systex | 41ad09e8f6ed7f8849020c52bd1c92f70e62641ba04be163f0a57078fcf493b9

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 01:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-13_202f4c031e04ccac2b7ea77136102e8a_amadey_darkgate_elex_smoke-loader_stop.exe
Size 384KB
Sample260714-b44lnact6j
SHA256 41ad09e8f6ed7f8849020c52bd1c92f70e62641ba04be163f0a57078fcf493b9
MD5 202f4c031e04ccac2b7ea77136102e8a
SHA1 4fd3f26ce693660c77fda718edd985600311f180
SHA512 da1412296593692813ea5cde4f2419893956e4160842af9a3ccff076e16aad26d12ca83e439bab22e717d99ef30eac91b18cbe49296d49fd04da21302392022b
SSDEEP 3072:J9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:jctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1EE847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
3712	bwqoigbytrljdbvt.exe
5508	bwqoigbytrljdbvt.sys
1640	CreateProcess.exe
2736	dbvtoljgby.exe
3516	CreateProcess.exe
2476	CreateProcess.exe
5988	i_dbvtoljgby.exe
2120	igdyvqoiga.sys
4712	CreateProcess.exe
3432	dyvqolgdbv.exe
5508	CreateProcess.exe
2740	CreateProcess.exe
4900	i_dyvqolgdbv.exe
1868	dxsnkidavs.sys
628	CreateProcess.exe
5872	snlfdxvpni.exe
4492	CreateProcess.exe
484	CreateProcess.exe
4964	i_snlfdxvpni.exe
1204	sqkicankfd.sys
3616	CreateProcess.exe
1680	fcausnkfcx.exe
1984	CreateProcess.exe
2516	CreateProcess.exe
5988	i_fcausnkfcx.exe
4980	khfaxspnhf.sys
2424	CreateProcess.exe
4180	kfzxspcaus.exe
1040	CreateProcess.exe
2160	CreateProcess.exe
2128	i_kfzxspcaus.exe
4464	hczxsmkhca.sys
4336	CreateProcess.exe
5172	cwupmhezxr.exe
5636	CreateProcess.exe
5212	CreateProcess.exe
5068	i_cwupmhezxr.exe
5056	wuomgecwur.sys
4580	CreateProcess.exe
3400	wurpjhbzur.exe
4368	CreateProcess.exe
2340	CreateProcess.exe
2900	i_wurpjhbzur.exe
1328	jgecwurmjh.sys
5764	CreateProcess.exe
2964	ebwtromgez.exe
5412	CreateProcess.exe
4596	CreateProcess.exe
5904	i_ebwtromgez.exe
5504	ljebwuomge.sys
2428	CreateProcess.exe
4672	jebwtoljdb.exe
2492	CreateProcess.exe
476	CreateProcess.exe
1808	i_jebwtoljdb.exe
5020	aywtolgdbv.sys
4364	CreateProcess.exe
5068	gayvqolgey.exe
3232	CreateProcess.exe
5364	CreateProcess.exe
3780	i_gayvqolgey.exe
1840	ysqnifdbvt.sys
3140	CreateProcess.exe
4468	ysqnifdyvt.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_1884068056\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_1224313353\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4204_1224313353\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrmgeywu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnligdyvtq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kfzxspcaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snlfdxvpni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jebwtoljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_toljgeywtr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fcausnkfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebwtromgez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gayvqolgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqkicaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqkicaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	toljgeywtr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnligdyvtq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dyvqolgdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqnifdyvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eczurmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwqoigbytrljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvtoljgby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dyvqolgdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wurpjhbzur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebwtromgez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqnifdyvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpmkhczxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwupmhezxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jebwtoljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xspkicsmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpmkhczxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eczurmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wurpjhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wurpjhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrmgeywu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snlfdxvpni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcausnkfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfzxspcaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwupmhezxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkigayvtqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-13_202f4c031e04ccac2b7ea77136102e8a_amadey_darkgate_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvtoljgby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wurpjhbzur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gayvqolgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xspkicsmke.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2560	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2140	ipconfig.exe
5056	ipconfig.exe
5972	ipconfig.exe
3868	ipconfig.exe
1164	ipconfig.exe
1060	ipconfig.exe
1860	ipconfig.exe
5880	ipconfig.exe
124	ipconfig.exe
5540	ipconfig.exe
3092	ipconfig.exe
4404	ipconfig.exe
5808	ipconfig.exe
3364	ipconfig.exe
3264	ipconfig.exe
4804	ipconfig.exe
5540	ipconfig.exe
5156	ipconfig.exe
3216	ipconfig.exe
5020	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134284669803625908"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{88FFC45B-2FF8-4CD0-BBB1-4D209F21A14A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1720	2026-07-13_202f4c031e04ccac2b7ea77136102e8a_amadey_darkgate_elex_smoke-loader_stop.exe
1720	2026-07-13_202f4c031e04ccac2b7ea77136102e8a_amadey_darkgate_elex_smoke-loader_stop.exe
1720	2026-07-13_202f4c031e04ccac2b7ea77136102e8a_amadey_darkgate_elex_smoke-loader_stop.exe
1720	2026-07-13_202f4c031e04ccac2b7ea77136102e8a_amadey_darkgate_elex_smoke-loader_stop.exe
1720	2026-07-13_202f4c031e04ccac2b7ea77136102e8a_amadey_darkgate_elex_smoke-loader_stop.exe
1720	2026-07-13_202f4c031e04ccac2b7ea77136102e8a_amadey_darkgate_elex_smoke-loader_stop.exe
1720	2026-07-13_202f4c031e04ccac2b7ea77136102e8a_amadey_darkgate_elex_smoke-loader_stop.exe
1720	2026-07-13_202f4c031e04ccac2b7ea77136102e8a_amadey_darkgate_elex_smoke-loader_stop.exe
1720	2026-07-13_202f4c031e04ccac2b7ea77136102e8a_amadey_darkgate_elex_smoke-loader_stop.exe
1720	2026-07-13_202f4c031e04ccac2b7ea77136102e8a_amadey_darkgate_elex_smoke-loader_stop.exe
1720	2026-07-13_202f4c031e04ccac2b7ea77136102e8a_amadey_darkgate_elex_smoke-loader_stop.exe
1720	2026-07-13_202f4c031e04ccac2b7ea77136102e8a_amadey_darkgate_elex_smoke-loader_stop.exe
1720	2026-07-13_202f4c031e04ccac2b7ea77136102e8a_amadey_darkgate_elex_smoke-loader_stop.exe
1720	2026-07-13_202f4c031e04ccac2b7ea77136102e8a_amadey_darkgate_elex_smoke-loader_stop.exe
1720	2026-07-13_202f4c031e04ccac2b7ea77136102e8a_amadey_darkgate_elex_smoke-loader_stop.exe
1720	2026-07-13_202f4c031e04ccac2b7ea77136102e8a_amadey_darkgate_elex_smoke-loader_stop.exe
1720	2026-07-13_202f4c031e04ccac2b7ea77136102e8a_amadey_darkgate_elex_smoke-loader_stop.exe
1720	2026-07-13_202f4c031e04ccac2b7ea77136102e8a_amadey_darkgate_elex_smoke-loader_stop.exe
1720	2026-07-13_202f4c031e04ccac2b7ea77136102e8a_amadey_darkgate_elex_smoke-loader_stop.exe
1720	2026-07-13_202f4c031e04ccac2b7ea77136102e8a_amadey_darkgate_elex_smoke-loader_stop.exe
1720	2026-07-13_202f4c031e04ccac2b7ea77136102e8a_amadey_darkgate_elex_smoke-loader_stop.exe
1720	2026-07-13_202f4c031e04ccac2b7ea77136102e8a_amadey_darkgate_elex_smoke-loader_stop.exe
1720	2026-07-13_202f4c031e04ccac2b7ea77136102e8a_amadey_darkgate_elex_smoke-loader_stop.exe
1720	2026-07-13_202f4c031e04ccac2b7ea77136102e8a_amadey_darkgate_elex_smoke-loader_stop.exe
1720	2026-07-13_202f4c031e04ccac2b7ea77136102e8a_amadey_darkgate_elex_smoke-loader_stop.exe
1720	2026-07-13_202f4c031e04ccac2b7ea77136102e8a_amadey_darkgate_elex_smoke-loader_stop.exe
1720	2026-07-13_202f4c031e04ccac2b7ea77136102e8a_amadey_darkgate_elex_smoke-loader_stop.exe
1720	2026-07-13_202f4c031e04ccac2b7ea77136102e8a_amadey_darkgate_elex_smoke-loader_stop.exe
1720	2026-07-13_202f4c031e04ccac2b7ea77136102e8a_amadey_darkgate_elex_smoke-loader_stop.exe
1720	2026-07-13_202f4c031e04ccac2b7ea77136102e8a_amadey_darkgate_elex_smoke-loader_stop.exe
1720	2026-07-13_202f4c031e04ccac2b7ea77136102e8a_amadey_darkgate_elex_smoke-loader_stop.exe
1720	2026-07-13_202f4c031e04ccac2b7ea77136102e8a_amadey_darkgate_elex_smoke-loader_stop.exe
1720	2026-07-13_202f4c031e04ccac2b7ea77136102e8a_amadey_darkgate_elex_smoke-loader_stop.exe
1720	2026-07-13_202f4c031e04ccac2b7ea77136102e8a_amadey_darkgate_elex_smoke-loader_stop.exe
1720	2026-07-13_202f4c031e04ccac2b7ea77136102e8a_amadey_darkgate_elex_smoke-loader_stop.exe
1720	2026-07-13_202f4c031e04ccac2b7ea77136102e8a_amadey_darkgate_elex_smoke-loader_stop.exe
1720	2026-07-13_202f4c031e04ccac2b7ea77136102e8a_amadey_darkgate_elex_smoke-loader_stop.exe
1720	2026-07-13_202f4c031e04ccac2b7ea77136102e8a_amadey_darkgate_elex_smoke-loader_stop.exe
3712	bwqoigbytrljdbvt.exe
3712	bwqoigbytrljdbvt.exe
1720	2026-07-13_202f4c031e04ccac2b7ea77136102e8a_amadey_darkgate_elex_smoke-loader_stop.exe
1720	2026-07-13_202f4c031e04ccac2b7ea77136102e8a_amadey_darkgate_elex_smoke-loader_stop.exe
3712	bwqoigbytrljdbvt.exe
3712	bwqoigbytrljdbvt.exe
1720	2026-07-13_202f4c031e04ccac2b7ea77136102e8a_amadey_darkgate_elex_smoke-loader_stop.exe
1720	2026-07-13_202f4c031e04ccac2b7ea77136102e8a_amadey_darkgate_elex_smoke-loader_stop.exe
3712	bwqoigbytrljdbvt.exe
3712	bwqoigbytrljdbvt.exe
1720	2026-07-13_202f4c031e04ccac2b7ea77136102e8a_amadey_darkgate_elex_smoke-loader_stop.exe
1720	2026-07-13_202f4c031e04ccac2b7ea77136102e8a_amadey_darkgate_elex_smoke-loader_stop.exe
3712	bwqoigbytrljdbvt.exe
3712	bwqoigbytrljdbvt.exe
1720	2026-07-13_202f4c031e04ccac2b7ea77136102e8a_amadey_darkgate_elex_smoke-loader_stop.exe
1720	2026-07-13_202f4c031e04ccac2b7ea77136102e8a_amadey_darkgate_elex_smoke-loader_stop.exe
3712	bwqoigbytrljdbvt.exe
3712	bwqoigbytrljdbvt.exe
1720	2026-07-13_202f4c031e04ccac2b7ea77136102e8a_amadey_darkgate_elex_smoke-loader_stop.exe
1720	2026-07-13_202f4c031e04ccac2b7ea77136102e8a_amadey_darkgate_elex_smoke-loader_stop.exe
3712	bwqoigbytrljdbvt.exe
3712	bwqoigbytrljdbvt.exe
1720	2026-07-13_202f4c031e04ccac2b7ea77136102e8a_amadey_darkgate_elex_smoke-loader_stop.exe
1720	2026-07-13_202f4c031e04ccac2b7ea77136102e8a_amadey_darkgate_elex_smoke-loader_stop.exe
3712	bwqoigbytrljdbvt.exe
3712	bwqoigbytrljdbvt.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe
4204	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	5988	i_dbvtoljgby.exe
Token: SeDebugPrivilege	4900	i_dyvqolgdbv.exe
Token: SeDebugPrivilege	4964	i_snlfdxvpni.exe
Token: SeDebugPrivilege	5988	i_fcausnkfcx.exe
Token: SeDebugPrivilege	2128	i_kfzxspcaus.exe
Token: SeDebugPrivilege	5068	i_cwupmhezxr.exe
Token: SeDebugPrivilege	2900	i_wurpjhbzur.exe
Token: SeDebugPrivilege	5904	i_ebwtromgez.exe
Token: SeDebugPrivilege	1808	i_jebwtoljdb.exe
Token: SeDebugPrivilege	3780	i_gayvqolgey.exe
Token: SeDebugPrivilege	5868	i_ysqnifdyvt.exe
Token: SeDebugPrivilege	4328	i_aysqkicaus.exe
Token: SeDebugPrivilege	1592	i_xspkicsmke.exe
Token: SeDebugPrivilege	4396	i_xrpmkhczxu.exe
Token: SeDebugPrivilege	3292	i_eczurmkecw.exe
Token: SeDebugPrivilege	2436	i_wurpjhbztr.exe
Token: SeDebugPrivilege	5020	i_bztrmgeywu.exe
Token: SeDebugPrivilege	5696	i_toljgeywtr.exe
Token: SeDebugPrivilege	5040	i_tnligdyvtq.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4204	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 3712	1720	2026-07-13_202f4c031e04ccac2b7ea77136102e8a_amadey_darkgate_elex_smoke-loader_stop.exe	88
PID 1720 wrote to memory of 4600	1720	2026-07-13_202f4c031e04ccac2b7ea77136102e8a_amadey_darkgate_elex_smoke-loader_stop.exe	89
PID 4600 wrote to memory of 4204	4600	iexplore.exe	90
PID 4204 wrote to memory of 5708	4204	msedge.exe	91
PID 4204 wrote to memory of 2560	4204	msedge.exe	92
PID 4204 wrote to memory of 5584	4204	msedge.exe	93
PID 4204 wrote to memory of 5584	4204	msedge.exe	93
PID 4204 wrote to memory of 5584	4204	msedge.exe	93
PID 4204 wrote to memory of 5528	4204	msedge.exe	94
PID 4204 wrote to memory of 5528	4204	msedge.exe	94
PID 4204 wrote to memory of 5144	4204	msedge.exe	95
PID 4204 wrote to memory of 5144	4204	msedge.exe	95
PID 4204 wrote to memory of 5144	4204	msedge.exe	95
PID 4204 wrote to memory of 1688	4204	msedge.exe	96
PID 4204 wrote to memory of 1688	4204	msedge.exe	96
PID 4204 wrote to memory of 1688	4204	msedge.exe	96
PID 4204 wrote to memory of 3904	4204	msedge.exe	98
PID 4204 wrote to memory of 3904	4204	msedge.exe	98
PID 4204 wrote to memory of 3904	4204	msedge.exe	98
PID 4204 wrote to memory of 704	4204	msedge.exe	99
PID 4204 wrote to memory of 704	4204	msedge.exe	99
PID 4204 wrote to memory of 704	4204	msedge.exe	99
PID 4204 wrote to memory of 3364	4204	msedge.exe	100
PID 4204 wrote to memory of 3364	4204	msedge.exe	100
PID 3712 wrote to memory of 1640	3712	bwqoigbytrljdbvt.exe	104
PID 2736 wrote to memory of 3516	2736	dbvtoljgby.exe	107
PID 4204 wrote to memory of 3184	4204	msedge.exe	110
PID 4204 wrote to memory of 3184	4204	msedge.exe	110
PID 4204 wrote to memory of 5424	4204	msedge.exe	111
PID 4204 wrote to memory of 5424	4204	msedge.exe	111
PID 4204 wrote to memory of 2052	4204	msedge.exe	113
PID 4204 wrote to memory of 6112	4204	msedge.exe	114
PID 4204 wrote to memory of 6112	4204	msedge.exe	114
PID 4204 wrote to memory of 6036	4204	msedge.exe	117
PID 4204 wrote to memory of 6036	4204	msedge.exe	117
PID 3712 wrote to memory of 2476	3712	bwqoigbytrljdbvt.exe	118
PID 3712 wrote to memory of 4712	3712	bwqoigbytrljdbvt.exe	122
PID 3432 wrote to memory of 5508	3432	dyvqolgdbv.exe	124
PID 3712 wrote to memory of 2740	3712	bwqoigbytrljdbvt.exe	127
PID 3712 wrote to memory of 628	3712	bwqoigbytrljdbvt.exe	131
PID 5872 wrote to memory of 4492	5872	snlfdxvpni.exe	133
PID 3712 wrote to memory of 484	3712	bwqoigbytrljdbvt.exe	136
PID 3712 wrote to memory of 3616	3712	bwqoigbytrljdbvt.exe	141
PID 1680 wrote to memory of 1984	1680	fcausnkfcx.exe	143
PID 3712 wrote to memory of 2516	3712	bwqoigbytrljdbvt.exe	146
PID 4204 wrote to memory of 2120	4204	msedge.exe	148
PID 4204 wrote to memory of 4460	4204	msedge.exe	149
PID 4204 wrote to memory of 5904	4204	msedge.exe	150
PID 3712 wrote to memory of 2424	3712	bwqoigbytrljdbvt.exe	153
PID 4180 wrote to memory of 1040	4180	kfzxspcaus.exe	155
PID 3712 wrote to memory of 2160	3712	bwqoigbytrljdbvt.exe	158
PID 3712 wrote to memory of 4336	3712	bwqoigbytrljdbvt.exe	162
PID 5172 wrote to memory of 5636	5172	cwupmhezxr.exe	164
PID 3712 wrote to memory of 5212	3712	bwqoigbytrljdbvt.exe	167
PID 3712 wrote to memory of 4580	3712	bwqoigbytrljdbvt.exe	171
PID 3400 wrote to memory of 4368	3400	wurpjhbzur.exe	173
PID 3712 wrote to memory of 2340	3712	bwqoigbytrljdbvt.exe	176
PID 3712 wrote to memory of 5764	3712	bwqoigbytrljdbvt.exe	180
PID 2964 wrote to memory of 5412	2964	ebwtromgez.exe	182
PID 3712 wrote to memory of 4596	3712	bwqoigbytrljdbvt.exe	185
PID 4204 wrote to memory of 6116	4204	msedge.exe	187
PID 4204 wrote to memory of 6116	4204	msedge.exe	187
PID 3712 wrote to memory of 2428	3712	bwqoigbytrljdbvt.exe	193
PID 4672 wrote to memory of 2492	4672	jebwtoljdb.exe	195

C:\Users\Admin\AppData\Local\Temp\2026-07-13_202f4c031e04ccac2b7ea77136102e8a_amadey_darkgate_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-13_202f4c031e04ccac2b7ea77136102e8a_amadey_darkgate_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Temp\bwqoigbytrljdbvt.exe
  C:\Temp\bwqoigbytrljdbvt.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3712
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbvtoljgby.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1640
  - - C:\Temp\dbvtoljgby.exe
      C:\Temp\dbvtoljgby.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2736
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3516
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5972
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbvtoljgby.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2476
  - - C:\Temp\i_dbvtoljgby.exe
      C:\Temp\i_dbvtoljgby.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5988
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dyvqolgdbv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4712
  - - C:\Temp\dyvqolgdbv.exe
      C:\Temp\dyvqolgdbv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3432
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5508
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3868
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dyvqolgdbv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2740
  - - C:\Temp\i_dyvqolgdbv.exe
      C:\Temp\i_dyvqolgdbv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4900
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\snlfdxvpni.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:628
  - - C:\Temp\snlfdxvpni.exe
      C:\Temp\snlfdxvpni.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5872
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4492
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1164
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_snlfdxvpni.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:484
  - - C:\Temp\i_snlfdxvpni.exe
      C:\Temp\i_snlfdxvpni.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4964
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fcausnkfcx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3616
  - - C:\Temp\fcausnkfcx.exe
      C:\Temp\fcausnkfcx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1680
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1984
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5540
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fcausnkfcx.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2516
  - - C:\Temp\i_fcausnkfcx.exe
      C:\Temp\i_fcausnkfcx.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5988
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kfzxspcaus.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2424
  - - C:\Temp\kfzxspcaus.exe
      C:\Temp\kfzxspcaus.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4180
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1040
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3092
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kfzxspcaus.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2160
  - - C:\Temp\i_kfzxspcaus.exe
      C:\Temp\i_kfzxspcaus.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2128
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cwupmhezxr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4336
  - - C:\Temp\cwupmhezxr.exe
      C:\Temp\cwupmhezxr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5172
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5636
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5020
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cwupmhezxr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5212
  - - C:\Temp\i_cwupmhezxr.exe
      C:\Temp\i_cwupmhezxr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5068
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wurpjhbzur.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4580
  - - C:\Temp\wurpjhbzur.exe
      C:\Temp\wurpjhbzur.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3400
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4368
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2140
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wurpjhbzur.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2340
  - - C:\Temp\i_wurpjhbzur.exe
      C:\Temp\i_wurpjhbzur.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2900
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ebwtromgez.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5764
  - - C:\Temp\ebwtromgez.exe
      C:\Temp\ebwtromgez.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2964
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5412
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4804
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ebwtromgez.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4596
  - - C:\Temp\i_ebwtromgez.exe
      C:\Temp\i_ebwtromgez.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5904
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jebwtoljdb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2428
  - - C:\Temp\jebwtoljdb.exe
      C:\Temp\jebwtoljdb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4672
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2492
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1060
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jebwtoljdb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:476
  - - C:\Temp\i_jebwtoljdb.exe
      C:\Temp\i_jebwtoljdb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1808
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gayvqolgey.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4364
  - - C:\Temp\gayvqolgey.exe
      C:\Temp\gayvqolgey.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5068
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3232
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5056
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gayvqolgey.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5364
  - - C:\Temp\i_gayvqolgey.exe
      C:\Temp\i_gayvqolgey.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3780
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ysqnifdyvt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3140
  - - C:\Temp\ysqnifdyvt.exe
      C:\Temp\ysqnifdyvt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4468
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5104
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5540
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ysqnifdyvt.exe ups_ins
    3⤵
    PID:2572
  - - C:\Temp\i_ysqnifdyvt.exe
      C:\Temp\i_ysqnifdyvt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5868
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\aysqkicaus.exe ups_run
    3⤵
    PID:3196
  - - C:\Temp\aysqkicaus.exe
      C:\Temp\aysqkicaus.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2344
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3988
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1860
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_aysqkicaus.exe ups_ins
    3⤵
    PID:2128
  - - C:\Temp\i_aysqkicaus.exe
      C:\Temp\i_aysqkicaus.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4328
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xspkicsmke.exe ups_run
    3⤵
    PID:1440
  - - C:\Temp\xspkicsmke.exe
      C:\Temp\xspkicsmke.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4740
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2336
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4404
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xspkicsmke.exe ups_ins
    3⤵
    PID:5424
  - - C:\Temp\i_xspkicsmke.exe
      C:\Temp\i_xspkicsmke.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1592
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xrpmkhczxu.exe ups_run
    3⤵
    PID:4172
  - - C:\Temp\xrpmkhczxu.exe
      C:\Temp\xrpmkhczxu.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4632
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4972
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5156
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xrpmkhczxu.exe ups_ins
    3⤵
    PID:5912
  - - C:\Temp\i_xrpmkhczxu.exe
      C:\Temp\i_xrpmkhczxu.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4396
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\eczurmkecw.exe ups_run
    3⤵
    PID:1568
  - - C:\Temp\eczurmkecw.exe
      C:\Temp\eczurmkecw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2952
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4804
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5880
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_eczurmkecw.exe ups_ins
    3⤵
    PID:4780
  - - C:\Temp\i_eczurmkecw.exe
      C:\Temp\i_eczurmkecw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3292
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wurpjhbztr.exe ups_run
    3⤵
    PID:5052
  - - C:\Temp\wurpjhbztr.exe
      C:\Temp\wurpjhbztr.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4488
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2300
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:124
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wurpjhbztr.exe ups_ins
    3⤵
    PID:1096
  - - C:\Temp\i_wurpjhbztr.exe
      C:\Temp\i_wurpjhbztr.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2436
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bztrmgeywu.exe ups_run
    3⤵
    PID:1808
  - - C:\Temp\bztrmgeywu.exe
      C:\Temp\bztrmgeywu.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4464
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5352
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3216
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bztrmgeywu.exe ups_ins
    3⤵
    PID:2312
  - - C:\Temp\i_bztrmgeywu.exe
      C:\Temp\i_bztrmgeywu.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5020
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\toljgeywtr.exe ups_run
    3⤵
    PID:4648
  - - C:\Temp\toljgeywtr.exe
      C:\Temp\toljgeywtr.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6112
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5384
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5808
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_toljgeywtr.exe ups_ins
    3⤵
    PID:5800
  - - C:\Temp\i_toljgeywtr.exe
      C:\Temp\i_toljgeywtr.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5696
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tnligdyvtq.exe ups_run
    3⤵
    PID:1244
  - - C:\Temp\tnligdyvtq.exe
      C:\Temp\tnligdyvtq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1340
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4396
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3364
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tnligdyvtq.exe ups_ins
    3⤵
    PID:4188
  - - C:\Temp\i_tnligdyvtq.exe
      C:\Temp\i_tnligdyvtq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5040
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nkigayvtqk.exe ups_run
    3⤵
    PID:5672
  - - C:\Temp\nkigayvtqk.exe
      C:\Temp\nkigayvtqk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:124
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3380
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3264
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffe8b9bc188,0x7ffe8b9bc194,0x7ffe8b9bc1a0
      4⤵
      PID:5708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,15045944935481253567,9114464920982151410,524288 --field-trial-handle=2728,i,2471860435010486569,17624327644118248072,262144 --variations-seed-version --mojo-platform-channel-handle=2832 /prefetch:11
      4⤵
      System Time Discovery
      PID:2560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1616,i,5528789665958171110,12515196595210969779,262144 --field-trial-handle=2728,i,2471860435010486569,17624327644118248072,262144 --variations-seed-version --mojo-platform-channel-handle=2712 /prefetch:2
      4⤵
      PID:5584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2268,i,13022310317924203601,17412856148943706914,524288 --field-trial-handle=2728,i,2471860435010486569,17624327644118248072,262144 --variations-seed-version --mojo-platform-channel-handle=2884 /prefetch:13
      4⤵
      PID:5528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3596,i,2439808132777316239,15338789798229420552,2097152 --field-trial-handle=2728,i,2471860435010486569,17624327644118248072,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
      4⤵
      PID:5144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3612,i,211088125372901102,5078493661742393334,2097152 --field-trial-handle=2728,i,2471860435010486569,17624327644118248072,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:1
      4⤵
      PID:1688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4268,i,9399965918407811156,16655708958271191103,2097152 --field-trial-handle=2728,i,2471860435010486569,17624327644118248072,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:1
      4⤵
      PID:3904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4336,i,11257947909511184491,12166721160099181179,2097152 --field-trial-handle=2728,i,2471860435010486569,17624327644118248072,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:9
      4⤵
      PID:704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,17925606180785654151,15991026660867369327,524288 --field-trial-handle=2728,i,2471860435010486569,17624327644118248072,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:14
      4⤵
      PID:3364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5572,i,5499873740238758993,10935139559480058916,524288 --field-trial-handle=2728,i,2471860435010486569,17624327644118248072,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:14
      4⤵
      PID:3184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5576,i,16447078571687764121,2871998896065169536,524288 --field-trial-handle=2728,i,2471860435010486569,17624327644118248072,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:14
      4⤵
      PID:5424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,6443190329200077554,10220836077732026902,524288 --field-trial-handle=2728,i,2471860435010486569,17624327644118248072,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
      4⤵
      PID:1868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,6443190329200077554,10220836077732026902,524288 --field-trial-handle=2728,i,2471860435010486569,17624327644118248072,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
      4⤵
      PID:2052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,1797488711738207570,13204074609518323709,524288 --field-trial-handle=2728,i,2471860435010486569,17624327644118248072,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:14
      4⤵
      PID:6112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,10580057020436876760,2417475150380666786,524288 --field-trial-handle=2728,i,2471860435010486569,17624327644118248072,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:14
      4⤵
      PID:6036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4704,i,2311720715345166432,7168124214844330537,524288 --field-trial-handle=2728,i,2471860435010486569,17624327644118248072,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:14
      4⤵
      PID:2120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3580,i,16878856427135946879,1351314220194213705,524288 --field-trial-handle=2728,i,2471860435010486569,17624327644118248072,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:14
      4⤵
      PID:4460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4496,i,2313505356148063870,13651491788719241592,524288 --field-trial-handle=2728,i,2471860435010486569,17624327644118248072,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:14
      4⤵
      PID:5904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3384,i,6654293565186949252,14199468944092389941,524288 --field-trial-handle=2728,i,2471860435010486569,17624327644118248072,262144 --variations-seed-version --mojo-platform-channel-handle=3388 /prefetch:14
      4⤵
      PID:6116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=928,i,7145427046362686117,15591328627120667386,524288 --field-trial-handle=2728,i,2471860435010486569,17624327644118248072,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:14
      4⤵
      PID:2596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2624,i,8840884397322516582,402077235414177262,262144 --field-trial-handle=2728,i,2471860435010486569,17624327644118248072,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:10
      4⤵
      PID:2296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5592,i,5061311172225085095,18222071224082477114,524288 --field-trial-handle=2728,i,2471860435010486569,17624327644118248072,262144 --variations-seed-version --mojo-platform-channel-handle=928 /prefetch:14
      4⤵
      PID:1580

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5876

C:\Temp\bwqoigbytrljdbvt.sys
C:\Temp\bwqoigbytrljdbvt.sys
1⤵
- Executes dropped EXE
PID:5508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3312

C:\Temp\igdyvqoiga.sys
C:\Temp\igdyvqoiga.sys
1⤵
- Executes dropped EXE
PID:2120

C:\Temp\dxsnkidavs.sys
C:\Temp\dxsnkidavs.sys
1⤵
- Executes dropped EXE
PID:1868

C:\Temp\sqkicankfd.sys
C:\Temp\sqkicankfd.sys
1⤵
- Executes dropped EXE
PID:1204

C:\Temp\khfaxspnhf.sys
C:\Temp\khfaxspnhf.sys
1⤵
- Executes dropped EXE
PID:4980

C:\Temp\hczxsmkhca.sys
C:\Temp\hczxsmkhca.sys
1⤵
- Executes dropped EXE
PID:4464

C:\Temp\wuomgecwur.sys
C:\Temp\wuomgecwur.sys
1⤵
- Executes dropped EXE
PID:5056

C:\Temp\jgecwurmjh.sys
C:\Temp\jgecwurmjh.sys
1⤵
- Executes dropped EXE
PID:1328

C:\Temp\ljebwuomge.sys
C:\Temp\ljebwuomge.sys
1⤵
- Executes dropped EXE
PID:5504

C:\Temp\aywtolgdbv.sys
C:\Temp\aywtolgdbv.sys
1⤵
- Executes dropped EXE
PID:5020

C:\Temp\ysqnifdbvt.sys
C:\Temp\ysqnifdbvt.sys
1⤵
- Executes dropped EXE
PID:1840

C:\Temp\ifaxvtndau.sys
C:\Temp\ifaxvtndau.sys
1⤵
PID:3608

C:\Temp\fdxvpnhfax.sys
C:\Temp\fdxvpnhfax.sys
1⤵
PID:1808

C:\Temp\xrpnhfcaus.sys
C:\Temp\xrpnhfcaus.sys
1⤵
PID:3780

C:\Temp\hfzxrpjhbz.sys
C:\Temp\hfzxrpjhbz.sys
1⤵
PID:3364

C:\Temp\hezxrpjhbz.sys
C:\Temp\hezxrpjhbz.sys
1⤵
PID:1832

C:\Temp\ebwtrojhbz.sys
C:\Temp\ebwtrojhbz.sys
1⤵
PID:6020

C:\Temp\mgdywtrljg.sys
C:\Temp\mgdywtrljg.sys
1⤵
PID:5780

C:\Temp\lgdbvtqlid.sys
C:\Temp\lgdbvtqlid.sys
1⤵
PID:4760

C:\Temp\qnlidaysqk.sys
C:\Temp\qnlidaysqk.sys
1⤵
PID:3428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bwqoigbytrljdbvt.exe

Path C:\Temp\bwqoigbytrljdbvt.exe
Size 384KB
SHA256 7d69a9974a905ea92b22bb648832305a29799a40948369d098ecde191e2fd806
MD5 f7050d47281f54fc6c525fffeb779ec6
SHA1 7fefe351f4b9709d5841cf68440be29997b2aa27
SHA512 fe540abb4ee509ea5e75abae2968962dbfafbfb830e1f0807059068dccc270bfa185da80e42fbe6b3c3b70ca1a9d57550ac5b1a23350b8fd858edf7007f225f2
SSDEEP 3072:Q9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:ictFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T17E847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bwqoigbytrljdbvt.sys

Path C:\Temp\bwqoigbytrljdbvt.sys
Size 293KB
SHA256 393230f87bba3db2529800b2fe9f8ffe21b24610dab52bbe25975ae6d90a0776
MD5 ad08cc7c21c422367657997ffa5d379c
SHA1 980700c150be658a35692270e964778c439a3478
SHA512 6ea3aa960d9c7a172094d5e4778403bb6a644816b2b41dc93e33f073f322dbc57cbe9054d7e4e84c98945d52b284f254344a1f740c6d098dd032068875bc5fc6
SSDEEP 3072:QtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:QIJjiJcbI03GBc3ucY5DCSj
TLSH
T1E1545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cwupmhezxr.exe

Path C:\Temp\cwupmhezxr.exe
Size 384KB
SHA256 33ff1bab8ade4264a5658449a1442d7e34f84feed9e9c1e316b8cc07605ce6d0
MD5 4c8302c6c5abc03f32429c9dbff01079
SHA1 df4e9336b805933e96560590d7246d675d90d7dc
SHA512 611987e8d242a6c7e4612ce4510f6bfb403f2fdd0909a02f8a254b68fa9e39024d155702e46e0b4dd71695a4b744a3418ba3f76834509cc1e52168d80616acd2
SSDEEP 3072:69ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:gctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T169847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbvtoljgby.exe

Path C:\Temp\dbvtoljgby.exe
Size 384KB
SHA256 006c11aace2ffbe8fa66d07aca49dc7d6317f54b2a079b8e7d0b4cce73c34469
MD5 2f986d0b034fb0a1e8543b12742fe361
SHA1 dd71d989f302010dba7bd368a7aa4e3daec29255
SHA512 afecfb363a7f4b7422e2a52108e8324a37bf7c0fd1735ddd4f2ab41d603f74e7b9d19b4f36bbafaa3ffdfdb87a4d63a5e4aa81171d666660b29150a3360095e2
SSDEEP 3072:h9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:rctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T11D846B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxsnkidavs.sys

Path C:\Temp\dxsnkidavs.sys
Size 293KB
SHA256 f20c8aad1d5bab4eea243530922a657fafb06c3dfec21734cf1a8aba68ec156c
MD5 8e4f28c05f3543c19374d3a4bdff8a59
SHA1 9079c84c1e88da70b278bebbc5a2de9de01564e6
SHA512 77a4cbfd6321ad8aaeaffe3078c97a70f3ac662542bc003b8b0dd976ece090c457869775c67f9b4255211d9a12ea07f84f1fc467eda8852f509bae56ba771adc
SSDEEP 3072:stKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:sIJjiJcbI03GBc3ucY5DCSj
TLSH
T197545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dyvqolgdbv.exe

Path C:\Temp\dyvqolgdbv.exe
Size 384KB
SHA256 de26d4c60d1dd61f3414daf5d7a70854352e22a6be732db08505f5aa79c5adba
MD5 954cbb6e1d4630766aa9fddc08e4f015
SHA1 9293531d246be82772ae65522bfa001c846c8712
SHA512 b747994bf8b39ba2ab84fe1b831ba807842fd2120b077568779f80245c37b787359dc35ad4bbeef8688c50bea4150a505534a9bcee74c11fb637a40fde186e89
SSDEEP 3072:79ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:pctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E2846B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fcausnkfcx.exe

Path C:\Temp\fcausnkfcx.exe
Size 384KB
SHA256 638d9bb043d2c4ae2df529ba1dffcffff30a766016bc6080fdc2abfde2f16f89
MD5 d01eb4299e852926be842f530101da54
SHA1 29d2f9cf0b52d9cb83fc112d953134908ffbab66
SHA512 a45d1c972f69ff483af0e34ed95f08e48ff86a87c6d46e1a638a29d9024436e30d1ebcaaf806b8498a905edc0fb0a5def39fe0d35d4ad4a69cf1390a65244729
SSDEEP 3072:p9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:DctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T183847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hczxsmkhca.sys

Path C:\Temp\hczxsmkhca.sys
Size 293KB
SHA256 f0f2fec78a74f82b7397505be3ebdaec6e64b32763e7c246a30486cfab4e2658
MD5 3e70a175397388ef33ca49f3cfcdb897
SHA1 86450c18599c746f21c6a8126f9695adf473198b
SHA512 bc11ee1bfaa8a2aecbaf5b643eda75652511f0bd683fbc55d4a8888b48a70fe0253549c8bf6917791f6a5c02690f8b5800a8cfa07da8b428b8fcb8823221ec14
SSDEEP 3072:ItKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:IIJjiJcbI03GBc3ucY5DCSj
TLSH
T184545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dbvtoljgby.exe

Path C:\Temp\i_dbvtoljgby.exe
Size 384KB
SHA256 1fc219e0245dd0d99f472c6444685dfe0f4abee31a3b573f3786b280555fe4d8
MD5 a63c109946e18aa9f4371521110fa68e
SHA1 ba79628c7d958c81fb68a5705ac21380c1bde477
SHA512 a7c150333f21d81f1578c7e65d243cc53dd882d294bdb5df9ed59e9a28d9a2d94f634dd68a7b61eea2c6296b4be4ca84b7482272095d5375f0c0ae6f053253cd
SSDEEP 3072:x9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:7ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T123847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dyvqolgdbv.exe

Path C:\Temp\i_dyvqolgdbv.exe
Size 384KB
SHA256 bb6a23b1ad2b33a04a7be05fe68c77bbb338d0f4888c8fb806756d072224c168
MD5 f528cd92452277a91fa6d2493792a58a
SHA1 9a7e1e5686790076844e4e4f5f274bcad16afdfa
SHA512 af5d6a8ab69990d97c72051367d6f1a23f1ebf912151bff37c27034310b302e5fbaa3df3bb70ee1e6423069610e7286f31642bd80ad39b436d1c0276a3cc931f
SSDEEP 3072:J9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:jctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T165847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fcausnkfcx.exe

Path C:\Temp\i_fcausnkfcx.exe
Size 384KB
SHA256 8923b2ef7076c7b3ec7b35777c307deeee4be537f3c92f658e94dd7aa9569ade
MD5 0462a85b8e7204c0a8c9b4ce7a4f072a
SHA1 5469658b1682632c7cf66c6171f72f79f26794b9
SHA512 66902ebee1efeef5c8e6d724448423a3fef37c1cbe78342b5459ecb95ba0f02afdd8e57a0404da3a9bcfc065b65a1fe71df86efe2cdcde2bdbc5d070aea6aecc
SSDEEP 3072:p9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:DctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T118847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_kfzxspcaus.exe

Path C:\Temp\i_kfzxspcaus.exe
Size 384KB
SHA256 fde9d2f763a061e35312ad24c597e245eb69837ff73ab960d4617478087e7900
MD5 b18700687c9c48047f39bdfd053682ce
SHA1 0b11c263f2ba10b1ddcbd973407f108d51780272
SHA512 b067c9fa9f8ce788a3e1dc2afcf42c778116afefa940256bdef633a1272ff8f4f0a8d170632db08708ac97fcb4cf24e9cf262e7d26249887c88fc54f9cb56e75
SSDEEP 3072:r9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:ZctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1FB847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_snlfdxvpni.exe

Path C:\Temp\i_snlfdxvpni.exe
Size 384KB
SHA256 2b1e517c9703c4c62d3a08e0392c864862e1d9aa9c0fca4f3335768ee3bfa158
MD5 d663664d658db1b89c8df678e5181c32
SHA1 48ea18695ec432a6282ff8b55cd35df5743e0a9e
SHA512 7068f40b4c6ee8d54949cd65580d167afed3a16b228f020d9c1d73b3d63fe3bc7974760ba2f23e7daa78d5913ddce13053efd2ef238bd086df92cca539bdcea0
SSDEEP 3072:W9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:EctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T13F846A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igdyvqoiga.sys

Path C:\Temp\igdyvqoiga.sys
Size 293KB
SHA256 97e975d608bcf715628ff1332f91ed44c63cc683c1c2bca463b2238d13f2767d
MD5 0073ba6c6fa4b9bd8c2a710ec66e5ee7
SHA1 702ce119f5584356e6dd6ee316a5d0748a2b2c66
SHA512 1024c5094b8319cd1e822893f9bca1c97cc461fdcffce56a589facbc77488fdda3b144a37c5f321662275dafdb98eea6171ef19db94ad53449062955d6ed13a4
SSDEEP 3072:atKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:aIJjiJcbI03GBc3ucY5DCSj
TLSH
T1DD545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kfzxspcaus.exe

Path C:\Temp\kfzxspcaus.exe
Size 384KB
SHA256 0bdaf29c300862c3d3c1efbb1308315f115594a297b820c7a371fbfd781e832d
MD5 71b08d455bbbf37686519b354753c67a
SHA1 a3d71415abfed124dc0de797bbd8b3e9c80e46e4
SHA512 0ac2cbdb63db920f34a5768473c0ad494ff70d1000c944b00b70089047cbf7caf8800f8cd12886aaa91803b7b7ed379146854a6c3456054f50c026e7dc6b5e5f
SSDEEP 3072:Z9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:zctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B9847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

khfaxspnhf.sys

Path C:\Temp\khfaxspnhf.sys
Size 293KB
SHA256 09451ba0889b6192c7e06b86138fa038e19cb860dbd33b70a58a00299c627802
MD5 3951ef6c41b1432d9dd83161d66c4f01
SHA1 bb28aaa4a1382f4511f372fea5e91b3625ba3d7c
SHA512 f8a600dc70c47da3757909f7e64b239969e748831386803b4a312977179d74cc8e1318c6345d9e2fbe10df57710580f55361462c4811ca547af645482b1430a3
SSDEEP 3072:ltKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:lIJjiJcbI03GBc3ucY5DCSj
TLSH
T1D9545B44AAA4B0F6D9D5043C00EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snlfdxvpni.exe

Path C:\Temp\snlfdxvpni.exe
Size 384KB
SHA256 e18cdd6dd520670883e8c026942a8a7e117b30065eb4935620e7b3a33140be36
MD5 b277f3f025e582166de7f6c4ccec9fd7
SHA1 cde2c48c1e6b89057f55e3aa2e58b8b9ee955c01
SHA512 51809dcb76ecf0efdee07e4f6cd077430783873b21d36dd573bd058f329d1e882a9a23d1152b4e23b3e4866b0df846b9fc95721087b7ead178e106633e657af3
SSDEEP 3072:w9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:CctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T10A847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqkicankfd.sys

Path C:\Temp\sqkicankfd.sys
Size 293KB
SHA256 632499f8a31cfa9bf031596a12248dee4793527ec1503645ffc040a11f437a3a
MD5 2a274a54b192613f0c3d161422f98ad3
SHA1 8ed3ccf4e2f291bfeac67b955a99c8902a2d2bda
SHA512 52e8b83aa68d36b99437b739c13575b3bba19167d0a84b82c53cfe78cc4afc19a943d20b23e92862d6b682c6860af3f58fc1641eb18f0f9b5f26689026c8a59c
SSDEEP 3072:/tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:/IJjiJcbI03GBc3ucY5DCSj
TLSH
T1A2545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

97f5f098-8881-42da-88f3-22925524fe08.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\97f5f098-8881-42da-88f3-22925524fe08.tmp
Size 35KB
SHA256 d527adb5cbbfe2ba13dd279c90ddb707be5e9da804635259ee169fff00864153
MD5 1db88c1a079091bc681837dee94d373a
SHA1 9f6ed7161262bdb888d24aa5698c9e9cd7cbc933
SHA512 02a1ec7ca2fd240fd45c4ab43363e07fc0ee6b8eae71095f6faf87be22b1b31ce6174c55fe7555f0fb9aaab0268e6b4332e0fb184d95d7e5f9fd4837184336a9
SSDEEP 768:Qj+9f3iD4KSWp8+p3bd66j+4BRv86aLIWwb9M1:v9f3iyA8+p3Z6n4y2b+1
TLSH
T1D0F2AF31E8699E734CE5C648B2573783AFF425A399C00ED8D4D8AF0D01972AD1B4B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 73cddd8ba00953bb057768ce96df498999d9d0edb0a54ecde01136f6fb06a1ca
MD5 4988025665c7749225df45c5cda275c7
SHA1 2d7b90b4268805f5472cb1e1478b71338e1a2968
SHA512 21a650354744dc729e1a56cda0128371ee3a50a12d7144e32e6672d59beda96a4d1e38c1066075f8d601218bfb0be1df73dc298975f2ab195069a0efafb9d3ef
TLSH
T1BC519EB807B129F2CBA446755AD1E60A32F8889900B3DE5B40401DB55B07F6D16D2FAB
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59c2ba.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59c2ba.TMP
Size 2KB
SHA256 a230d89912f5f4210256640ea0d69331a545a8bcc61be0ac9310547fae5d3327
MD5 1caceb6e160d0ecc6bfdac4bc49f6e0e
SHA1 26d78956321140bbfe4fa81c1144298cdecfc169
SHA512 29aa5c4a86a938e431cdf5b9fa759774319d1e6e4ea25e9bc4ddf0863a572356cbbd52e894d1ce14eae44780b0bfa845017647f7445a7df97b3c20831bbfea18
TLSH
T16D51A0B807B129F2CBA446755AD1E60A32F8889900B7DE5B40401DF55F07F6D17D2FAB
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 25920a959ad7377d46aee18ecb840d6a7261bb2ffa8fe3a009fb4ac60952c490
MD5 d04fa122df3a86001e3bdf21ce8541ba
SHA1 9e61c2da46e6b6a9c17bc6b41829cead25022c9b
SHA512 97c7d44f92eb60c85e4a1507d536ce19e9b87e6d5101a9ed29d2b7ab2d726fcd9b4ced3d40bf466b6814c1133dfce9c6e2b9a53c173f2466455ae8c844a3d9b2
TLSH
T18451ACF3C3E8862DD90196F0AA147E2BCE1D0914832C3D5AC9E4AE1BA3E2471E14195E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 ad2300435848b03a309a0962359a2bd668ef8fb4ec943d1ec2d967863c503743
MD5 ec8d816b5c0571748cdeb4f2fb00b02f
SHA1 d12b2a352afb20697330e92a93e2a0cb1ca184bc
SHA512 d735e8a7ac0b23c7efd9e297b32af9ba407c42d6bd24225eeec1b6ac7f17572032569e3a9f87d353f0ac7346a6c657d59b642701ff38e60995ef02a2b26dfcfe
SSDEEP 192:sxRSRTyM/jK1Ml8wC//fusRCQi53ZlZM48zoD8pi/g6+WNIYCsuO6GLIgtJ:sxRSD8//fusQp5JlSBi/5Ie93
TLSH
T1A452EA166A345977DCDBD21DFA55BF53D6F81433A2901E44AAFCCA0C04E6AEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 eb554d5d825e847004e6fbd1d4b838d9ff86323198150157b6af171e4b98c701
MD5 f44f702805f73e7c6f44f3ba5edc5416
SHA1 9e9df0c03d710492985887892a25f917d5679f78
SHA512 a13f688dc2f6d19461f5a15a6635782ae9f575ea37c2329bb95a267f36b25103cd596470db85047ec9e0c8cf8ccee9e5a3c05533fa480391bb32f78b85f09b47
SSDEEP 192:sxRNRTyM/jK1Ml8UQgWC//fusMC5i53ZlZM4gzoD8pr5/g6+WNCUw/YCquO6GLI5:sxRNtq4//fusDc5JlSVN/5q/k9a
TLSH
T19962DA166A3459779CDBD21DFA51BF53D6F8547392941E44AAFCCA0C00F6AEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 dab75220cc7424fd6f8e8762473ada5fff46afd817bf57f86953860a63af31af
MD5 06a492a3847e04e1211087718c2ed3af
SHA1 6d33dd657e033cdf2eebd5f6e33f5f49f760c5d0
SHA512 d4efa9d4e6b77537e23ea3bd3ef40728112dadf785440ff930209b263b62ae1a6b3843a546e1615b31928ad628479bac089d97763d14b00f93cb553c4c9d1dfa
SSDEEP 192:sxRNRTyM/jK1Ml8wC//fusMCQi53ZlZM4gzoD8p95/g6+WNCUw/YCGuO6GLIgD0J:sxRNt8//fusDp5JlSV//5q/o9s
TLSH
T10762DA166A3459779CDBD21DFA51BF53D6F8147392941E44AAFCCA0C00E6BEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a170fa48-d0f9-4c42-bcef-12aeb26bd4f6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a170fa48-d0f9-4c42-bcef-12aeb26bd4f6.tmp
Size 32KB
SHA256 eccffe29719778b308fb78f9965f0e46cbccb55a5cc2a0e26f9a9cff78715463
MD5 01e27dd8dc941744f9e84df1d8181b05
SHA1 667b76778adf301845fbe292b4c0a6a90e5dce2b
SHA512 4e32d418cee1099fb4841501128f094181297ccca1a7a277f28e1059eed92578348dec8ce94e399cc4d6fe67ede825e88eb9609a805a1939ab5aa96befd68b19
SSDEEP 768:j/8vNN7pLuL7tQWgQ+fB+8F1+UoAYDCx9Tuqh0VfUC9xbog/OV/aMQqqqrov4:j/8vN7E7tQWgQ+fB+u1jaUaMVqBA
TLSH
T142E2FC3B680CCB7E4F804E9CEC29BD9AADE801CF5698CD5447EA840C03C57EB561A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 79256129da3d4e047ebeb3a46cf68b37cf0022128b9f4dc19b74a39589f4da8f
MD5 acf37770eb2b179e431cf9c872175a03
SHA1 18d8855e617edaa11ca1f77a074bebfca19892f9
SHA512 68b087f439c1346aa16a156a38c2bd18761ff7313cc8816300d739e7aecc1ae17259f18c5f9cda5ad4a991b231596bc550cec932cb9a68f9c65e33896d8c9883
SSDEEP 768:Kj+9f3E4KS5p8+p3bd66j+4BRv86aLIWwb9M1:p9f3jn8+p3Z6n4y2b+1
TLSH
T1D1F2AF31E8A9DE734CE5C648B2573783AEF425B399C01ED8D8D9AF0D01972AD170B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 18c8a3da585b00b3de485b94d715a99f018b5d39737de7eac78b05b286b7ef11
MD5 24a705862d8ddd34bb432426826e658a
SHA1 9f38bf058758d55672c3818f02f930d51fdf7df2
SHA512 5096940e07978beb3c43cc60a0bb2b08461a8f40ef589e46c44982e9047ed0637862ec3906fc4dc7565b00ff8a7e9a0b5344210962e211dd30578707c1b0b248
SSDEEP 768:Irv+4UNbdD3QcwNp8+p3bd66j+4BRv86aLIi62bwCl1:Ibsbp34L8+p3Z6n4yY0ww
TLSH
T15803CE33F8A899739CE6CA44B2467A437FF851A396C10EC4D5DD2B4E419A19E630BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 9f0d465d02252b0ddaf67eb14b0ee015ec28871f2aa2d7237ce4f4264866c434
MD5 65e243f1ba9fb02e8ff8a10ad5887ca9
SHA1 95c945e6309e3ac3813f62b2a0c4abc502b867c2
SHA512 fc3cfbc5af6bbb30a0f64bc98c12b379c6171d721941c022b4a489b6a57cedcc57d9d6474187f0304156a6ccaff0d237e90297953d7179ba267d454262855462
SSDEEP 768:aF1j+9P3RwgMfrnop8+p3bd66j+4BRv86aLIWwb9M1:/9P3cK8+p3Z6n4y2b+1
TLSH
T1A31328F298D78A77D89E8747A37D2E429EFCD1A3B5841894B7C85E0CCC921BFC606815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4204_487116452\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 102f14d9b67f9d0a3520cd84542ff9c1fbaed22510aaccdb2043c1787ae503ae
MD5 e1956477bd15256393b872805747cef0
SHA1 54d93ceda6b6cb74fa9ef46a8b66b32f70767b66
SHA512 2c3ac57bb0918299ee90d20b6d6f202de2fbc1dfa7cf1398e23cbb867eed02238b3adc756b99c3a69cdf3b9eea9f7b5d52e72a366b41876f7f1f1f029e0f1888
TLSH
T1CC71238357A8D5B3C1DE9BF013835204F6FB227C0B2370640BA1594AEB30A7A64B8F08
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1204-272-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1328-328-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1808-390-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1832-422-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1840-364-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1868-244-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2120-197-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3364-418-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3428-470-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3608-377-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3780-398-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4464-298-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4760-450-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4980-284-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5020-365-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5020-339-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5056-324-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5504-335-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5508-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5780-431-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6020-427-0x0000000000010000-0x00000000000AB000-memory.dmp

Download