dropped EXE
PID:3324

C:\Temp\pmkezxupmh.sys
C:\Temp\pmkezxupmh.sys
1⤵
- Executes dropped EXE
PID:3400

C:\Temp\heuomheczu.sys
C:\Temp\heuomheczu.sys
1⤵
- Executes dropped EXE
PID:3396

C:\Temp\hezwuomjhb.sys
C:\Temp\hezwuomjhb.sys
1⤵
- Executes dropped EXE
PID:1052

C:\Temp\geywqojgbz.sys
C:\Temp\geywqojgbz.sys
1⤵
- Executes dropped EXE
PID:4964

C:\Temp\lgdbytqolg.sys
C:\Temp\lgdbytqolg.sys
1⤵
- Executes dropped EXE
PID:1328

C:\Temp\gaytqljdbo.sys
C:\Temp\gaytqljdbo.sys
1⤵
- Executes dropped EXE
PID:4516

C:\Temp\qoigaysqli.sys
C:\Temp\qoigaysqli.sys
1⤵
- Executes dropped EXE
PID:3176

C:\Temp\fdxvpkicau.sys
C:\Temp\fdxvpkicau.sys
1⤵
PID:5772

C:\Temp\fzxspkhfca.sys
C:\Temp\fzxspkhfca.sys
1⤵
PID:5648

C:\Temp\heczxrpmkh.sys
C:\Temp\heczxrpmkh.sys
1⤵
PID:1432

C:\Temp\jhfzxrpjhc.sys
C:\Temp\jhfzxrpjhc.sys
1⤵
PID:4588

C:\Temp\gebwtrpjge.sys
C:\Temp\gebwtrpjge.sys
1⤵
PID:4056

C:\Temp\gdbzwqoigb.sys
C:\Temp\gdbzwqoigb.sys
1⤵
PID:6088

C:\Temp\nljdbvtolg.sys
C:\Temp\nljdbvtolg.sys
1⤵
PID:5544

C:\Temp\fdbvtqoigd.sys
C:\Temp\fdbvtqoigd.sys
1⤵
PID:3844

C:\Temp\ifdxvpnifa.sys
C:\Temp\ifdxvpnifa.sys
1⤵
PID:2652

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aqkicausnk.exe

Path C:\Temp\aqkicausnk.exe
Size 384KB
SHA256 c03ce7a65b717cf409b9c02ce3291828d518f5d9fc9ddddaec7c11feeba6b7a4
MD5 5210d27c7c7a2d3339f472e9606516c1
SHA1 c325e19f9bc6bb04061f14790ffe5a00bb77b6cb
SHA512 1218e6d2a28276ab7530ae9afd6e225a586f01d65c274f2bcc844dfe0c22db1670fa1c75a1ae086ad3b6a40ca27f9d9078dfed8e399f3c06d8fcbe5860beb7fc
SSDEEP 3072:N9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:fctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B4847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxvpnifayv.sys

Path C:\Temp\dxvpnifayv.sys
Size 293KB
SHA256 69d4251745aa8bc55a11ec1855cd3eecd9df1376e30dcb33d7c10e34a89df958
MD5 49a5c556e4cee2b84a116e44c3b5293d
SHA1 470b9cf7a1de31ff05a4a99724c1143a980817d4
SHA512 d5769f361c9c63200c2cc28f219be5c10ee9b9a58493b62fc857b664a6d9a40682217aaeb4aefa3012863672a1bda840d4a897ee9a0ff0f658f92c07d72ccd18
SSDEEP 3072:qtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:qIJjiJcbI03GBc3ucY5DCSj
TLSH
T109545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gdyvqoigaysqlidb.exe

Path C:\Temp\gdyvqoigaysqlidb.exe
Size 384KB
SHA256 a5e990497aca24ccfe1fdfe205634cd5589a13472ef08b5bc67340abaea65f4d
MD5 301d9e9920bb711628b95da74cd8ff17
SHA1 6bd21d2c116cd410babaf118514695840f3d45fa
SHA512 19cecf2a00b2d0528584f573aadd17b59ff66a6b69f976ccacabe9ae2d95ce2f6fa4df0d576273550c2c4221be63d5924cca226e23c454fcec05ff7003aa41cf
SSDEEP 3072:s9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:2ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D3846B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gdyvqoigaysqlidb.sys

Path C:\Temp\gdyvqoigaysqlidb.sys
Size 293KB
SHA256 79ceb6e661b998193223b5d706ae900cb6d916c98736f69164d1eea28f253e62
MD5 6f5b705785d0b5008effa35d52f857c4
SHA1 788de9db7042f34a3ec0cf852be236b4947bd631
SHA512 84d69870c634bdcf3832b283b691a4f4537c30604760acceae27457beacec4ddcd25003068f65171100d20fde3d398314f303484adbdca29ffb310a43f4866dc
SSDEEP 3072:utKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:uIJjiJcbI03GBc3ucY5DCSj
TLSH
T1D5545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

heuomheczu.sys

Path C:\Temp\heuomheczu.sys
Size 293KB
SHA256 f92705188adbc660dbcf77e78c8cde66128576023432120666d6fe2b1a0fdcd1
MD5 61fc4f5d31eb78ea48a384fa04100f7a
SHA1 09723fe0a75cda00ca007b1d96ae3f87634eaf9d
SHA512 facbcfbbc058f55aaa7f9d583ea9e6df8e3050198547b3e385d2a10330b062a9fb3f614c58c0efd836fd19dc130492ae6f510a99bf2f7fb3bf774fb8952186b9
SSDEEP 3072:gtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:gIJjiJcbI03GBc3ucY5DCSj
TLSH
T119545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_aqkicausnk.exe

Path C:\Temp\i_aqkicausnk.exe
Size 384KB
SHA256 671ce13dd62f8f49fe5db87c406047a12716cefa1e20e267b1d80f83c43454b2
MD5 2cb4f4e18bf041e059c0869602d62306
SHA1 fd3027db639fb359026092fe6d46c2157fb27d65
SHA512 7b52043d35cb54f2eabea96424190ae627434c2ed186b42116490a27ebbfe9c01012d50e5663bca7d1657591cd92fe23dbc4daf0697f75626b546b2564c32eeb
SSDEEP 3072:i9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:4ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1FE847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_igdyvqojgy.exe

Path C:\Temp\i_igdyvqojgy.exe
Size 384KB
SHA256 67ca4da142ee1e665acd5913691604b9682984b52ededd9d58f382ac3df69e66
MD5 cac4025b80f982d80da88f01382fb7e1
SHA1 b6161cc848f12ba74ca38f8a0f22964fb3b7887c
SHA512 b4400da90cb09d428aa9b86ea6471090a594939de3c2fe0d0f89eb78f28115f90db8499f63a784acb133d0561415bc65ec8e23f5169f90ff8d7c085e222c3e78
SSDEEP 3072:e9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:8ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T18E847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nhfzxrpjhc.exe

Path C:\Temp\i_nhfzxrpjhc.exe
Size 384KB
SHA256 7a8a66a668e726ff0417bb46f6320b89729190173d92d6dc71bd0efe3ad6329a
MD5 fe279becbf346b525f44bcf14bd74274
SHA1 6fedd8fa7db7a116de82899f4c5fbeb7fa143e2d
SHA512 60270c5e28115aed331b477e5dd1ef79fab77f6ebccc4d5c503a36f72f2e180b0cc9dabc0768b93ecfa75cef914c834e883fdb1f9c7ba75e1dbaca492f4397f1
SSDEEP 3072:h9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:rctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T124847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pnkfcausnk.exe

Path C:\Temp\i_pnkfcausnk.exe
Size 384KB
SHA256 768d8c845554a128e3c3fc3cb930c2d7a7551567b1c0af9b23daf5ce1d1c0440
MD5 4f3942d8da73ef2104909f0c07d29c3c
SHA1 d750cb635fccd5b58e190f1b285a353358773874
SHA512 548bbd058775113681e13b48fcd7ed61449e97d90dd1f3a0d16324adfb0030b3cb4aced51d1b4e08ec70f7436622d90c0b5bb2ed622b8c5a008a706fb8eb5622
SSDEEP 3072:a9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:ActFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C0847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xvpnifayvq.exe

Path C:\Temp\i_xvpnifayvq.exe
Size 384KB
SHA256 241a904ee2852201c3f54137f844a09686743fbe6e311b409f91e162738919cf
MD5 a880a26565ae1bb25c26fd52995bfd7e
SHA1 ad8511e0be547566dcfbbb26d9a23f3dacd94642
SHA512 d2200c60f5a3235e2c2a543dfee2637ef7dd57d7fccc4adf2385e3feccdf219db60f0744a879b0f1993f072cbcecfb107891612f8ebe000d6c4ba7cfd7a1a358
SSDEEP 3072:19ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:XctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T115847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igdyvqojgy.exe

Path C:\Temp\igdyvqojgy.exe
Size 384KB
SHA256 67a8a0db619e496cba36a74eb44a4bbb24babb0c6ccf1b5765af14b1fd23fed0
MD5 4570fd2de2669ecc22d3046376c5df0f
SHA1 8c7695da8eac86bdf7a5f3f0b57bd7e012a0bbb1
SHA512 f724553544c9c3cd498e2690abe64e74fb9bb63c3ec601aa070fda7b7f231e5081a387e007fddd7c23b4bda7448a25a0a6468c379fc8b5dbc10af890732daade
SSDEEP 3072:c9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:mctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T156847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nhfzxrpjhc.exe

Path C:\Temp\nhfzxrpjhc.exe
Size 384KB
SHA256 8753ddfc47d3e22e626cf9892e624017473e2e68130ba6667c0a4c7f7af4cee1
MD5 b43db96a74b561bd37731978dbfde956
SHA1 1b32155606e4c45e8037b124b359ae430b070471
SHA512 8ad995bb070c015b1a9baad34b0de819c1e083c0f2330a054b3b202c7fb0ea0e29bb12a59cc2fe877a17ab971bdf9a180bee60d40411b24155e820ebe04daeec
SSDEEP 3072:79ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:pctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T19E847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmkezxupmh.sys

Path C:\Temp\pmkezxupmh.sys
Size 293KB
SHA256 546c0a3dfff9e1b3aaa3ef5d5ab840753627113ea9a6a88cabd23c121c5f7994
MD5 5b0aa40cd90d7a1b642dc5fa5f17a37e
SHA1 dd142d99b02855004b339d4353ad26ab762b6dc3
SHA512 22b505f329cac787bf1a0dfa02cfba45df056b5623d369c37b89cacdad4984800155e26ff82d3c0d30abe022819da1f3e6657de60f560d4eee86b8f2bfbfeee4
SSDEEP 3072:qtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:qIJjiJcbI03GBc3ucY5DCSj
TLSH
T150545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnkfcausnk.exe

Path C:\Temp\pnkfcausnk.exe
Size 384KB
SHA256 deda1f3483a7ec3e854362e97d0e144e7331a3b38572818247f6880a3e9f951a
MD5 11d5b35b3d94fe5cd74fbffacc1c319e
SHA1 89d9278d64ea5611b93f1cdc1f51982daec6e9eb
SHA512 ce8e4cee6795f8e8872bded1227b4ca1fac4b20cc4aefcd4eee632249199cb8480f0d69de78b386f704a8f333a70ae031ae47d69c55f5e5373e1320256ef47e1
SSDEEP 3072:/9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:FctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T18B847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnkfcausqk.sys

Path C:\Temp\pnkfcausqk.sys
Size 293KB
SHA256 ac061f80c96d58f0b50b2353be7fb6a49d69c192d1ba5a7e1b257977eaf16436
MD5 45b3f56034004ff91d97095fe984b5c2
SHA1 966932dc656b185ea781715a6efabb6fdfa2f14a
SHA512 8f9360777a6719efb03d5c2ab2ba28d51d953e151ee32e4054bc18dc575fe1adaed1aaa680e4b789f2f67976771b5d69f5ee4756239b0f8a05a6814a4400f63b
SSDEEP 3072:etKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:eIJjiJcbI03GBc3ucY5DCSj
TLSH
T1D8545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tqlavtnifd.sys

Path C:\Temp\tqlavtnifd.sys
Size 293KB
SHA256 bb4424a554b95672dd3b127172c83b8572aa8fb013854db43c249e7959fb2f38
MD5 ecf6e41360c319d0b7c820b9abe32aa1
SHA1 3ddd53840302b5b5dcd42bf154bd09793dbe7907
SHA512 77f775b73b2564eed2fa192c9a0d07ace7fdf1da064dbe26e07ff00e48928f3dab9a3b597425e65355fb194278b48d76c1b100883f4051db670c72b4aab9b8f4
SSDEEP 3072:KtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:KIJjiJcbI03GBc3ucY5DCSj
TLSH
T1AA545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wurmhecwuo.exe

Path C:\Temp\wurmhecwuo.exe
Size 384KB
SHA256 beb170a4be923594aed5fa15e1fd1bf6b9bd3771eb68f2fb53da17c6b3695cae
MD5 e1708c2d2c56cc24a2139dda0bd7f996
SHA1 b7fe398e88c60a8199baaddc6f5cecd0dc9e7d57
SHA512 48dff0cb52aa6b1c31d6d13c6f97176f30ca72204418af0d446bf5cc2cb323ca6fd2eefae18c4a077b011e11ee28602312c5405bafc8e03f69803d1ade37036f
SSDEEP 3072:W9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:EctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T10A847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvpnifayvq.exe

Path C:\Temp\xvpnifayvq.exe
Size 384KB
SHA256 a1957b8d49ab71235a43065945458c6b74f71e5a8499be6adb5fb001c52b164d
MD5 387118677e0cb8061048470e0f16955d
SHA1 a33357c96bac8e08f3497481d5fc0fc2425b6a86
SHA512 fce3d7e47f896dfb357c1e510f3e5d175bb58ef209901b2ca05fa75ae2010984f102890ecdc3d1768e72285e4745298697fd424e90e44bba609c73b2fb563cff
SSDEEP 3072:s9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:2ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F0847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3f51b0e24e52d8511f72e348c132f84b6b8edb54027a5c8c4fbe2a976322a690
MD5 e32f775acc5ed08adf9d5f6678c2bc4d
SHA1 bd5f4d60c6c8f97a1fed276a8c02ca345e30bb2a
SHA512 2b2fef021516ee5e90b192840780767fff5c147cfb2dfe5b900a8b298d542111707f16c28e265447d090c61e8e091b3529eb29ff376abe03cd34315206805eba
TLSH
T1DAD09B996686AD54DD80343534A1E34B9A18F522102C46488117B064CCA464246561FF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a54d1be6da491be16ecc22dac3ad8cfbe4eabb017451e32c26f2904977fde58e
MD5 9daa45ac0383b3b978ad8da2d5000b62
SHA1 f52083ce5d095366a6fa9406b8b49000fcb53bc0
SHA512 ac55ccfd63460f712cd2ffb1ff656349475683b1ec07abd198254ac469a634f7129cf280de184340d8314fe2b8f7e955f7a112deb1511d52de882ae801a7c1af
TLSH
T17DD09B9D6686AE54DD80343134A1E34B9A18F522642C464880177054CCA464246571FF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 15e692431333f5565cc8c64f9b306824e76f4b8408e04682ccd888a763765aac
MD5 9ea95a8afdad892058832f22357bf8ca
SHA1 ce756c3187107c90e69fa53a8164dd8558081796
SHA512 5fe8bd1a8c054aec3bd683f2f1553cf6e68c089031dbab871801c83eb79fc070e13c682ce71a12f99e3d572f8a5fb2ad509cf66358ca3f86a67e0d3979e0a4e4
TLSH
T17361199C07A27592EF3139F740D3A0DD3774645B41C7EE0398B2A270C83A70636C1A71
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59d97e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59d97e.TMP
Size 3KB
SHA256 e9d6598f160ccef89b4b27b0297418a5a7fd0fd97b91e8d0539328830fa21242
MD5 e3d7ccf3e8f88ddc10c570f26f4f750d
SHA1 db6c474d39e0a9bce831f8bf21cac8d0523487e7
SHA512 1e0dee19a3c45b28c05b0ebd5a3af7b5af63a0a431249ce44db9e5c635ac784ac583a4d20838b67da01b5780e35ffab4a7fb031398fecae68a53ae27385ad167
TLSH
T1DC61099C07A67592EF3139F740E390DD3774645B41C7EE0298B2A2B4C83A70676C5A71
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 50ba76821d331b676d17730fe7e3e47bab19574ac152f8bf2999f33f665afccc
MD5 6cc41c3e61ace309d3f5a62a8e3b4e32
SHA1 46b3d45aa12ebae4f999170470cca41c96d2e51a
SHA512 23c3ce649f2523ac2c7e631d3c6755b6851d53d5242b6ad5be63864c209f184a2dfe4008a51278a2cf89c2a6b1d55d575b8af5b84689e174a7cd95cee7f89635
TLSH
T1EB41CEF3C3E4856EC91156F0AB186E2BCE1D0914432C3D5AC9E4EF1BA3E2471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 317b41695c0625fda726353faebadc3d06842ce6ec871e68202d3f4de0d3503c
MD5 050f7dbb7c8eef70790814b9c17fb415
SHA1 168a383c204e4d396d5806556484bab9b3882670
SHA512 82e756420f350d579c5065d4f4374b9223e074577a8d557f8ecd0b9f9d1574606417646a7f951142885f76477679dd4c96f88ab57d1bce6db9627ce09038445a
SSDEEP 192:sxRtRayM/jK1Ml8wCc/f+sM1rULZh8xzzoA8p9k/g6+WNCCg/YDsvGEIgtJ:sxRt08c/f+sMqlh8xia/5c/Z3
TLSH
T18162C8156A34993BDCCBD209FA517B63D6F81573A2941E04AAFCCA0C01E7ADD6213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 06d03859f43f5403598fa0492c4b7cc2ce41d8e24e88be2a3cc9e0b90905c459
MD5 7e75b37a04b5369a4a07f72201ccaff4
SHA1 ad8a1b639f4f2602194ffb88c7939ba5e9d17524
SHA512 3097b638025569ff1926a1f2e429f6702708783e20461907cd337e28c7b1b02d2c6c21611619e9f0f2679745f1ed04d4cc1bbcff450ac4e89be17886d7a056dc
SSDEEP 192:sxRWRayM/jK1Ml8wCc/f+sC1rULZh8xzzoA8p9k/g6+WNCCg/YDsvGEIgD7J:sxRW08c/f+sCqlh8xia/5c/ZZ
TLSH
T1F862D9056A34597BDCCBD209FA517F63D6F81573A2901E44AAFC8A0C01E7ADD6213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 56bdc83a03aceb27974a725814ec87ee006e76819ca9d615d0c2608254748dd9
MD5 c16feb6b0e55c2c804dfb62d456bade2
SHA1 e47cf7dc890aeac45bd9bbace131130f90a98f9c
SHA512 481d76aacfae5b7a73341e25a17b1b3784eda40b92de1a126224fe7754da61c0a9ec2d3f25a5a3db0f6098c94afb37a40cd2f605605612f83a29e123af06ad85
SSDEEP 192:sxRWRayM/jK1Ml8UQmCc/f+sC1r8LZh8xzzoA8prk/g6+WNCCg/YD5vGEIgDxJ:sxRW0qBc/f+sC6lh8xig/5c/U3
TLSH
T16D62D815AA349977DCCBD209FA517B63D6F81573A2941E04AAFCCA0C01E7ADD6213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 05d428e1f96886c223689d3a90e2dbf1804f78db0d7e6ef988fe296f63f60f5b
MD5 5862110c7a0db3ccf832ff3235057e17
SHA1 bd8f11a1bf72edc96ee02ca870ff700adb1d3035
SHA512 90316ff1e0447e9982d682b5f09fb34fd8c38c76d92ce9afcd8c49587682a909e0bd5561d07b870d3a66a9f33c1681abd17c8422b84ca15c58885259265e2348
SSDEEP 768:f+4+zH7pLuL7eDWgb/fPI8F1+UoAYDCx9Tuqh0VfUC9xbog/OVGKkIn2pro7aU:f+4+zBE7eDWgb/fPIu1jaJKkw2C7aU
TLSH
T193E2EB7B680CCB7E4F404A9DEC29BD9A6DE801CF9698C95447FA880C03C7AEB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

83776876-7d30-4a84-946f-6cf69f88dce5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\83776876-7d30-4a84-946f-6cf69f88dce5.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 fcd40e8440e2e8a66fa208413db7fd3b59fb706ff8fb93e67fb9384c1a848cc3
MD5 c1ab6520298fef2b3103294754402329
SHA1 3f2ba6b81ee63357a42a9fe4e8d0d8af40cf2fbb
SHA512 7caa42d2859b5a8fb0053d0e1e5c7c1d7c1f214d5696fa0284f82e94be022f68b838f52485ec0360203737abffea274b849bda3b5f02be2e3615a68d0b5d8d06
SSDEEP 768:qj+9C3hiV9wwifgcvaHuVboPzkZLNx9OFcYMjBe:J9C3YVV3HOawZLNqqYCe
TLSH
T1C2F2BF31BC729C278DEBC289B2462A97AFF4116385C01F48DDD86F4D04D76AD0B0BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 4b6c30a006f01e430176e073a54ac633c9e5103bd30943615d6f096127ff70f8
MD5 cc5fcf1e2a078f1329da5734ef547281
SHA1 a67844c4981e1c75ba661e30d9ea81e8a03eb0d5
SHA512 8966ac8ad47275fd36cb8fc4a9a6f3ce1d32416da6dce0d3179a00f8371c8a686b00fe12f09073187034a8ba767884ed9b9e837e46802ce4a070c82218884843
SSDEEP 768:bF1j+9e3QwgXiVP1FcHaHuVboPzkZLNx9OFcYMjBe:69e3nVtHOawZLNqqYCe
TLSH
T1A51317F198E38937D9AE8387A33D2E469EBCD153B5841984BBC45E4CCC921BFC706915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 5811d572adcd171c8b307a24d14c7e053e9f41191c50aaed5c55ddb99545279e
MD5 885951011de0277f4ac1e132c559acab
SHA1 ac18daa1c1fa132ec2235e222c8efd4c2fcadde9
SHA512 64c50bee9e69d677f8199e090555d955e72ea6a3dbd1263bdf08e4f2ab0c11cc5efe98bb2f7c3b552d5dc8db691a6a1b0880c321b20de3398804671554fefbb6
SSDEEP 768:0rv+4UNbdC3k6QwifgJaHuVboPzkZLNx9OZmUik4K:0bsbs3kKgHOawZLNq0UVr
TLSH
T18E03BF35A8749837DDF7D289B28B7A477FF4111385C40B8889EC2B4D45AB4AD170BE27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b1c3e14b-fac5-43cc-b5ee-cfb6dd21bd2b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b1c3e14b-fac5-43cc-b5ee-cfb6dd21bd2b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3856_1271869552\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 fdb3dae835f8244bb92db71c506f25ba61156aff8a3255c5dbc26d6f56a58c83
MD5 d42f8cc5090e3992c6d691fad9282bfd
SHA1 b07b004aa56cf4e0fb15873dd499a3e3414312ac
SHA512 fceee36049364fe2fcdef80a0b1094a58b7c2146d30b450980fc4eb96ddb1138d3a9755a147bdc3bcdaed6b9318a4e89127a393e9b47468fc30b029f06c9e080
TLSH
T15F71048357B8D5B2C59E5BF002835544F2BB123C076370240B51558AAA30A3554B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1052-322-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1328-341-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1432-401-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2580-195-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3176-372-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3324-270-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3396-297-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3400-282-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3844-434-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3844-430-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4020-242-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4032-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4056-409-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4516-347-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4588-405-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4964-326-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5544-418-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5648-397-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5772-384-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6088-413-0x0000000000010000-0x00000000000AB000-memory.dmp

Download