systex | 919fefacbc6c497cfd66165e474666d96e1dcc21414853f338df9ffff8ca5462

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_f3baf803922c3f5600d8dd0bae0894d2_amadey_darkgate_elex_smoke-loader_stop.exe
Size 384KB
Sample260709-tkpx9sdz3t
SHA256 919fefacbc6c497cfd66165e474666d96e1dcc21414853f338df9ffff8ca5462
MD5 f3baf803922c3f5600d8dd0bae0894d2
SHA1 b813b55bce9a6d3d717967cc1582cd186bb80b1b
SHA512 7f55ea37d303a70465c10e00be247bc218cf08b7c91842069d1346401c38af2c6af348b37991a3f4001542f76f0f57c438dfcefff50e5ba1f6916db44e885b1c
SSDEEP 3072:fbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:fbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B7847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC3F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
5908	omjebztrljgecwuo.exe
2572	omjebztrljgecwuo.sys
3124	CreateProcess.exe
3384	wrpjhbztrm.exe
1220	CreateProcess.exe
3276	CreateProcess.exe
4360	i_wrpjhbztrm.exe
3308	rljgbztrlj.sys
2108	CreateProcess.exe
404	olgeztojgb.exe
1464	CreateProcess.exe
956	CreateProcess.exe
3184	i_olgeztojgb.exe
5824	ljgbztqljg.sys
3336	CreateProcess.exe
1640	ytqljdyvto.exe
1128	CreateProcess.exe
5216	CreateProcess.exe
5644	i_ytqljdyvto.exe
5772	idyvtnlfdy.sys
6096	CreateProcess.exe
868	nlfdxvqnlf.exe
3512	CreateProcess.exe
1108	CreateProcess.exe
4740	i_nlfdxvqnlf.exe
5128	qnlfaxvqni.sys
3236	CreateProcess.exe
4668	avtnkfdxvs.exe
5320	CreateProcess.exe
4016	CreateProcess.exe
3144	i_avtnkfdxvs.exe
5952	faxsqkicau.sys
4356	CreateProcess.exe
2248	xvmkicxvpn.exe
4720	CreateProcess.exe
4736	CreateProcess.exe
2252	i_xvmkicxvpn.exe
1364	eczxspkhca.sys
3060	CreateProcess.exe
3728	hfzxrpjhcz.exe
4652	CreateProcess.exe
6036	CreateProcess.exe
1376	i_hfzxrpjhcz.exe
2424	hfzxuspkhc.sys
4956	CreateProcess.exe
5300	zxrpmhbzwr.exe
2208	CreateProcess.exe
3556	CreateProcess.exe
6012	i_zxrpmhbzwr.exe
5924	zxrpjhbztr.sys
2412	CreateProcess.exe
5416	xrpjhbzurm.exe
3040	CreateProcess.exe
4360	CreateProcess.exe
2352	i_xrpjhbzurm.exe
4128	gebwtrljge.sys
2636	CreateProcess.exe
1004	jhbztrljgb.exe
1244	CreateProcess.exe
5220	CreateProcess.exe
2424	i_jhbztrljgb.exe
1552	gbytqljdbv.sys
4452	CreateProcess.exe
2568	dbytrljdbv.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-09_f3baf803922c3f5600d8dd0bae0894d2_amadey_darkgate_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlfdxvqnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avtnkfdxvs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhbztrljgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrpjhbztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvmkicxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvmkicxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrpmhbzwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxrpmhbzwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhbztrljgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eczusmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebwuomgecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_olgeztojgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfzxrpjhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbytrljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbytrljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnligayvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cztrpjhbzu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtrligdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ytqljdyvto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ytqljdyvto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfzxrpjhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkfcausqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkfcxupmkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebwuomgecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlfdxvqnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_avtnkfdxvs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnligayvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkfcausqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkfcxupmkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eczusmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrpjhbztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpjhbzurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkicavsnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cztrpjhbzu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtrligdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	olgeztojgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpjhbzurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkicavsnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omjebztrljgecwuo.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2904	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2444	ipconfig.exe
1528	ipconfig.exe
3716	ipconfig.exe
4320	ipconfig.exe
2380	ipconfig.exe
4512	ipconfig.exe
4408	ipconfig.exe
3356	ipconfig.exe
3648	ipconfig.exe
3388	ipconfig.exe
5180	ipconfig.exe
2588	ipconfig.exe
5784	ipconfig.exe
2608	ipconfig.exe
4740	ipconfig.exe
1704	ipconfig.exe
1364	ipconfig.exe
4780	ipconfig.exe
2136	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2786392678-1011493168-3329660577-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280868456033554"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2786392678-1011493168-3329660577-1000\{408E1806-C617-4EA1-9A00-F3FACC7BD4CC}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2200	2026-07-09_f3baf803922c3f5600d8dd0bae0894d2_amadey_darkgate_elex_smoke-loader_stop.exe
2200	2026-07-09_f3baf803922c3f5600d8dd0bae0894d2_amadey_darkgate_elex_smoke-loader_stop.exe
2200	2026-07-09_f3baf803922c3f5600d8dd0bae0894d2_amadey_darkgate_elex_smoke-loader_stop.exe
2200	2026-07-09_f3baf803922c3f5600d8dd0bae0894d2_amadey_darkgate_elex_smoke-loader_stop.exe
2200	2026-07-09_f3baf803922c3f5600d8dd0bae0894d2_amadey_darkgate_elex_smoke-loader_stop.exe
2200	2026-07-09_f3baf803922c3f5600d8dd0bae0894d2_amadey_darkgate_elex_smoke-loader_stop.exe
2200	2026-07-09_f3baf803922c3f5600d8dd0bae0894d2_amadey_darkgate_elex_smoke-loader_stop.exe
2200	2026-07-09_f3baf803922c3f5600d8dd0bae0894d2_amadey_darkgate_elex_smoke-loader_stop.exe
2200	2026-07-09_f3baf803922c3f5600d8dd0bae0894d2_amadey_darkgate_elex_smoke-loader_stop.exe
2200	2026-07-09_f3baf803922c3f5600d8dd0bae0894d2_amadey_darkgate_elex_smoke-loader_stop.exe
2200	2026-07-09_f3baf803922c3f5600d8dd0bae0894d2_amadey_darkgate_elex_smoke-loader_stop.exe
2200	2026-07-09_f3baf803922c3f5600d8dd0bae0894d2_amadey_darkgate_elex_smoke-loader_stop.exe
2200	2026-07-09_f3baf803922c3f5600d8dd0bae0894d2_amadey_darkgate_elex_smoke-loader_stop.exe
2200	2026-07-09_f3baf803922c3f5600d8dd0bae0894d2_amadey_darkgate_elex_smoke-loader_stop.exe
2200	2026-07-09_f3baf803922c3f5600d8dd0bae0894d2_amadey_darkgate_elex_smoke-loader_stop.exe
2200	2026-07-09_f3baf803922c3f5600d8dd0bae0894d2_amadey_darkgate_elex_smoke-loader_stop.exe
2200	2026-07-09_f3baf803922c3f5600d8dd0bae0894d2_amadey_darkgate_elex_smoke-loader_stop.exe
2200	2026-07-09_f3baf803922c3f5600d8dd0bae0894d2_amadey_darkgate_elex_smoke-loader_stop.exe
2200	2026-07-09_f3baf803922c3f5600d8dd0bae0894d2_amadey_darkgate_elex_smoke-loader_stop.exe
2200	2026-07-09_f3baf803922c3f5600d8dd0bae0894d2_amadey_darkgate_elex_smoke-loader_stop.exe
2200	2026-07-09_f3baf803922c3f5600d8dd0bae0894d2_amadey_darkgate_elex_smoke-loader_stop.exe
2200	2026-07-09_f3baf803922c3f5600d8dd0bae0894d2_amadey_darkgate_elex_smoke-loader_stop.exe
2200	2026-07-09_f3baf803922c3f5600d8dd0bae0894d2_amadey_darkgate_elex_smoke-loader_stop.exe
2200	2026-07-09_f3baf803922c3f5600d8dd0bae0894d2_amadey_darkgate_elex_smoke-loader_stop.exe
2200	2026-07-09_f3baf803922c3f5600d8dd0bae0894d2_amadey_darkgate_elex_smoke-loader_stop.exe
2200	2026-07-09_f3baf803922c3f5600d8dd0bae0894d2_amadey_darkgate_elex_smoke-loader_stop.exe
2200	2026-07-09_f3baf803922c3f5600d8dd0bae0894d2_amadey_darkgate_elex_smoke-loader_stop.exe
2200	2026-07-09_f3baf803922c3f5600d8dd0bae0894d2_amadey_darkgate_elex_smoke-loader_stop.exe
2200	2026-07-09_f3baf803922c3f5600d8dd0bae0894d2_amadey_darkgate_elex_smoke-loader_stop.exe
2200	2026-07-09_f3baf803922c3f5600d8dd0bae0894d2_amadey_darkgate_elex_smoke-loader_stop.exe
2200	2026-07-09_f3baf803922c3f5600d8dd0bae0894d2_amadey_darkgate_elex_smoke-loader_stop.exe
2200	2026-07-09_f3baf803922c3f5600d8dd0bae0894d2_amadey_darkgate_elex_smoke-loader_stop.exe
2200	2026-07-09_f3baf803922c3f5600d8dd0bae0894d2_amadey_darkgate_elex_smoke-loader_stop.exe
2200	2026-07-09_f3baf803922c3f5600d8dd0bae0894d2_amadey_darkgate_elex_smoke-loader_stop.exe
2200	2026-07-09_f3baf803922c3f5600d8dd0bae0894d2_amadey_darkgate_elex_smoke-loader_stop.exe
2200	2026-07-09_f3baf803922c3f5600d8dd0bae0894d2_amadey_darkgate_elex_smoke-loader_stop.exe
2200	2026-07-09_f3baf803922c3f5600d8dd0bae0894d2_amadey_darkgate_elex_smoke-loader_stop.exe
2200	2026-07-09_f3baf803922c3f5600d8dd0bae0894d2_amadey_darkgate_elex_smoke-loader_stop.exe
2200	2026-07-09_f3baf803922c3f5600d8dd0bae0894d2_amadey_darkgate_elex_smoke-loader_stop.exe
2200	2026-07-09_f3baf803922c3f5600d8dd0bae0894d2_amadey_darkgate_elex_smoke-loader_stop.exe
2200	2026-07-09_f3baf803922c3f5600d8dd0bae0894d2_amadey_darkgate_elex_smoke-loader_stop.exe
2200	2026-07-09_f3baf803922c3f5600d8dd0bae0894d2_amadey_darkgate_elex_smoke-loader_stop.exe
2200	2026-07-09_f3baf803922c3f5600d8dd0bae0894d2_amadey_darkgate_elex_smoke-loader_stop.exe
2200	2026-07-09_f3baf803922c3f5600d8dd0bae0894d2_amadey_darkgate_elex_smoke-loader_stop.exe
2200	2026-07-09_f3baf803922c3f5600d8dd0bae0894d2_amadey_darkgate_elex_smoke-loader_stop.exe
2200	2026-07-09_f3baf803922c3f5600d8dd0bae0894d2_amadey_darkgate_elex_smoke-loader_stop.exe
2200	2026-07-09_f3baf803922c3f5600d8dd0bae0894d2_amadey_darkgate_elex_smoke-loader_stop.exe
2200	2026-07-09_f3baf803922c3f5600d8dd0bae0894d2_amadey_darkgate_elex_smoke-loader_stop.exe
2200	2026-07-09_f3baf803922c3f5600d8dd0bae0894d2_amadey_darkgate_elex_smoke-loader_stop.exe
2200	2026-07-09_f3baf803922c3f5600d8dd0bae0894d2_amadey_darkgate_elex_smoke-loader_stop.exe
2200	2026-07-09_f3baf803922c3f5600d8dd0bae0894d2_amadey_darkgate_elex_smoke-loader_stop.exe
2200	2026-07-09_f3baf803922c3f5600d8dd0bae0894d2_amadey_darkgate_elex_smoke-loader_stop.exe
2200	2026-07-09_f3baf803922c3f5600d8dd0bae0894d2_amadey_darkgate_elex_smoke-loader_stop.exe
2200	2026-07-09_f3baf803922c3f5600d8dd0bae0894d2_amadey_darkgate_elex_smoke-loader_stop.exe
2200	2026-07-09_f3baf803922c3f5600d8dd0bae0894d2_amadey_darkgate_elex_smoke-loader_stop.exe
2200	2026-07-09_f3baf803922c3f5600d8dd0bae0894d2_amadey_darkgate_elex_smoke-loader_stop.exe
5908	omjebztrljgecwuo.exe
5908	omjebztrljgecwuo.exe
5908	omjebztrljgecwuo.exe
5908	omjebztrljgecwuo.exe
5908	omjebztrljgecwuo.exe
5908	omjebztrljgecwuo.exe
5908	omjebztrljgecwuo.exe
5908	omjebztrljgecwuo.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	4360	i_wrpjhbztrm.exe
Token: SeDebugPrivilege	3184	i_olgeztojgb.exe
Token: SeDebugPrivilege	5644	i_ytqljdyvto.exe
Token: SeDebugPrivilege	4740	i_nlfdxvqnlf.exe
Token: SeDebugPrivilege	3144	i_avtnkfdxvs.exe
Token: SeDebugPrivilege	2252	i_xvmkicxvpn.exe
Token: SeDebugPrivilege	1376	i_hfzxrpjhcz.exe
Token: SeDebugPrivilege	6012	i_zxrpmhbzwr.exe
Token: SeDebugPrivilege	2352	i_xrpjhbzurm.exe
Token: SeDebugPrivilege	2424	i_jhbztrljgb.exe
Token: SeDebugPrivilege	2560	i_dbytrljdbv.exe
Token: SeDebugPrivilege	5972	i_vtnligayvq.exe
Token: SeDebugPrivilege	4992	i_sqkicavsnl.exe
Token: SeDebugPrivilege	612	i_nkfcausqni.exe
Token: SeDebugPrivilege	6112	i_nkfcxupmkf.exe
Token: SeDebugPrivilege	2756	i_eczusmkecw.exe
Token: SeDebugPrivilege	2536	i_cztrpjhbzu.exe
Token: SeDebugPrivilege	2476	i_ebwuomgecw.exe
Token: SeDebugPrivilege	2040	i_wtrligdbvt.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5148	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 5908	2200	2026-07-09_f3baf803922c3f5600d8dd0bae0894d2_amadey_darkgate_elex_smoke-loader_stop.exe	88
PID 2200 wrote to memory of 4820	2200	2026-07-09_f3baf803922c3f5600d8dd0bae0894d2_amadey_darkgate_elex_smoke-loader_stop.exe	89
PID 4820 wrote to memory of 5148	4820	iexplore.exe	90
PID 5148 wrote to memory of 2944	5148	msedge.exe	91
PID 5148 wrote to memory of 2904	5148	msedge.exe	93
PID 5148 wrote to memory of 556	5148	msedge.exe	94
PID 5148 wrote to memory of 556	5148	msedge.exe	94
PID 5148 wrote to memory of 556	5148	msedge.exe	94
PID 5148 wrote to memory of 3272	5148	msedge.exe	95
PID 5148 wrote to memory of 3272	5148	msedge.exe	95
PID 5148 wrote to memory of 1824	5148	msedge.exe	97
PID 5148 wrote to memory of 5588	5148	msedge.exe	96
PID 5148 wrote to memory of 1824	5148	msedge.exe	97
PID 5148 wrote to memory of 1824	5148	msedge.exe	97
PID 5148 wrote to memory of 5588	5148	msedge.exe	96
PID 5148 wrote to memory of 5588	5148	msedge.exe	96
PID 5148 wrote to memory of 1816	5148	msedge.exe	99
PID 5148 wrote to memory of 3496	5148	msedge.exe	98
PID 5148 wrote to memory of 1816	5148	msedge.exe	99
PID 5148 wrote to memory of 1816	5148	msedge.exe	99
PID 5148 wrote to memory of 3496	5148	msedge.exe	98
PID 5148 wrote to memory of 3496	5148	msedge.exe	98
PID 5148 wrote to memory of 1832	5148	msedge.exe	101
PID 5148 wrote to memory of 1832	5148	msedge.exe	101
PID 5148 wrote to memory of 3024	5148	msedge.exe	104
PID 5148 wrote to memory of 5232	5148	msedge.exe	105
PID 5148 wrote to memory of 3024	5148	msedge.exe	104
PID 5148 wrote to memory of 5232	5148	msedge.exe	105
PID 5908 wrote to memory of 3124	5908	omjebztrljgecwuo.exe	106
PID 5148 wrote to memory of 960	5148	msedge.exe	109
PID 3384 wrote to memory of 1220	3384	wrpjhbztrm.exe	111
PID 5148 wrote to memory of 4168	5148	msedge.exe	114
PID 5148 wrote to memory of 4168	5148	msedge.exe	114
PID 5148 wrote to memory of 2084	5148	msedge.exe	117
PID 5148 wrote to memory of 2084	5148	msedge.exe	117
PID 5908 wrote to memory of 3276	5908	omjebztrljgecwuo.exe	118
PID 5908 wrote to memory of 2108	5908	omjebztrljgecwuo.exe	122
PID 404 wrote to memory of 1464	404	olgeztojgb.exe	124
PID 5908 wrote to memory of 956	5908	omjebztrljgecwuo.exe	127
PID 5908 wrote to memory of 3336	5908	omjebztrljgecwuo.exe	131
PID 1640 wrote to memory of 1128	1640	ytqljdyvto.exe	133
PID 5908 wrote to memory of 5216	5908	omjebztrljgecwuo.exe	136
PID 5908 wrote to memory of 6096	5908	omjebztrljgecwuo.exe	141
PID 868 wrote to memory of 3512	868	nlfdxvqnlf.exe	143
PID 5148 wrote to memory of 4756	5148	msedge.exe	146
PID 5148 wrote to memory of 5016	5148	msedge.exe	147
PID 5148 wrote to memory of 6036	5148	msedge.exe	148
PID 5908 wrote to memory of 1108	5908	omjebztrljgecwuo.exe	149
PID 5908 wrote to memory of 3236	5908	omjebztrljgecwuo.exe	153
PID 4668 wrote to memory of 5320	4668	avtnkfdxvs.exe	155
PID 5908 wrote to memory of 4016	5908	omjebztrljgecwuo.exe	158
PID 5148 wrote to memory of 2696	5148	msedge.exe	160
PID 5148 wrote to memory of 2696	5148	msedge.exe	160
PID 5148 wrote to memory of 2696	5148	msedge.exe	160
PID 5148 wrote to memory of 5812	5148	msedge.exe	161
PID 5148 wrote to memory of 5812	5148	msedge.exe	161
PID 5148 wrote to memory of 5812	5148	msedge.exe	161
PID 5908 wrote to memory of 4356	5908	omjebztrljgecwuo.exe	164
PID 2248 wrote to memory of 4720	2248	xvmkicxvpn.exe	166
PID 5908 wrote to memory of 4736	5908	omjebztrljgecwuo.exe	169
PID 5908 wrote to memory of 3060	5908	omjebztrljgecwuo.exe	173
PID 3728 wrote to memory of 4652	3728	hfzxrpjhcz.exe	175
PID 5908 wrote to memory of 6036	5908	omjebztrljgecwuo.exe	178
PID 5908 wrote to memory of 4956	5908	omjebztrljgecwuo.exe	182

C:\Users\Admin\AppData\Local\Temp\2026-07-09_f3baf803922c3f5600d8dd0bae0894d2_amadey_darkgate_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_f3baf803922c3f5600d8dd0bae0894d2_amadey_darkgate_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Temp\omjebztrljgecwuo.exe
  C:\Temp\omjebztrljgecwuo.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5908
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wrpjhbztrm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3124
  - - C:\Temp\wrpjhbztrm.exe
      C:\Temp\wrpjhbztrm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3384
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1220
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1704
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wrpjhbztrm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3276
  - - C:\Temp\i_wrpjhbztrm.exe
      C:\Temp\i_wrpjhbztrm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4360
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\olgeztojgb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2108
  - - C:\Temp\olgeztojgb.exe
      C:\Temp\olgeztojgb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:404
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1464
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4320
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_olgeztojgb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:956
  - - C:\Temp\i_olgeztojgb.exe
      C:\Temp\i_olgeztojgb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3184
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ytqljdyvto.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3336
  - - C:\Temp\ytqljdyvto.exe
      C:\Temp\ytqljdyvto.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1640
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1128
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5180
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ytqljdyvto.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5216
  - - C:\Temp\i_ytqljdyvto.exe
      C:\Temp\i_ytqljdyvto.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5644
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nlfdxvqnlf.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6096
  - - C:\Temp\nlfdxvqnlf.exe
      C:\Temp\nlfdxvqnlf.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:868
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3512
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1364
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nlfdxvqnlf.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1108
  - - C:\Temp\i_nlfdxvqnlf.exe
      C:\Temp\i_nlfdxvqnlf.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4740
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\avtnkfdxvs.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3236
  - - C:\Temp\avtnkfdxvs.exe
      C:\Temp\avtnkfdxvs.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4668
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5320
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2380
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_avtnkfdxvs.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4016
  - - C:\Temp\i_avtnkfdxvs.exe
      C:\Temp\i_avtnkfdxvs.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3144
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvmkicxvpn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4356
  - - C:\Temp\xvmkicxvpn.exe
      C:\Temp\xvmkicxvpn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2248
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4720
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4512
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xvmkicxvpn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4736
  - - C:\Temp\i_xvmkicxvpn.exe
      C:\Temp\i_xvmkicxvpn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2252
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hfzxrpjhcz.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3060
  - - C:\Temp\hfzxrpjhcz.exe
      C:\Temp\hfzxrpjhcz.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3728
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4652
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4408
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hfzxrpjhcz.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6036
  - - C:\Temp\i_hfzxrpjhcz.exe
      C:\Temp\i_hfzxrpjhcz.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1376
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zxrpmhbzwr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4956
  - - C:\Temp\zxrpmhbzwr.exe
      C:\Temp\zxrpmhbzwr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5300
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2208
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1528
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zxrpmhbzwr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3556
  - - C:\Temp\i_zxrpmhbzwr.exe
      C:\Temp\i_zxrpmhbzwr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6012
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xrpjhbzurm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2412
  - - C:\Temp\xrpjhbzurm.exe
      C:\Temp\xrpjhbzurm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5416
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3040
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3356
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xrpjhbzurm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4360
  - - C:\Temp\i_xrpjhbzurm.exe
      C:\Temp\i_xrpjhbzurm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2352
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jhbztrljgb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2636
  - - C:\Temp\jhbztrljgb.exe
      C:\Temp\jhbztrljgb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1004
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1244
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4780
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jhbztrljgb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5220
  - - C:\Temp\i_jhbztrljgb.exe
      C:\Temp\i_jhbztrljgb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2424
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbytrljdbv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4452
  - - C:\Temp\dbytrljdbv.exe
      C:\Temp\dbytrljdbv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2568
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4192
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2588
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbytrljdbv.exe ups_ins
    3⤵
    PID:5760
  - - C:\Temp\i_dbytrljdbv.exe
      C:\Temp\i_dbytrljdbv.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2560
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtnligayvq.exe ups_run
    3⤵
    PID:3488
  - - C:\Temp\vtnligayvq.exe
      C:\Temp\vtnligayvq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5988
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3496
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2136
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtnligayvq.exe ups_ins
    3⤵
    PID:4408
  - - C:\Temp\i_vtnligayvq.exe
      C:\Temp\i_vtnligayvq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5972
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqkicavsnl.exe ups_run
    3⤵
    PID:3364
  - - C:\Temp\sqkicavsnl.exe
      C:\Temp\sqkicavsnl.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5060
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1376
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5784
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqkicavsnl.exe ups_ins
    3⤵
    PID:2424
  - - C:\Temp\i_sqkicavsnl.exe
      C:\Temp\i_sqkicavsnl.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4992
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nkfcausqni.exe ups_run
    3⤵
    PID:3008
  - - C:\Temp\nkfcausqni.exe
      C:\Temp\nkfcausqni.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4440
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5796
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2608
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nkfcausqni.exe ups_ins
    3⤵
    PID:608
  - - C:\Temp\i_nkfcausqni.exe
      C:\Temp\i_nkfcausqni.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:612
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nkfcxupmkf.exe ups_run
    3⤵
    PID:5564
  - - C:\Temp\nkfcxupmkf.exe
      C:\Temp\nkfcxupmkf.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1328
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4496
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3648
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nkfcxupmkf.exe ups_ins
    3⤵
    PID:5648
  - - C:\Temp\i_nkfcxupmkf.exe
      C:\Temp\i_nkfcxupmkf.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6112
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\eczusmkecw.exe ups_run
    3⤵
    PID:1880
  - - C:\Temp\eczusmkecw.exe
      C:\Temp\eczusmkecw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3432
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1520
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3716
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_eczusmkecw.exe ups_ins
    3⤵
    PID:4128
  - - C:\Temp\i_eczusmkecw.exe
      C:\Temp\i_eczusmkecw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2756
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cztrpjhbzu.exe ups_run
    3⤵
    PID:1368
  - - C:\Temp\cztrpjhbzu.exe
      C:\Temp\cztrpjhbzu.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2760
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4288
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3388
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cztrpjhbzu.exe ups_ins
    3⤵
    PID:5264
  - - C:\Temp\i_cztrpjhbzu.exe
      C:\Temp\i_cztrpjhbzu.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2536
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ebwuomgecw.exe ups_run
    3⤵
    PID:3252
  - - C:\Temp\ebwuomgecw.exe
      C:\Temp\ebwuomgecw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6088
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3720
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4740
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ebwuomgecw.exe ups_ins
    3⤵
    PID:4340
  - - C:\Temp\i_ebwuomgecw.exe
      C:\Temp\i_ebwuomgecw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2476
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wtrligdbvt.exe ups_run
    3⤵
    PID:5896
  - - C:\Temp\wtrligdbvt.exe
      C:\Temp\wtrligdbvt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3368
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1868
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2444
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wtrligdbvt.exe ups_ins
    3⤵
    PID:2376
  - - C:\Temp\i_wtrligdbvt.exe
      C:\Temp\i_wtrligdbvt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2040
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffeba65c188,0x7ffeba65c194,0x7ffeba65c1a0
      4⤵
      PID:2944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,11110436708617249811,10551899051026977181,524288 --field-trial-handle=2604,i,6427344879565734434,5298716922773110854,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:11
      4⤵
      System Time Discovery
      PID:2904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,15235332036857377786,3634141860424384958,262144 --field-trial-handle=2604,i,6427344879565734434,5298716922773110854,262144 --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:2
      4⤵
      PID:556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2316,i,14129209399015846591,7536484913407426920,524288 --field-trial-handle=2604,i,6427344879565734434,5298716922773110854,262144 --variations-seed-version --mojo-platform-channel-handle=2700 /prefetch:13
      4⤵
      PID:3272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3592,i,15176026520012944747,8791131608525488408,2097152 --field-trial-handle=2604,i,6427344879565734434,5298716922773110854,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
      4⤵
      PID:5588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3600,i,13450605355297994355,13284366804560607035,2097152 --field-trial-handle=2604,i,6427344879565734434,5298716922773110854,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
      4⤵
      PID:1824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4320,i,7644537902860485914,18159845213470842941,2097152 --field-trial-handle=2604,i,6427344879565734434,5298716922773110854,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:1
      4⤵
      PID:3496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4336,i,258723077601081644,8881123079941536272,2097152 --field-trial-handle=2604,i,6427344879565734434,5298716922773110854,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:9
      4⤵
      PID:1816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3608,i,1391852592782072120,4100191499459362021,524288 --field-trial-handle=2604,i,6427344879565734434,5298716922773110854,262144 --variations-seed-version --mojo-platform-channel-handle=3860 /prefetch:14
      4⤵
      PID:1832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3844,i,4262791859074268802,7012118547522976407,524288 --field-trial-handle=2604,i,6427344879565734434,5298716922773110854,262144 --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:14
      4⤵
      PID:3024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3864,i,7987621587966224830,5709589297167645601,524288 --field-trial-handle=2604,i,6427344879565734434,5298716922773110854,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
      4⤵
      PID:5232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,959204413839814593,4591003778022911905,524288 --field-trial-handle=2604,i,6427344879565734434,5298716922773110854,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:14
      4⤵
      PID:3344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,959204413839814593,4591003778022911905,524288 --field-trial-handle=2604,i,6427344879565734434,5298716922773110854,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:14
      4⤵
      PID:960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,1012874774740488123,14274700654927718209,524288 --field-trial-handle=2604,i,6427344879565734434,5298716922773110854,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:14
      4⤵
      PID:4168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6588,i,818477788118189035,190723739548959898,524288 --field-trial-handle=2604,i,6427344879565734434,5298716922773110854,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:14
      4⤵
      PID:2084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4784,i,6922743159960046253,924153674290064003,524288 --field-trial-handle=2604,i,6427344879565734434,5298716922773110854,262144 --variations-seed-version --mojo-platform-channel-handle=744 /prefetch:14
      4⤵
      PID:4756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,3648461642958085082,9883265920154552854,524288 --field-trial-handle=2604,i,6427344879565734434,5298716922773110854,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:14
      4⤵
      PID:5016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4876,i,10376374672090342195,348658037698719419,524288 --field-trial-handle=2604,i,6427344879565734434,5298716922773110854,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:14
      4⤵
      PID:6036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5404,i,16096223289756969811,9207132481090331496,2097152 --field-trial-handle=2604,i,6427344879565734434,5298716922773110854,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:1
      4⤵
      PID:2696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5520,i,9453621579255584210,6701898968587860862,2097152 --field-trial-handle=2604,i,6427344879565734434,5298716922773110854,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
      4⤵
      PID:5812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,2507974064349042674,13793818984310439147,524288 --field-trial-handle=2604,i,6427344879565734434,5298716922773110854,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:14
      4⤵
      PID:2644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6280,i,8103761716598713538,1400989028589443607,262144 --field-trial-handle=2604,i,6427344879565734434,5298716922773110854,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:10
      4⤵
      PID:3868

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3736

C:\Temp\omjebztrljgecwuo.sys
C:\Temp\omjebztrljgecwuo.sys
1⤵
- Executes dropped EXE
PID:2572

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5216

C:\Temp\rljgbztrlj.sys
C:\Temp\rljgbztrlj.sys
1⤵
- Executes dropped EXE
PID:3308

C:\Temp\ljgbztqljg.sys
C:\Temp\ljgbztqljg.sys
1⤵
- Executes dropped EXE
PID:5824

C:\Temp\idyvtnlfdy.sys
C:\Temp\idyvtnlfdy.sys
1⤵
- Executes dropped EXE
PID:5772

C:\Temp\qnlfaxvqni.sys
C:\Temp\qnlfaxvqni.sys
1⤵
- Executes dropped EXE
PID:5128

C:\Temp\faxsqkicau.sys
C:\Temp\faxsqkicau.sys
1⤵
- Executes dropped EXE
PID:5952

C:\Temp\eczxspkhca.sys
C:\Temp\eczxspkhca.sys
1⤵
- Executes dropped EXE
PID:1364

C:\Temp\hfzxuspkhc.sys
C:\Temp\hfzxuspkhc.sys
1⤵
- Executes dropped EXE
PID:2424

C:\Temp\zxrpjhbztr.sys
C:\Temp\zxrpjhbztr.sys
1⤵
- Executes dropped EXE
PID:5924

C:\Temp\gebwtrljge.sys
C:\Temp\gebwtrljge.sys
1⤵
- Executes dropped EXE
PID:4128

C:\Temp\gbytqljdbv.sys
C:\Temp\gbytqljdbv.sys
1⤵
- Executes dropped EXE
PID:1552

C:\Temp\dbytqoigay.sys
C:\Temp\dbytqoigay.sys
1⤵
PID:4480

C:\Temp\yvqnlfdyvq.sys
C:\Temp\yvqnlfdyvq.sys
1⤵
PID:6068

C:\Temp\nkfdxvsnlf.sys
C:\Temp\nkfdxvsnlf.sys
1⤵
PID:4020

C:\Temp\kicauspnkf.sys
C:\Temp\kicauspnkf.sys
1⤵
PID:4480

C:\Temp\pmkecausmk.sys
C:\Temp\pmkecausmk.sys
1⤵
PID:3212

C:\Temp\bzxusmjecw.sys
C:\Temp\bzxusmjecw.sys
1⤵
PID:788

C:\Temp\ebwuomgezw.sys
C:\Temp\ebwuomgezw.sys
1⤵
PID:3204

C:\Temp\ywqojgeywq.sys
C:\Temp\ywqojgeywq.sys
1⤵
PID:5356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

avtnkfdxvs.exe

Path C:\Temp\avtnkfdxvs.exe
Size 384KB
SHA256 1df0063cf82d5b7403251e37d37a960ed81497579d95090fae6414e02fbd6aa2
MD5 97e126f81468a87ca1635891ae57c849
SHA1 cd5f44032165bfc7c5f1cd33f3e8f032f986b199
SHA512 ccf8e453e19d94a53d6c6709eb1c9f8bc96ae3902feb1a0aa1e579fd63ea982eebe7eacc5201ae51f6fac8fc50845a8b8b650d78bc9c33b2b7657f172af5c1cd
SSDEEP 3072:BbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:Bbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T143847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC3F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

faxsqkicau.sys

Path C:\Temp\faxsqkicau.sys
Size 293KB
SHA256 9ea08f1a8854d255fcf3245374d8dd19a4415c018bc723fad25515e9911ea908
MD5 70d20124927689d1ea6610dda4497be1
SHA1 6c43695ab8723014400a38db228cdf480f64a2ef
SHA512 566d1469f60100d9074934eef46b26341edae61af449e868e4057a353df7be80fbefc730cae1355df5a2be823400a69c67dc842fef120bd1707a4a5c5b88dd10
SSDEEP 3072:FtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:FIJjiJcbI03GBc3ucY5DCSj
TLSH
T1DE545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_avtnkfdxvs.exe

Path C:\Temp\i_avtnkfdxvs.exe
Size 384KB
SHA256 72a8bb2ec028317ff058116f72950e8d154eb84658bc94db389ea9abcd0aa381
MD5 65d3f1edea166af4db5e61badb2f8643
SHA1 02b849abe85e1233fc77e6e0db820cf5cc82bd28
SHA512 f9e9f44897dc21a0bb1a00836cc23412c478a81771dafb1938a41c25b97972bb49fd4f1fcf32c16553796d3cfacebff79ed0146be843f61de4f384b961afc804
SSDEEP 3072:vbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:vbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T15A847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC3F754CE5D9A517C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nlfdxvqnlf.exe

Path C:\Temp\i_nlfdxvqnlf.exe
Size 384KB
SHA256 f66c30ba5ff1b05eb0fc33662ad9c69fe26f69b0a0f1b5f4c6bfefb0489fa5ef
MD5 b509e5ffe1e2d16885c4b12c03164d1b
SHA1 73193e345d8014c22f1383912906466895bc4da3
SHA512 90d4bc995cb88640ec9d2c9ee856894cb14d3fce03c89a0ca172fecbc38526cdf390f894be689c2a9aa86f81f629d7b5524b2bd2b5b911f743db210ca7ce48ec
SSDEEP 3072:3btF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:3btt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T111847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_olgeztojgb.exe

Path C:\Temp\i_olgeztojgb.exe
Size 384KB
SHA256 4d44bc2a242b6f997d3f9b46baa0bdd02e4c524d315234ffe5bd43b0e58dcc17
MD5 1f7a12df43d2ebb0e6445331a110f8dd
SHA1 7f3ca8ff865e44c8acfeac8fb8c3aafb53e53dad
SHA512 df1d44e7455214d30a3be710f6ef855885c88e862f350e115e4137d76ea95a4a40fb54a20d372131c17d810f718ac11782d0bed22654706002a02beadb5d0964
SSDEEP 3072:MbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:Mbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T17B847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC3F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wrpjhbztrm.exe

Path C:\Temp\i_wrpjhbztrm.exe
Size 384KB
SHA256 d139fc69f99c0c3e84036d354622dd1077ec269428204912614f49d2c2fd32d0
MD5 14b293d83bec1e5960ac24362cdc1e35
SHA1 fee20654622b9f83a09b8cae1c8be34a1875abb4
SHA512 c96579c8c84a4e4088e3cf7396a5e05d078e0fa27c91f49bd16104cfefd53c8b6b2acf439f939e68568659bb77a9446326383334eb7fea2f9305ac4ee3bc8010
SSDEEP 3072:KbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:Kbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T17A847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ytqljdyvto.exe

Path C:\Temp\i_ytqljdyvto.exe
Size 384KB
SHA256 98bf03b3c2b384961a3f77884fb4444921c4f5a10cbe625714be8415ae9864b0
MD5 88e71bb4e9eb001402c8d7ae1732fbeb
SHA1 9266c7fd66da043c19f693504d200292775a8771
SHA512 978320438bf99dd4594b5c60327613a4bb40cb1a7522c4b1017a3a95a57042378fab23808eb6edb749306e5e8391785039601559c4bf5122373b3edcae4695e9
SSDEEP 3072:ebtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyd:ebtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T188847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idyvtnlfdy.sys

Path C:\Temp\idyvtnlfdy.sys
Size 293KB
SHA256 40141a575662a29d9632f7078d7177bb43b15f96af43a3b3eae12ad62699ad85
MD5 f59f582e97ee0261b1995bb065f85429
SHA1 7206d5e0f469268afef097eb56b5324af5bc1652
SHA512 bfd4c62e4085fe1462858285286603031cf831a81662f63e73b04d99eb7641497e8b55077dd05111a648fc9a8d56afd2d9debe7ec20dbd93e572370087eeaf2c
SSDEEP 3072:ptKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:pIJjiJcbI03GBc3ucY5DCSj
TLSH
T11B545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljgbztqljg.sys

Path C:\Temp\ljgbztqljg.sys
Size 293KB
SHA256 d3eb5d533b1f077d682e3592f99632a2d4f69cf95b6e3455a1e7c6d8ca9f8170
MD5 9f3a037db0ecb1f44ea068d048f17a60
SHA1 f3e6385b5e06da957e369ed64283cc5d9bd9b804
SHA512 92d5525215aa2ae9b2318395110bbe24602db7aff6de6ab02121ef8de54d740250d3e72b1e8eba3ad333a5de815c0dc78afb58f6a057aaad1dbc422649050093
SSDEEP 3072:MtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:MIJjiJcbI03GBc3ucY5DCSj
TLSH
T12B545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlfdxvqnlf.exe

Path C:\Temp\nlfdxvqnlf.exe
Size 384KB
SHA256 e4ce8f78c6397601647b16ae524b37859b6cced0f9b2e0234a76bd00dd9d37ff
MD5 fc44e4797ffe2f622f964228368c4928
SHA1 d807b71109549ff995b7f245df9701270a433f7a
SHA512 653b69c4d798e9e0164599eef0dd16a59c20f4ef330af869bf0ac8dad1ccb11d54d3d4e2dbf1b4244461ac35d575e17009dd25530f19528f54142edc3dc256ef
SSDEEP 3072:qqbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9p5:Zbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F1847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F354CE5D9A517C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

olgeztojgb.exe

Path C:\Temp\olgeztojgb.exe
Size 384KB
SHA256 04617523e9aa71aafbd419d08ea302a6596e23de2c2d34d6a6e3cb2f73b397c6
MD5 413a854d7da8359f9b2b475d6359ef90
SHA1 4b6c434d15b29882244b16421f3ed14c820ea123
SHA512 a4e049209824f8517cab83025c67420f8afb90d6e81e427c2a64d36d3bd39add8cf1d8117d45f2f31326d1727ec7fda9681e9715fb2d0062b0d4c987a4d382fa
SSDEEP 3072:gbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:gbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E4847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omjebztrljgecwuo.exe

Path C:\Temp\omjebztrljgecwuo.exe
Size 384KB
SHA256 f07052937ebd972571429fe8190393fa71737f52aaebb88dc6ed0b199b82cc69
MD5 46b655ed6c9153c81b46ad19c093f55d
SHA1 77be6aae73892a5d6e555b7c88ffbd91f1b6b5c9
SHA512 8889f9b5727ec96526c80db0c1f2dabb36426b735d9cd417be266792786c3aa4bb51dd9bd6855b1246f2a2cabd36296f70ae31799d64808943b0cd755ba0c2c4
SSDEEP 3072:+btF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:+btt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T182847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC3F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omjebztrljgecwuo.sys

Path C:\Temp\omjebztrljgecwuo.sys
Size 293KB
SHA256 5a3793a4ed8faaffdf958a3ddeddd9a699dcc92bb02e6cb19e4f24d5a7c77481
MD5 0b47a64ff224448d731d1bec9d9960ec
SHA1 dd88a9834bf4fabb5aa540e29b79e79af6eb7081
SHA512 f86c0ca7cc0be6d1aedb053323c051eef88513d665ca6bed82e4e1637a9db1c3d63a6aafd2dcac3d9fb1dcc3823b352b0d832cefbf9c6d01f88405e3b5eb8b3f
SSDEEP 3072:2tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:2IJjiJcbI03GBc3ucY5DCSj
TLSH
T17C545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qnlfaxvqni.sys

Path C:\Temp\qnlfaxvqni.sys
Size 293KB
SHA256 05e34b04e2b63079b697ad407e93406c2aaad97912256ba4049145a800c4913d
MD5 bad3cfd52e9c9adc3e0f1bdbfa0f8e3f
SHA1 b9ec4d73554931b57bac1e216c31742d2780399b
SHA512 41778605294d2ca40da781e6ffe930c684687ad1bf173e70eff8df221354a392f50747e6faa4c49e6bf0e401b188e87edd04f814d6f2549470d00d94d201c0f7
SSDEEP 3072:mtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:mIJjiJcbI03GBc3ucY5DCSj
TLSH
T183545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rljgbztrlj.sys

Path C:\Temp\rljgbztrlj.sys
Size 293KB
SHA256 30ac52e127e0e6fbfdfad5f343119f1f2ebd6a8bd5134a5abed6bc553565de69
MD5 959698305ecb40f5606d82a3473b6266
SHA1 bdea46659c0551c8115296f8daf6b6f26e65b525
SHA512 57c522fa9ee67f41d998ab5484282d61f3140fc16c8ccc56616352e915ff775585d233c0c4389fa954643b096aa4e6f93350740d4a64e6a8e56439bfc1b47ea8
SSDEEP 3072:dtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:dIJjiJcbI03GBc3ucY5DCSj
TLSH
T111545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrpjhbztrm.exe

Path C:\Temp\wrpjhbztrm.exe
Size 384KB
SHA256 5a6a8c75e9a80ffa07b8a03b2c95c59e929cb62ec6061f718ea48189f436b963
MD5 3d3f2c915e1a083325037f3b332314fd
SHA1 0b78f1a3eeacb33199f3a5658828192a67c76738
SHA512 2679e4646b962b0bf31ac7bab27e46927ba4125cd066c12853b08dd50dc17b303097d1630265102d641447c217ae4f93b51038f3711e68d18569dd8c6757e06e
SSDEEP 3072:cbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:cbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1FF847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvmkicxvpn.exe

Path C:\Temp\xvmkicxvpn.exe
Size 384KB
SHA256 0aea5b84332188f571d63e18d98cb5d70ba11a74407a9f02b68eff5600a6a9b3
MD5 f72e6a7a63d2c14e3931b29f1fb11c41
SHA1 56cf5ceb17f213bfcde4aa78b8b398bceed71eaa
SHA512 7c57256adbf9a33153cc63811a16bf302a0d3f7b6753a21d78c84106b75aaa910c2532b8043c070f29aeb9a5a93ee00eb398e23503cda021e654f719789cad07
SSDEEP 3072:8btF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:8btt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T139847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ytqljdyvto.exe

Path C:\Temp\ytqljdyvto.exe
Size 384KB
SHA256 74e8470c32c8c3b9f517a8bf61695dd931318b4ea93c0a3ff83e9848e3dae72f
MD5 10eb49b450405d6dda269850ef042f04
SHA1 b31d280ecff335a8b1178a4b1e9989ddfddea77b
SHA512 8a47d91e3370d8b40b90708eb5051a0d6bd2793d18bf1a870feb254bbe27487ed6bd87441502f934c85d84e5be8ddbf74ec1315330d6ae3a5a5246279cd38a69
SSDEEP 3072:6btF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:6btt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1BB847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bf637ca0b28ebd6e948876848ccfe71d201158d460d4ad944f124f9d17ee5472
MD5 827e00d89fccbbde703c679b5c7ff536
SHA1 6d9e235782beb4e6b38fd4db2946f9bfc725110c
SHA512 1d18100db386f25678d8dabb492ab6e15d08e2c5a7d7e6c76bc253df648e2b5438cbc4fcb5a4033a1e14afbda93b271225eb5f545f12663d6bc35ca51239fcc3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7X:fwUQC5VwBIiElEd2K57P7X
TLSH
T148B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9fe82d5f89c093b9e73bc61db1da47b34ed26b4bc4ce053a376d95b06e248beb
MD5 b67e56e2cf3581861507f308f128a4b2
SHA1 4790a7b2b125ba2d334c30cf03dafd3a44da2c15
SHA512 fd22534f43f03d6756f66d84b103b212adc924d91541c367fff64c4201692480d2f4a5275b267ad2fa32b4a23db117666ee6a633564a65ea97ba291b29aefec5
TLSH
T138D02BE623544C88C0C031323972B348A1005E20024511DC1500B1388CE22C105030E5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 99856548fba2b09b26625f38792bc79bdd7b32d45b519c4f695f0c02b1f9b790
MD5 56cad0e2a0b77dbb713fe58128bdd05f
SHA1 bbbc2d67892cc177ca9a4cdd80e59b98d7e85044
SHA512 45e78603d1d496442fe7415895fb68db4abe5c366b4cc78a7aacc8ee188c19be13c62ca471f444e7cf61081562ad79aca905719506e78854282bd937745810ad
TLSH
T17BD02BEA23444D88C0C031323971B348A1105E20124511DC140071388CE22C105030F9
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 094e3da8e831741030981c818b088651e5763db71fd664e0005026a24bac6a97
MD5 c0d2368608ebedd9cf6d790e80c6535c
SHA1 51d284f7ab948a698745e1af8114e1d105336ba5
SHA512 d704f0ce67f800608be942228189a09f1978632d54944ff5f1f13fd8f8271722e420d8b93427f52d9d8e388c38965ed0ef7cc3cda2dc7bf24e0dea98de585179
TLSH
T172616E66033A4FF3CF3A4DF153D170DA35B1748642876E06A154B6B8E8CAF438061877
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe598eb9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe598eb9.TMP
Size 3KB
SHA256 202558fb2628fc000d5e00207e9e362e647cff4abca0564e1b3ecbe5976f68f5
MD5 1b5fc9caefd1d9659a7aa4363edbda39
SHA1 5a58d346a77e491feb272ebac646d5e65b5049fa
SHA512 0b4a89792b3d2849f931a5e5daafc860422cfb2f4fa4a77403a50410fe5e230dcd179e230ca9e62bbbb53e0eb78189639179ab16289364716bf38a4f030fc77b
TLSH
T125616F66073A4FF3CF3A4DF253D170DA35B1748642875E029054B6B8E8CAF438065877
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 c0f8143afa678a3cca1fa4f618aa690b77b92abc4f045868904a0556c5ae2a5d
MD5 8692d0c5fc224a9429602eabde623eda
SHA1 c4a5ec77fa440b433260df27e6b91bfe68b48c94
SHA512 cad73102b60f24c62967ead150f2a4983c995bc4a61464396efb6d66c1bae9699e279028d6e10e86eb71f05adb20881cbe86565c34c628a0b85d7d3a7fa9d5d5
TLSH
T10241BDF3C7E8866E891156F0AB186E1BCE1D0915432C3D5AC9E4EF1B93E3871E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 af48bd2a6daf3926e52a283590cbdcef4199bb9732a912c4d7c71ed51949eff1
MD5 ce02dfa8a96946c19b5f27715ae1ecd2
SHA1 ca567ea54319943c7c7d6a2d2f2cb1ca3807a6b6
SHA512 6b9aceb9391259a4bf0142f72b1860cceae8cb362006dde2e379095ccac01c16cc50238d344bedf4d75d95119a11ba1f3c52f27102df93350260089965d1696f
SSDEEP 192:sxRtRqyM/jK1Ml8wCf/fYsORFJlZErq+tzoA8pi/g6+WNIYntEbMmGiIgtJ:sxRtI8f/fYsORvLEG7i/5IGU3
TLSH
T12A52EA156A249977CCDBD209FA557F53D6F95573A2901E04AAFCCA0C01EB6EC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 b0995dc64e1789520ae14724a9f0d7b9d0649165d9b0d55acc06e5503add45fd
MD5 d5269e638a46bbcae40671e839b9f01e
SHA1 407a28482927b89f68f7e8252863bf40d4cf0836
SHA512 ccf6c709c9c80ad23a674c101689c0b27953d428d41bb8384945919d913beeeeaeb3323e97965ca8bbd98e9396f411713e1a076dde2d7794d50285282cc65a3c
SSDEEP 192:sxReRqyM/jK1Ml8UQmCf/fYsxRFLlZErq+pzoA8prw/g6+WNCjI/YnrbMmGiIgD1:sxReIqBf/fYsxR5LEGDM/5V/FUp
TLSH
T1F462D816AA245D77CCDBD209FA557B93D6F85573A2941E04AAFCCB0C01E76DC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 899288542c40e3566b21e2ce5180288004f673418d073f9d2cbc9219aa906377
MD5 d02583b04e1357aa17d03017d64fa6b3
SHA1 e70de9ab39f69eedd40aa8f1db5817863b1d3d66
SHA512 d51840631e4166e66b267d26f7a6ddfb2d9aae3d91ab7a1214b9d374eaf305798cde0152556d988e5770c8a5086d9938ca1950ddbb1a134c498354fe1c035a1b
SSDEEP 192:sxReRqyM/jK1Ml8wCf/fYsxRFJlZErq+tzoA8pi/g6+WNIYntEbMmGiIgDRJ:sxReI8f/fYsxRvLEG7i/5IGUf
TLSH
T14452E915AA249977CCDBD209FA557F53D6F85573A2901E04AAFCCB0C01EB6EC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 9c60bf7a2b25938e8f9844609cca97945eef380d29744ae3b8b029ae8c3e3c29
MD5 e2e4ef9cad0d0d024c7814b92077cc92
SHA1 edb85107d5ddc9e348f217b43bc00d9e3f929e5b
SHA512 ff105b8d1134d882776bcf402e4a34f118c021c8bff02296aaedb3671c319d26589363aa9c110577f6f2aac0caf5bdc77da2f53bb35cc7f2e327d2386a6be90b
SSDEEP 192:sxReRqyM/jK1Ml8wCf/fYsxRFLlZErq+pzoA8p9w/g6+WNCjI/YnrbMmGiIgDDJ:sxReI8f/fYsxR5LEGDC/5V/FUp
TLSH
T1F862D816AA245D77CCDBD208FA557B93D6F95173A2941E04AAFCCB0C01EB6DD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 421faeb320631524f5d39bb0f9d80e49488e9945e249b54a3b7f1ad3faa9e3bc
MD5 876f7e7fd9454fb064514f74106cc158
SHA1 105d7fe59bb3cdcc96fab21b4bdbd070720d32a6
SHA512 e5cb56bb29c200a9390cf544e0e14c7c2403501ead341e2e4acfc130b309497d3559b03f0d3ce91448e7543051c59b0539dae1825c51f953fb195850a9dddc22
SSDEEP 768:BwSIrY7pLuL7cxWghdfAx8F1+UoAYDCx9Tuqh0VfUC9xbog/OVNz0QLwdro0VMyk:BwSIrEE7cxWghdfAxu1jaez0EwW0O3
TLSH
T1C9E2EC7B680CCB7F4F804A9CEC29BD9A6DA801CF57D8899447FA880C03C67EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 dbcf18a67c1433125d5f69e4c092bef72cfd1dc0b300f6673f4099de857e097b
MD5 79a2bd0c64d1f38dc710294fffbe8e09
SHA1 7c92cafc9dbf8f3bed29f2197053590329ac9c83
SHA512 b35d5a19d475a9ab47eca09285cbaa366605d2cf1191007b9a863f8095cf1bae227c488368e571294d6dc11f23a7d69b42fba06cbe68f4c048a11c984d7f4a6b
SSDEEP 96:KRMN4cWaO8Wqnngk8K4pgu8cscHGshHVCbvlfCYWm7LgYYK49gKYcY4rKQZ2HDxW:CMN4cWaOjqngkApgujscHGshHVCbvlfq
TLSH
T171C14894323A87903A3E280494B99C1AE5C174E2345DA42F7BF902E15F66E52DFFC8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ee9d7fca-544d-4465-9d29-978e20ab17fe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\ee9d7fca-544d-4465-9d29-978e20ab17fe.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 db381f1e679690db310ffa3f9a1e583053a76a1d338272f69d203b02aadb4060
MD5 b0c8b4ae332e3501723a2151016809b6
SHA1 77fb386e202d067a4330a5b6ea4405dcdb0abcbf
SHA512 00e11719fcdff74b77e6caaf09bc982125e26e1f0cc779972dfb6aa6c28b50bb23c824e9691111930887d9ac55c0ea193e3021c8fdb1ff759b702415af5c1347
SSDEEP 768:lrv+4UNbdx3tfg7LsGxkrCYpjxLlVPgd5663k/TUiixe/:lbsbT3JqyrCm93Pf6UrUvI
TLSH
T13B03CF36D4A89A73DCE2D284B1477606BFB8215786C40794C5EA6F0E46CF09E631BC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 825d235de66c954332fc1da47337fe134addede4b1ce9e87c011c3aaabe6879d
MD5 35b2da8b0b3a8d41977f2b8f94ed8f7c
SHA1 f1bcafce02a164c305ad3bbe0e37a7c426e0f9d3
SHA512 480ff3ed9a71f62e6ada37750479faa59e31f021cac592c091894675ae3b8b1f9f4cd80a67aac1a86c9db877d1bc854d325ef25051298d12f0c2469454602923
SSDEEP 768:0j+9H3lDyMLsGxkrVSYpjxLlVPgd5663kH4Nb9MP:j9H3hyrwm93Pf6Uqb+P
TLSH
T154F2CF31A4A59FA39CD2D2D0F1073788BFF421B785C41E44D5EAAF0E09872DE671B819
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 753a55fbe7511038559783864d046a05f3fb6e5dcb16b05860ee0ac204d55eb5
MD5 1d5f54f31dd07eee1d5dc76d5da4f5b3
SHA1 027e20fedefdfa9a598f81f4565601f0500ee7e8
SHA512 492174af071ff700f267445baf6df687f287bcf3b6bce887a809c6fc64afffe6b85f65f95f2dea0284a73dcf199b0448b16b82c5c223e21c93a151e167943dee
SSDEEP 768:AF1j+9L3iwg0D158GxkrVqYpjxLlVPgd5663kH4Nb9MP:N9L3tyr8m93Pf6Uqb+P
TLSH
T1B71328F694D38A76E89E8783A33E2E459DBCD167B5885884F7C55D0DCC871BFC20A805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 dbdad97f4ff49abbc704179732e0d73975de1e8f7555ba367061457398acdeaa
MD5 c18125db83a4189dc13447ff01316e05
SHA1 930051454c9e95c0528aaa6ca1cdc4edf98cd6ab
SHA512 73fa471c069ecca08e006a79d19a5fe1c3c2b0311d3c88e8caa4e4fa4bdb88acc9e4e7d6c31a7b69e066c0557cf5639422708e79cf1db7354d318684e7c0b2dc
SSDEEP 768:5rv+4UNbd93s/MLsGxkrVnYpjxLlVPgd5663kH4Nb9Mb:5bsbL35yr9m93Pf6Uqb+b
TLSH
T1D813C031E4A8DBB3ACE6D294F0473656BFF821A789C40A44D5DA9F0D098B1DE271FC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 cbf9a22da7611830c2bcd001f9811d7156e2aa8aadaa78807c8401779492d18d
MD5 0cdc0380f17e23bf3bd4d512d97ab2b7
SHA1 8c7a69335958205867fad969c2c2f8fd799c3295
SHA512 d84c60d5d8f6053642b2da60036ed7f92d2d7a2b597d60459a3e87c5ec405422a8e15f8e4f8550b5baa8a61e90ab9ae8654cd33488404ce23e1df7425acf68ec
SSDEEP 768:Cj+9H3sDyMLsGxkrVSYpjxLlVPgd5663kH4Nb9MP:x9H3yyrwm93Pf6Uqb+P
TLSH
T102F2CF31A4A59FA39CD2D2D4F1073788BFF421B785C41E44D5EAAF0E098B2DE671B819
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5148_1038749062\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 ae7218fcbfcfab028d6335d9c247c4c6b88286586d65342c718ea47c631adca0
MD5 553b46f14efe9bb26573bc914784b13e
SHA1 f115bfcb53b6be67f1c5407df5dde3317a1bf17c
SHA512 cbc79dce7bd29a384fe9cc9d0d799474404e38141bb9132b4a353184233a9460548d68c4e1f6e6d5e30554724594d0aaaebee8609e5e7209fcd05cdc2bd402c1
TLSH
T1F671238357B9C6B3C1DE5FF102835608F5FB22380B6330204BA16546AB30A7A64B8F08
MD5 SHA1 SHA512 TLSH

Submit Download

memory/788-419-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1364-320-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1552-384-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2424-332-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2572-64-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3204-431-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3212-413-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3308-198-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4020-405-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4128-372-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4480-415-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4480-388-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4480-409-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5128-286-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5356-435-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5772-273-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5824-245-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5924-347-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5952-314-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6068-401-0x0000000000010000-0x00000000000AB000-memory.dmp

Download