systex | a78c4fa0b16679101edf4bf682db382669b6c12963ae4e67e96bd164d2aa4a41

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 01:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-13_7228c22f5671d2062b57ef550a22020e_amadey_darkgate_elex_smoke-loader_stop.exe
Size 384KB
Sample260714-bk68fad15x
SHA256 a78c4fa0b16679101edf4bf682db382669b6c12963ae4e67e96bd164d2aa4a41
MD5 7228c22f5671d2062b57ef550a22020e
SHA1 2112ca3f064a2513e1f3dae712951bbaa6b0cac6
SHA512 6babd6a2c506721fc8be1f21be7b4d79c750c8fbbb4f3374020c1755104b52237907ead9940103eddc0646724df6e2bbf3b1b8041c52fb3dc1a82e2e4c4cef30
SSDEEP 3072:cG9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx99:hctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A7847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
4660	etolgdbztrojgeyw.exe
3900	etolgdbztrojgeyw.sys
4092	CreateProcess.exe
1888	gbywolgdbt.exe
712	CreateProcess.exe
4348	CreateProcess.exe
260	i_gbywolgdbt.exe
1512	omgeywqojg.sys
1048	CreateProcess.exe
5124	yvqoigaytq.exe
2768	CreateProcess.exe
3900	CreateProcess.exe
4864	i_yvqoigaytq.exe
6076	igaysqliga.sys
1876	CreateProcess.exe
4368	dbvtqlidyv.exe
4292	CreateProcess.exe
4456	CreateProcess.exe
4440	i_dbvtqlidyv.exe
5008	ysqkicavsn.sys
4392	CreateProcess.exe
564	vtnlfdxvqn.exe
4608	CreateProcess.exe
1280	CreateProcess.exe
4420	i_vtnlfdxvqn.exe
1088	spkhfaxvpn.sys
2832	CreateProcess.exe
6108	nhfdausmkf.exe
2592	CreateProcess.exe
3352	CreateProcess.exe
4544	i_nhfdausmkf.exe
2056	spnkicausm.sys
2984	CreateProcess.exe
1524	pmkhcausmk.exe
4808	CreateProcess.exe
4160	CreateProcess.exe
5184	i_pmkhcausmk.exe
908	fzxrpkhcau.sys
1320	CreateProcess.exe
3696	zxrpjhczur.exe
5408	CreateProcess.exe
4148	CreateProcess.exe
6052	i_zxrpjhczur.exe
5752	ezxrpjhbzw.sys
3468	CreateProcess.exe
2004	cwurpjgezw.exe
5688	CreateProcess.exe
808	CreateProcess.exe
5812	i_cwurpjgezw.exe
5612	mhezwugebw.sys
3044	CreateProcess.exe
1652	wqojgbztro.exe
2368	CreateProcess.exe
2324	CreateProcess.exe
748	i_wqojgbztro.exe
4324	eywqojgbyw.sys
5508	CreateProcess.exe
4120	eywtroiyvt.exe
3532	CreateProcess.exe
1736	CreateProcess.exe
2540	i_eywtroiyvt.exe
5648	gdbytqolgd.sys
1104	CreateProcess.exe
5424	lgdbywqoig.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnlfdxvqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkidaysqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpnicavsnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxrpkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	etolgdbztrojgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlfdxvqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwurpjgezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqojgbztro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eczurmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gezwrojhbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaysqlidav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvqoigaytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvtqlidyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgdbywqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usqkicausn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxrpkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eczurmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gezwrojhbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvtqlidyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmkhcausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrpjhczur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwurpjgezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkidaysqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpnicavsnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbywolgdbt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfdausmkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jebztromje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bywqoigeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfdausmkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxrpjhczur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbywolgdbt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmkhcausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywtroiyvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywtroiyvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usqkicausn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bywqoigeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-13_7228c22f5671d2062b57ef550a22020e_amadey_darkgate_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqojgbztro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgdbywqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jebztromje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvqoigaytq.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1904	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3800	ipconfig.exe
3052	ipconfig.exe
4840	ipconfig.exe
1128	ipconfig.exe
4944	ipconfig.exe
2860	ipconfig.exe
1720	ipconfig.exe
5384	ipconfig.exe
6076	ipconfig.exe
5920	ipconfig.exe
4444	ipconfig.exe
3896	ipconfig.exe
1684	ipconfig.exe
4228	ipconfig.exe
5796	ipconfig.exe
896	ipconfig.exe
3808	ipconfig.exe
5020	ipconfig.exe
4640	ipconfig.exe
5776	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134284652053988417"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{860F4CBD-9769-42E8-9077-4352A35A2ABB}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5044	2026-07-13_7228c22f5671d2062b57ef550a22020e_amadey_darkgate_elex_smoke-loader_stop.exe
5044	2026-07-13_7228c22f5671d2062b57ef550a22020e_amadey_darkgate_elex_smoke-loader_stop.exe
5044	2026-07-13_7228c22f5671d2062b57ef550a22020e_amadey_darkgate_elex_smoke-loader_stop.exe
5044	2026-07-13_7228c22f5671d2062b57ef550a22020e_amadey_darkgate_elex_smoke-loader_stop.exe
5044	2026-07-13_7228c22f5671d2062b57ef550a22020e_amadey_darkgate_elex_smoke-loader_stop.exe
5044	2026-07-13_7228c22f5671d2062b57ef550a22020e_amadey_darkgate_elex_smoke-loader_stop.exe
5044	2026-07-13_7228c22f5671d2062b57ef550a22020e_amadey_darkgate_elex_smoke-loader_stop.exe
5044	2026-07-13_7228c22f5671d2062b57ef550a22020e_amadey_darkgate_elex_smoke-loader_stop.exe
5044	2026-07-13_7228c22f5671d2062b57ef550a22020e_amadey_darkgate_elex_smoke-loader_stop.exe
5044	2026-07-13_7228c22f5671d2062b57ef550a22020e_amadey_darkgate_elex_smoke-loader_stop.exe
5044	2026-07-13_7228c22f5671d2062b57ef550a22020e_amadey_darkgate_elex_smoke-loader_stop.exe
5044	2026-07-13_7228c22f5671d2062b57ef550a22020e_amadey_darkgate_elex_smoke-loader_stop.exe
5044	2026-07-13_7228c22f5671d2062b57ef550a22020e_amadey_darkgate_elex_smoke-loader_stop.exe
5044	2026-07-13_7228c22f5671d2062b57ef550a22020e_amadey_darkgate_elex_smoke-loader_stop.exe
5044	2026-07-13_7228c22f5671d2062b57ef550a22020e_amadey_darkgate_elex_smoke-loader_stop.exe
5044	2026-07-13_7228c22f5671d2062b57ef550a22020e_amadey_darkgate_elex_smoke-loader_stop.exe
5044	2026-07-13_7228c22f5671d2062b57ef550a22020e_amadey_darkgate_elex_smoke-loader_stop.exe
5044	2026-07-13_7228c22f5671d2062b57ef550a22020e_amadey_darkgate_elex_smoke-loader_stop.exe
5044	2026-07-13_7228c22f5671d2062b57ef550a22020e_amadey_darkgate_elex_smoke-loader_stop.exe
5044	2026-07-13_7228c22f5671d2062b57ef550a22020e_amadey_darkgate_elex_smoke-loader_stop.exe
5044	2026-07-13_7228c22f5671d2062b57ef550a22020e_amadey_darkgate_elex_smoke-loader_stop.exe
5044	2026-07-13_7228c22f5671d2062b57ef550a22020e_amadey_darkgate_elex_smoke-loader_stop.exe
5044	2026-07-13_7228c22f5671d2062b57ef550a22020e_amadey_darkgate_elex_smoke-loader_stop.exe
5044	2026-07-13_7228c22f5671d2062b57ef550a22020e_amadey_darkgate_elex_smoke-loader_stop.exe
5044	2026-07-13_7228c22f5671d2062b57ef550a22020e_amadey_darkgate_elex_smoke-loader_stop.exe
5044	2026-07-13_7228c22f5671d2062b57ef550a22020e_amadey_darkgate_elex_smoke-loader_stop.exe
5044	2026-07-13_7228c22f5671d2062b57ef550a22020e_amadey_darkgate_elex_smoke-loader_stop.exe
5044	2026-07-13_7228c22f5671d2062b57ef550a22020e_amadey_darkgate_elex_smoke-loader_stop.exe
5044	2026-07-13_7228c22f5671d2062b57ef550a22020e_amadey_darkgate_elex_smoke-loader_stop.exe
5044	2026-07-13_7228c22f5671d2062b57ef550a22020e_amadey_darkgate_elex_smoke-loader_stop.exe
5044	2026-07-13_7228c22f5671d2062b57ef550a22020e_amadey_darkgate_elex_smoke-loader_stop.exe
5044	2026-07-13_7228c22f5671d2062b57ef550a22020e_amadey_darkgate_elex_smoke-loader_stop.exe
5044	2026-07-13_7228c22f5671d2062b57ef550a22020e_amadey_darkgate_elex_smoke-loader_stop.exe
5044	2026-07-13_7228c22f5671d2062b57ef550a22020e_amadey_darkgate_elex_smoke-loader_stop.exe
5044	2026-07-13_7228c22f5671d2062b57ef550a22020e_amadey_darkgate_elex_smoke-loader_stop.exe
5044	2026-07-13_7228c22f5671d2062b57ef550a22020e_amadey_darkgate_elex_smoke-loader_stop.exe
5044	2026-07-13_7228c22f5671d2062b57ef550a22020e_amadey_darkgate_elex_smoke-loader_stop.exe
5044	2026-07-13_7228c22f5671d2062b57ef550a22020e_amadey_darkgate_elex_smoke-loader_stop.exe
5044	2026-07-13_7228c22f5671d2062b57ef550a22020e_amadey_darkgate_elex_smoke-loader_stop.exe
5044	2026-07-13_7228c22f5671d2062b57ef550a22020e_amadey_darkgate_elex_smoke-loader_stop.exe
5044	2026-07-13_7228c22f5671d2062b57ef550a22020e_amadey_darkgate_elex_smoke-loader_stop.exe
5044	2026-07-13_7228c22f5671d2062b57ef550a22020e_amadey_darkgate_elex_smoke-loader_stop.exe
5044	2026-07-13_7228c22f5671d2062b57ef550a22020e_amadey_darkgate_elex_smoke-loader_stop.exe
5044	2026-07-13_7228c22f5671d2062b57ef550a22020e_amadey_darkgate_elex_smoke-loader_stop.exe
5044	2026-07-13_7228c22f5671d2062b57ef550a22020e_amadey_darkgate_elex_smoke-loader_stop.exe
5044	2026-07-13_7228c22f5671d2062b57ef550a22020e_amadey_darkgate_elex_smoke-loader_stop.exe
5044	2026-07-13_7228c22f5671d2062b57ef550a22020e_amadey_darkgate_elex_smoke-loader_stop.exe
5044	2026-07-13_7228c22f5671d2062b57ef550a22020e_amadey_darkgate_elex_smoke-loader_stop.exe
5044	2026-07-13_7228c22f5671d2062b57ef550a22020e_amadey_darkgate_elex_smoke-loader_stop.exe
5044	2026-07-13_7228c22f5671d2062b57ef550a22020e_amadey_darkgate_elex_smoke-loader_stop.exe
5044	2026-07-13_7228c22f5671d2062b57ef550a22020e_amadey_darkgate_elex_smoke-loader_stop.exe
5044	2026-07-13_7228c22f5671d2062b57ef550a22020e_amadey_darkgate_elex_smoke-loader_stop.exe
5044	2026-07-13_7228c22f5671d2062b57ef550a22020e_amadey_darkgate_elex_smoke-loader_stop.exe
5044	2026-07-13_7228c22f5671d2062b57ef550a22020e_amadey_darkgate_elex_smoke-loader_stop.exe
5044	2026-07-13_7228c22f5671d2062b57ef550a22020e_amadey_darkgate_elex_smoke-loader_stop.exe
5044	2026-07-13_7228c22f5671d2062b57ef550a22020e_amadey_darkgate_elex_smoke-loader_stop.exe
4660	etolgdbztrojgeyw.exe
4660	etolgdbztrojgeyw.exe
4660	etolgdbztrojgeyw.exe
4660	etolgdbztrojgeyw.exe
4660	etolgdbztrojgeyw.exe
4660	etolgdbztrojgeyw.exe
4660	etolgdbztrojgeyw.exe
4660	etolgdbztrojgeyw.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	260	i_gbywolgdbt.exe
Token: SeDebugPrivilege	4864	i_yvqoigaytq.exe
Token: SeDebugPrivilege	4440	i_dbvtqlidyv.exe
Token: SeDebugPrivilege	4420	i_vtnlfdxvqn.exe
Token: SeDebugPrivilege	4544	i_nhfdausmkf.exe
Token: SeDebugPrivilege	5184	i_pmkhcausmk.exe
Token: SeDebugPrivilege	6052	i_zxrpjhczur.exe
Token: SeDebugPrivilege	5812	i_cwurpjgezw.exe
Token: SeDebugPrivilege	748	i_wqojgbztro.exe
Token: SeDebugPrivilege	2540	i_eywtroiyvt.exe
Token: SeDebugPrivilege	4856	i_lgdbywqoig.exe
Token: SeDebugPrivilege	3176	i_qkidaysqli.exe
Token: SeDebugPrivilege	6068	i_vpnicavsnk.exe
Token: SeDebugPrivilege	5284	i_usqkicausn.exe
Token: SeDebugPrivilege	252	i_fzxrpkhcau.exe
Token: SeDebugPrivilege	3152	i_eczurmkecw.exe
Token: SeDebugPrivilege	2812	i_gezwrojhbw.exe
Token: SeDebugPrivilege	1296	i_jebztromje.exe
Token: SeDebugPrivilege	3028	i_bywqoigeyw.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1940	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5044 wrote to memory of 4660	5044	2026-07-13_7228c22f5671d2062b57ef550a22020e_amadey_darkgate_elex_smoke-loader_stop.exe	87
PID 5044 wrote to memory of 4572	5044	2026-07-13_7228c22f5671d2062b57ef550a22020e_amadey_darkgate_elex_smoke-loader_stop.exe	88
PID 4572 wrote to memory of 1940	4572	iexplore.exe	89
PID 1940 wrote to memory of 4432	1940	msedge.exe	90
PID 1940 wrote to memory of 1904	1940	msedge.exe	91
PID 1940 wrote to memory of 4612	1940	msedge.exe	93
PID 1940 wrote to memory of 4612	1940	msedge.exe	93
PID 1940 wrote to memory of 1956	1940	msedge.exe	92
PID 1940 wrote to memory of 1956	1940	msedge.exe	92
PID 1940 wrote to memory of 1956	1940	msedge.exe	92
PID 1940 wrote to memory of 5804	1940	msedge.exe	95
PID 1940 wrote to memory of 5864	1940	msedge.exe	96
PID 1940 wrote to memory of 5804	1940	msedge.exe	95
PID 1940 wrote to memory of 5804	1940	msedge.exe	95
PID 1940 wrote to memory of 5864	1940	msedge.exe	96
PID 1940 wrote to memory of 5864	1940	msedge.exe	96
PID 1940 wrote to memory of 1076	1940	msedge.exe	97
PID 1940 wrote to memory of 1076	1940	msedge.exe	97
PID 1940 wrote to memory of 1076	1940	msedge.exe	97
PID 1940 wrote to memory of 2056	1940	msedge.exe	98
PID 1940 wrote to memory of 2056	1940	msedge.exe	98
PID 1940 wrote to memory of 2056	1940	msedge.exe	98
PID 1940 wrote to memory of 5076	1940	msedge.exe	99
PID 1940 wrote to memory of 5076	1940	msedge.exe	99
PID 4660 wrote to memory of 4092	4660	etolgdbztrojgeyw.exe	103
PID 1888 wrote to memory of 712	1888	gbywolgdbt.exe	106
PID 1940 wrote to memory of 3300	1940	msedge.exe	109
PID 1940 wrote to memory of 552	1940	msedge.exe	110
PID 1940 wrote to memory of 3300	1940	msedge.exe	109
PID 1940 wrote to memory of 552	1940	msedge.exe	110
PID 1940 wrote to memory of 3084	1940	msedge.exe	112
PID 1940 wrote to memory of 4460	1940	msedge.exe	113
PID 1940 wrote to memory of 4460	1940	msedge.exe	113
PID 1940 wrote to memory of 2088	1940	msedge.exe	116
PID 1940 wrote to memory of 2088	1940	msedge.exe	116
PID 4660 wrote to memory of 4348	4660	etolgdbztrojgeyw.exe	117
PID 4660 wrote to memory of 1048	4660	etolgdbztrojgeyw.exe	121
PID 5124 wrote to memory of 2768	5124	yvqoigaytq.exe	123
PID 4660 wrote to memory of 3900	4660	etolgdbztrojgeyw.exe	126
PID 4660 wrote to memory of 1876	4660	etolgdbztrojgeyw.exe	130
PID 4368 wrote to memory of 4292	4368	dbvtqlidyv.exe	132
PID 4660 wrote to memory of 4456	4660	etolgdbztrojgeyw.exe	135
PID 4660 wrote to memory of 4392	4660	etolgdbztrojgeyw.exe	140
PID 564 wrote to memory of 4608	564	vtnlfdxvqn.exe	142
PID 4660 wrote to memory of 1280	4660	etolgdbztrojgeyw.exe	145
PID 1940 wrote to memory of 1780	1940	msedge.exe	147
PID 1940 wrote to memory of 5248	1940	msedge.exe	148
PID 1940 wrote to memory of 3160	1940	msedge.exe	149
PID 4660 wrote to memory of 2832	4660	etolgdbztrojgeyw.exe	152
PID 6108 wrote to memory of 2592	6108	nhfdausmkf.exe	154
PID 4660 wrote to memory of 3352	4660	etolgdbztrojgeyw.exe	157
PID 4660 wrote to memory of 2984	4660	etolgdbztrojgeyw.exe	161
PID 1524 wrote to memory of 4808	1524	pmkhcausmk.exe	163
PID 4660 wrote to memory of 4160	4660	etolgdbztrojgeyw.exe	166
PID 4660 wrote to memory of 1320	4660	etolgdbztrojgeyw.exe	170
PID 3696 wrote to memory of 5408	3696	zxrpjhczur.exe	172
PID 4660 wrote to memory of 4148	4660	etolgdbztrojgeyw.exe	175
PID 4660 wrote to memory of 3468	4660	etolgdbztrojgeyw.exe	179
PID 2004 wrote to memory of 5688	2004	cwurpjgezw.exe	181
PID 4660 wrote to memory of 808	4660	etolgdbztrojgeyw.exe	184
PID 1940 wrote to memory of 4916	1940	msedge.exe	186
PID 1940 wrote to memory of 4916	1940	msedge.exe	186
PID 4660 wrote to memory of 3044	4660	etolgdbztrojgeyw.exe	192
PID 1652 wrote to memory of 2368	1652	wqojgbztro.exe	194

C:\Users\Admin\AppData\Local\Temp\2026-07-13_7228c22f5671d2062b57ef550a22020e_amadey_darkgate_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-13_7228c22f5671d2062b57ef550a22020e_amadey_darkgate_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5044
- C:\Temp\etolgdbztrojgeyw.exe
  C:\Temp\etolgdbztrojgeyw.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4660
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gbywolgdbt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4092
  - - C:\Temp\gbywolgdbt.exe
      C:\Temp\gbywolgdbt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1888
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:712
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6076
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gbywolgdbt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4348
  - - C:\Temp\i_gbywolgdbt.exe
      C:\Temp\i_gbywolgdbt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:260
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\yvqoigaytq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1048
  - - C:\Temp\yvqoigaytq.exe
      C:\Temp\yvqoigaytq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5124
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2768
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1128
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_yvqoigaytq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3900
  - - C:\Temp\i_yvqoigaytq.exe
      C:\Temp\i_yvqoigaytq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4864
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbvtqlidyv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1876
  - - C:\Temp\dbvtqlidyv.exe
      C:\Temp\dbvtqlidyv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4368
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4292
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:896
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbvtqlidyv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4456
  - - C:\Temp\i_dbvtqlidyv.exe
      C:\Temp\i_dbvtqlidyv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4440
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtnlfdxvqn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4392
  - - C:\Temp\vtnlfdxvqn.exe
      C:\Temp\vtnlfdxvqn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:564
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4608
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3808
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtnlfdxvqn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1280
  - - C:\Temp\i_vtnlfdxvqn.exe
      C:\Temp\i_vtnlfdxvqn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4420
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nhfdausmkf.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2832
  - - C:\Temp\nhfdausmkf.exe
      C:\Temp\nhfdausmkf.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6108
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2592
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5920
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nhfdausmkf.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3352
  - - C:\Temp\i_nhfdausmkf.exe
      C:\Temp\i_nhfdausmkf.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4544
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pmkhcausmk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2984
  - - C:\Temp\pmkhcausmk.exe
      C:\Temp\pmkhcausmk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1524
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4808
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4944
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pmkhcausmk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4160
  - - C:\Temp\i_pmkhcausmk.exe
      C:\Temp\i_pmkhcausmk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5184
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zxrpjhczur.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1320
  - - C:\Temp\zxrpjhczur.exe
      C:\Temp\zxrpjhczur.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3696
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5408
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3800
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zxrpjhczur.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4148
  - - C:\Temp\i_zxrpjhczur.exe
      C:\Temp\i_zxrpjhczur.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6052
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cwurpjgezw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3468
  - - C:\Temp\cwurpjgezw.exe
      C:\Temp\cwurpjgezw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2004
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5688
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5020
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cwurpjgezw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:808
  - - C:\Temp\i_cwurpjgezw.exe
      C:\Temp\i_cwurpjgezw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5812
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wqojgbztro.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3044
  - - C:\Temp\wqojgbztro.exe
      C:\Temp\wqojgbztro.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1652
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2368
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2860
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wqojgbztro.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2324
  - - C:\Temp\i_wqojgbztro.exe
      C:\Temp\i_wqojgbztro.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:748
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\eywtroiyvt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5508
  - - C:\Temp\eywtroiyvt.exe
      C:\Temp\eywtroiyvt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4120
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3532
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4444
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_eywtroiyvt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1736
  - - C:\Temp\i_eywtroiyvt.exe
      C:\Temp\i_eywtroiyvt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2540
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lgdbywqoig.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1104
  - - C:\Temp\lgdbywqoig.exe
      C:\Temp\lgdbywqoig.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5424
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2940
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3896
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lgdbywqoig.exe ups_ins
    3⤵
    PID:2656
  - - C:\Temp\i_lgdbywqoig.exe
      C:\Temp\i_lgdbywqoig.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4856
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qkidaysqli.exe ups_run
    3⤵
    PID:3500
  - - C:\Temp\qkidaysqli.exe
      C:\Temp\qkidaysqli.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5492
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5512
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4640
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qkidaysqli.exe ups_ins
    3⤵
    PID:3344
  - - C:\Temp\i_qkidaysqli.exe
      C:\Temp\i_qkidaysqli.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3176
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vpnicavsnk.exe ups_run
    3⤵
    PID:200
  - - C:\Temp\vpnicavsnk.exe
      C:\Temp\vpnicavsnk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:568
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4324
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1720
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vpnicavsnk.exe ups_ins
    3⤵
    PID:2836
  - - C:\Temp\i_vpnicavsnk.exe
      C:\Temp\i_vpnicavsnk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6068
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\usqkicausn.exe ups_run
    3⤵
    PID:4736
  - - C:\Temp\usqkicausn.exe
      C:\Temp\usqkicausn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5184
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1252
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5384
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_usqkicausn.exe ups_ins
    3⤵
    PID:4828
  - - C:\Temp\i_usqkicausn.exe
      C:\Temp\i_usqkicausn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5284
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fzxrpkhcau.exe ups_run
    3⤵
    PID:6052
  - - C:\Temp\fzxrpkhcau.exe
      C:\Temp\fzxrpkhcau.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4596
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1216
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1684
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fzxrpkhcau.exe ups_ins
    3⤵
    PID:1436
  - - C:\Temp\i_fzxrpkhcau.exe
      C:\Temp\i_fzxrpkhcau.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:252
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\eczurmkecw.exe ups_run
    3⤵
    PID:1916
  - - C:\Temp\eczurmkecw.exe
      C:\Temp\eczurmkecw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4896
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5884
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4228
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_eczurmkecw.exe ups_ins
    3⤵
    PID:4136
  - - C:\Temp\i_eczurmkecw.exe
      C:\Temp\i_eczurmkecw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3152
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gezwrojhbw.exe ups_run
    3⤵
    PID:5488
  - - C:\Temp\gezwrojhbw.exe
      C:\Temp\gezwrojhbw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4944
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4952
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5776
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gezwrojhbw.exe ups_ins
    3⤵
    PID:4492
  - - C:\Temp\i_gezwrojhbw.exe
      C:\Temp\i_gezwrojhbw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2812
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jebztromje.exe ups_run
    3⤵
    PID:3872
  - - C:\Temp\jebztromje.exe
      C:\Temp\jebztromje.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1668
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5016
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3052
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jebztromje.exe ups_ins
    3⤵
    PID:4708
  - - C:\Temp\i_jebztromje.exe
      C:\Temp\i_jebztromje.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1296
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bywqoigeyw.exe ups_run
    3⤵
    PID:5360
  - - C:\Temp\bywqoigeyw.exe
      C:\Temp\bywqoigeyw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1588
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3800
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5796
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bywqoigeyw.exe ups_ins
    3⤵
    PID:4652
  - - C:\Temp\i_bywqoigeyw.exe
      C:\Temp\i_bywqoigeyw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3028
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gaysqlidav.exe ups_run
    3⤵
    PID:2520
  - - C:\Temp\gaysqlidav.exe
      C:\Temp\gaysqlidav.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5316
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2960
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4840
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffeec69c188,0x7ffeec69c194,0x7ffeec69c1a0
      4⤵
      PID:4432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,9069603180100400524,9177944137543951787,524288 --field-trial-handle=2300,i,4193615838682192657,5722315480887532712,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:11
      4⤵
      System Time Discovery
      PID:1904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1600,i,12210915991181249045,16872804744664107178,262144 --field-trial-handle=2300,i,4193615838682192657,5722315480887532712,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
      4⤵
      PID:1956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2340,i,4496536310377455613,17067786268505331273,524288 --field-trial-handle=2300,i,4193615838682192657,5722315480887532712,262144 --variations-seed-version --mojo-platform-channel-handle=3020 /prefetch:13
      4⤵
      PID:4612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3652,i,14335866549391453783,476474781217817180,2097152 --field-trial-handle=2300,i,4193615838682192657,5722315480887532712,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
      4⤵
      PID:5804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3632,i,9840915291904482923,16220237245698414437,2097152 --field-trial-handle=2300,i,4193615838682192657,5722315480887532712,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
      4⤵
      PID:5864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4340,i,16257655889484505055,13441125685753278159,2097152 --field-trial-handle=2300,i,4193615838682192657,5722315480887532712,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:1
      4⤵
      PID:1076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4360,i,12390060120739381250,14133343178089046148,2097152 --field-trial-handle=2300,i,4193615838682192657,5722315480887532712,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:9
      4⤵
      PID:2056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3740,i,3381593278836375181,9220167468526990772,524288 --field-trial-handle=2300,i,4193615838682192657,5722315480887532712,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:14
      4⤵
      PID:5076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,6551587994669299711,12859253677833072235,524288 --field-trial-handle=2300,i,4193615838682192657,5722315480887532712,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14
      4⤵
      PID:3300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,6816056134365568718,10469580031259809383,524288 --field-trial-handle=2300,i,4193615838682192657,5722315480887532712,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:14
      4⤵
      PID:552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,14782604202402549779,18354483308151482451,524288 --field-trial-handle=2300,i,4193615838682192657,5722315480887532712,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:14
      4⤵
      PID:4636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,14782604202402549779,18354483308151482451,524288 --field-trial-handle=2300,i,4193615838682192657,5722315480887532712,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:14
      4⤵
      PID:3084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,17443227587522498713,11529052281375329233,524288 --field-trial-handle=2300,i,4193615838682192657,5722315480887532712,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:14
      4⤵
      PID:4460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6656,i,2728368386970415505,3000135719030747946,524288 --field-trial-handle=2300,i,4193615838682192657,5722315480887532712,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:14
      4⤵
      PID:2088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4336,i,1984223900982730034,11895992629154662208,524288 --field-trial-handle=2300,i,4193615838682192657,5722315480887532712,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:14
      4⤵
      PID:1780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4580,i,4696392752226497994,1006530870270921529,524288 --field-trial-handle=2300,i,4193615838682192657,5722315480887532712,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:14
      4⤵
      PID:5248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4368,i,13517018813136338247,11626964402949998301,524288 --field-trial-handle=2300,i,4193615838682192657,5722315480887532712,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:14
      4⤵
      PID:3160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5684,i,15605320487110775623,1830589002315099238,524288 --field-trial-handle=2300,i,4193615838682192657,5722315480887532712,262144 --variations-seed-version --mojo-platform-channel-handle=3900 /prefetch:14
      4⤵
      PID:4916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5692,i,9355594831093570311,16159755185770842731,262144 --field-trial-handle=2300,i,4193615838682192657,5722315480887532712,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:10
      4⤵
      PID:3084

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4764

C:\Temp\etolgdbztrojgeyw.sys
C:\Temp\etolgdbztrojgeyw.sys
1⤵
- Executes dropped EXE
PID:3900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5372

C:\Temp\omgeywqojg.sys
C:\Temp\omgeywqojg.sys
1⤵
- Executes dropped EXE
PID:1512

C:\Temp\igaysqliga.sys
C:\Temp\igaysqliga.sys
1⤵
- Executes dropped EXE
PID:6076

C:\Temp\ysqkicavsn.sys
C:\Temp\ysqkicavsn.sys
1⤵
- Executes dropped EXE
PID:5008

C:\Temp\spkhfaxvpn.sys
C:\Temp\spkhfaxvpn.sys
1⤵
- Executes dropped EXE
PID:1088

C:\Temp\spnkicausm.sys
C:\Temp\spnkicausm.sys
1⤵
- Executes dropped EXE
PID:2056

C:\Temp\fzxrpkhcau.sys
C:\Temp\fzxrpkhcau.sys
1⤵
- Executes dropped EXE
PID:908

C:\Temp\ezxrpjhbzw.sys
C:\Temp\ezxrpjhbzw.sys
1⤵
- Executes dropped EXE
PID:5752

C:\Temp\mhezwugebw.sys
C:\Temp\mhezwugebw.sys
1⤵
- Executes dropped EXE
PID:5612

C:\Temp\eywqojgbyw.sys
C:\Temp\eywqojgbyw.sys
1⤵
- Executes dropped EXE
PID:4324

C:\Temp\gdbytqolgd.sys
C:\Temp\gdbytqolgd.sys
1⤵
- Executes dropped EXE
PID:5648

C:\Temp\sqoigaysql.sys
C:\Temp\sqoigaysql.sys
1⤵
PID:3640

C:\Temp\xvtnlfdavs.sys
C:\Temp\xvtnlfdavs.sys
1⤵
PID:4860

C:\Temp\usnkfcaxvp.sys
C:\Temp\usnkfcaxvp.sys
1⤵
PID:4444

C:\Temp\causmkfcxv.sys
C:\Temp\causmkfcxv.sys
1⤵
PID:4588

C:\Temp\hbzxrpmhfc.sys
C:\Temp\hbzxrpmhfc.sys
1⤵
PID:3764

C:\Temp\pjhecwuomh.sys
C:\Temp\pjhecwuomh.sys
1⤵
PID:5036

C:\Temp\mjebwuomge.sys
C:\Temp\mjebwuomge.sys
1⤵
PID:2264

C:\Temp\bywqoigbyt.sys
C:\Temp\bywqoigbyt.sys
1⤵
PID:4524

C:\Temp\lgdyvqoiga.sys
C:\Temp\lgdyvqoiga.sys
1⤵
PID:2380

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dbvtqlidyv.exe

Path C:\Temp\dbvtqlidyv.exe
Size 384KB
SHA256 ab00cb7b2d596a8a3e73d743a707d0109b255804b84d380df3c7e9ce7462392a
MD5 5ee3c9e2257dbae8091312131d2eb8c0
SHA1 c79d76ed78040b9b3eb92556ee36932bdeaa00fc
SHA512 e161436d41ffc2bc55874016976a43e2d5dd2bebaf44f8259abdaa393d600bb41a52fde8020ce17eb6791f31f89a792858ccb3829e194322ca149fc5a2ce56cc
SSDEEP 3072:q9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:QctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C9847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

etolgdbztrojgeyw.exe

Path C:\Temp\etolgdbztrojgeyw.exe
Size 384KB
SHA256 db5ff7251a12a2b9d81f9162483f19b56a2fd4ea3b44a3e19c9e03213c632cfc
MD5 145b91a494c96119d49b963d9eba7cd3
SHA1 bcb8266352cab6c6b2dd5a7438f6a388a6d8e4f4
SHA512 e79ac31272c00150e071933854171e56321bd786d430d8da0fd3813c8cbc8858f114491a7eb4880686ad1ebcfe632a6b019ef8f7ab2b0c106800035a738dc7e3
SSDEEP 3072:J9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:jctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A0847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

etolgdbztrojgeyw.sys

Path C:\Temp\etolgdbztrojgeyw.sys
Size 293KB
SHA256 db78017c941da0fe049875bf8fc207d04d607b7eb437ca69c0dfa4e863f5c84c
MD5 017d6a0a50b1cdff424f65390dd9da0b
SHA1 6332765a0fe8fd7bf26359982c8d2232c2443147
SHA512 54bb28da7300b72fc17223e5cf2fc01bee1b773eb179ae32f1d456103fff276ea70c23c7b658f36fa8ea810f52b8eff233a52384f5465f938a03d1e18b4d0a1c
SSDEEP 3072:vtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:vIJjiJcbI03GBc3ucY5DCSj
TLSH
T1DF545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbywolgdbt.exe

Path C:\Temp\gbywolgdbt.exe
Size 384KB
SHA256 9a70dd1cad4f44530f792a3d16da986ff387c5976e066c6300dec3da9ca587fc
MD5 a80be96da230dc1b11c30331c97620d7
SHA1 c1eecb040e984527f893138f8c06e30ca911a14a
SHA512 3fce264fb300739cc11511d063b60819fc761ce7b091fa1c7af658a9674dec40e7629c9c161eeca3e8ca15d02df8bbceed5f20d8d23d77d282588f8a4dcd16d0
SSDEEP 3072:+9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:cctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T106847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dbvtqlidyv.exe

Path C:\Temp\i_dbvtqlidyv.exe
Size 384KB
SHA256 8c778a99877f6fc5d6a0dbe4c6cfe8d2176acdc4d02316e4f72842ed0c2c1835
MD5 11a1b493e486a919fd689beddff2e7af
SHA1 1c8177765deb6e9107e5bd9a9184bd95e9366cbf
SHA512 6689eee299fbf72aa92d08ce6948c4c898745e802a46c1a6cb2a2aeb9c611b88386525a3838e770b7c6b3a3210576f322005628e63baab83f36cc09410a6cd26
SSDEEP 3072:Y9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:actFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T17B847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gbywolgdbt.exe

Path C:\Temp\i_gbywolgdbt.exe
Size 384KB
SHA256 67e7f1fe98e1f18575b970d179ba3d028abeb85d6f25cd24564385bb7ad6113d
MD5 f7045369e967583dd8b768c6b3113682
SHA1 0355ba74457ade2774e9b2c5270c919de04c7c4b
SHA512 8cf83e8e9dc74020e2acfa6de526c90dca577c516fe507796bf14c585ee2baaad3ed2a79f71c9bef45631cee4afae1fd4c995a8b13d0b8963fbc87017a133ee2
SSDEEP 3072:p9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:DctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E1847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nhfdausmkf.exe

Path C:\Temp\i_nhfdausmkf.exe
Size 384KB
SHA256 fb4aba807c5520d105b3ec37bdb0fce07e12b4eb2280e9350aa3459fe1b4f763
MD5 c919841e2e6fbee7e902520a0106b746
SHA1 6d2c77fa346a24a6ff95b2fa31fb86b441099651
SHA512 ff77eb0394978cd5ed6b512a428e4805cd7dd142e5b1ee96e0a4b8a765418822da9c9e0f6df8775d2dcdacd061b5f6337b9e344ffba3b6d7aa2137faccae8dca
SSDEEP 3072:E9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:ectFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T10B847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vtnlfdxvqn.exe

Path C:\Temp\i_vtnlfdxvqn.exe
Size 384KB
SHA256 6aaa021e7935b77709b5263cf61b022faabe0fce7516b55975139be0cba18e2a
MD5 322a44f8e4347590316180782f43f5b6
SHA1 21c7ddd03a449c2adc1ef0cf9b981ed70334e536
SHA512 73e2b1f87384d728303c6b4b4673cd07d502841b91d5537dce62e4381148909c4aa741a8f38aa81633c088d79d0f34cf212895c1a68090fa70395c04f30efccc
SSDEEP 3072:A9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:SctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T117847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_yvqoigaytq.exe

Path C:\Temp\i_yvqoigaytq.exe
Size 384KB
SHA256 740ab4ea8e7bea88b08b7fd26881beb671a3b50ffbc20ed03d05a198efc74a03
MD5 59e5e9b5bef4cdd5c75140d8cc7f13a2
SHA1 10d63f925a9fc5e729b15c37b2c63268261970a8
SHA512 b2b91d1515dc0fc5fba7e8f0a9dfd35bbbb1c77100076f1270ec8edf3fbb80a59c94fa43c0c412c1461b8f5db07468f9e7e0a678acdf5f878c10b04367cd3101
SSDEEP 3072:G9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:0ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T19D847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igaysqliga.sys

Path C:\Temp\igaysqliga.sys
Size 293KB
SHA256 594d43b44f6685fc4b450f2bd3f4ce9d303e2e272593f5e971acf78d0df17fa3
MD5 6438f767bbf9e215c07f9c3b52e70242
SHA1 0615ae6924acf96055e9705d846704891e67c9bc
SHA512 a2beab91d455f770a98d7a538ab656f8b50421b3ae4d65603a940305e18b0071776b011e5f4e02de93d93e7f46f285a86d8d9eef1cdc7f110e8dac44a9cb2ac6
SSDEEP 3072:HtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:HIJjiJcbI03GBc3ucY5DCSj
TLSH
T1F9545B44AAA4B0F6D9D5043C00EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nhfdausmkf.exe

Path C:\Temp\nhfdausmkf.exe
Size 384KB
SHA256 668d83a627ed67c5233086185ea785099170759ffc0a440f8bbc04742de2eb1d
MD5 41a1221517204b6898e404828b3d0299
SHA1 73d4e299193ba4ef8ee0bda9b4e234a3d65047a8
SHA512 a73ddfff172a279d04a64d9457998cf607233eb899bb1d55a1640fd65658a2d531d07064260018066cf2a681c87dcade08ed86acd0cb6663a9ab0dea6f215513
SSDEEP 3072:n9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:9ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T17E847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omgeywqojg.sys

Path C:\Temp\omgeywqojg.sys
Size 293KB
SHA256 65879211aee3d6ac5e6a72a8285f7d35900e5547fe0c3f14871d86f3353b1ea1
MD5 437879170af8a3894edd160066429e08
SHA1 97e5408a5af4d103840a981b81cebc0aa2d352f9
SHA512 fb5ebc6d2c9114a18a3c0e011417db158ccdfeb5a6fd77b3013ba6e99eb9d04e6663161ddf54878380f8630b6a926f4579413ec52f958d5b76aacdf3256e49a9
SSDEEP 3072:PtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:PIJjiJcbI03GBc3ucY5DCSj
TLSH
T175545B44AAA4B0F6D9D5043C00EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmkhcausmk.exe

Path C:\Temp\pmkhcausmk.exe
Size 384KB
SHA256 6a06c54a53cc26abbc3e237abdd455be917796c2ed236f7a05070fcbd0f7f836
MD5 86f808b1cb1ebbcb52c31ba097858c8f
SHA1 381be1d6aa1df17cbad8a660fb8cf9aadebcf032
SHA512 175ae94753cfb45b413e3c1c6bd959f74f80dd502df74eb5a8f34c00ccd7ee2699ef37794cae19847767662a0a6c8c0a52422690e4edbd57bc2e9f014c885ecd
SSDEEP 3072:d9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:vctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D2847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spkhfaxvpn.sys

Path C:\Temp\spkhfaxvpn.sys
Size 293KB
SHA256 db2236481112d331c9f27bdc5fde28184eda7c26ccec3faace13ed8e46f7d841
MD5 698c43add886e2e2a278e0704d4bf8a3
SHA1 91a67a2628c36bdad9a2d13a07cd363bf0f31574
SHA512 8687f8f7787854e9f5c90968a71eb27480f431defb33e1d842e8cc99e8df3a7383bdad1d5311b03472fb18e128bb2c7891776f6925d342225fa7adcb17189d61
SSDEEP 3072:ktKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:kIJjiJcbI03GBc3ucY5DCSj
TLSH
T11E545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spnkicausm.sys

Path C:\Temp\spnkicausm.sys
Size 293KB
SHA256 a135e987fb725a3b378c21d1dc7d9d8b50b4390b4417ce206f4129244b89cc09
MD5 6d3aef24c8426ecbea1ff3301d52c637
SHA1 0877124a83aa1889ee50b4b73adb76b2d0eff3ef
SHA512 a38951a02dd1cc018b3145f87c5a191cb72e7e6e2e2335b4e81a71b58b034031f9805eeb0c6cfb71c3e5bacf0dcc96c8ad2f0c1592b8c267c1aef07785841ccb
SSDEEP 3072:stKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:sIJjiJcbI03GBc3ucY5DCSj
TLSH
T127545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtnlfdxvqn.exe

Path C:\Temp\vtnlfdxvqn.exe
Size 384KB
SHA256 ce989b126a4a407dd453ef0e69c23d0c526d1e8a371f137b0731b257d54fee1c
MD5 471098d89586b25618090bad3f5a94c9
SHA1 9ab1f0de52fbef140d4ebf6d1062d7e3542adcb9
SHA512 b2b7d0c3f394f7c15f1ff7765549b13fc3a110382de3e2dd271d5d832fc3f1cca863aae826bdf67c1fd84dd3e15dc41bfaf6d89070002af28c075ec44ef072db
SSDEEP 3072:H9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:dctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T103847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ysqkicavsn.sys

Path C:\Temp\ysqkicavsn.sys
Size 293KB
SHA256 d7beae8ee3ed36f3b08da6c1c0c25268e3a7fec28f82ec37722bd8a505035e29
MD5 8c22bde0d82033dafa661a2207a98382
SHA1 6b564cc45e0e1d4c6c9bdca77f42960c17324fe9
SHA512 ff19217facab1eba8f6cee6014ec9bbfe7d11e56f33d875320c4bc555ba771de4476d77d5d52a36dd16848883c82c7155e3ed58d0b35199e487e16c1cd544920
SSDEEP 3072:ktKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:kIJjiJcbI03GBc3ucY5DCSj
TLSH
T193545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yvqoigaytq.exe

Path C:\Temp\yvqoigaytq.exe
Size 384KB
SHA256 269a9cb6af905b770dd739593a4c0b68e680ed425e4f904cd96ce7e80a78db5c
MD5 6ee0a4cbd1513c85230eb8cc001146dc
SHA1 17569cbb11b14326131e8d344795f97455d5423a
SHA512 0cfe470b0a037047712124f76f3866f5614938d798dd49e7bf72797a7fa8d254beeb8c5aa63097195fe7a05d72274776b6ab7a742849fd074ff03cba883c5e90
SSDEEP 3072:+9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:cctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T148847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dfacefa73d018d54e3feba3eef28ec722a8422fee8768a2c3d8d6253f863b375
MD5 cb5000b6fab1115bfff50bedcc3eb9fd
SHA1 afbfe0ec03df59e7a1eba1da4227111508419c03
SHA512 aab9a1afd5de2f983466724b6ecf0dbc2e176c5a1eb2f059b9507511cc53643fcf9ed990bd565f22f8d53fb82db71cba238962a75c68db02d5f10b526661bd08
TLSH
T15AD09B667354991CC9C439712462565161015820941443581D96B16CCDE56C707561DA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecdd5c8034c45eff453cbaf31d8886e2bd9609a73853367a6d096a69cc81f1be
MD5 a774534a956a5c8affebe08e87c80683
SHA1 b3e4e20a91e4087d3b9247b5ef6815f51858a041
SHA512 27769aee2cac148a0154fe42b51da2a9a1088e9e990873915b4c7ab9bd5442a3facf82b2bd1cbaef75328bd5937813698b96ac06aa76d934d07ab5ebb194a824
TLSH
T103D09B6673449A1CC9C439712461565161115820E41443581C96715CCDE56C707571DE
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a94c40aa71968dd8468d4c6036d0091046ae18be69b726aeea70a563f661325b
MD5 a584ce7ca53e718033b582dc18f88bbb
SHA1 a17ba3e6f986e7cc594b4047255c2010e8ecde12
SHA512 6389addb0c0d26e94091a68ecb52ccb8198bf3b4c1d9175bf99367fe77431a528add72c698071a30a7aceae31848520163461ccc52e9ca75413695493f72ede7
TLSH
T162615F41831A19EDD7A788B1AFD0974833F19671EBC3AE55A0412CF05B67F3493DA017
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59a7fe.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59a7fe.TMP
Size 3KB
SHA256 9fb6fdfd69917fcda21231070b468eb52fd39f089e5afab4efc06aa00fc34f5a
MD5 9034c6389b873d6387fd0a8129b6f7f5
SHA1 07716b96553534b9e73edeb6c1fbcade99c522f2
SHA512 5c7464fd0116ca1ae7a85ef698ed800cb3423575e520b82f5a09fcfc22ccf9e22c19b18d5013d85b59271218510c5a14870a9d2a386c9c34f17bdb7f112d579a
TLSH
T120616041831A19EDD7A788B1AFD0974833F196B1EBC3AE55A0412CF05B67F3493DA017
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 80f5a4c2d50c0da5f6fb633439ffd88e0c62617e4cae2dcdd62fb0bf38ee1a06
MD5 da9f8d09d372b209f15e10a182ae5106
SHA1 8c3c6898fed9a66e908c4dd81156c9131411c130
SHA512 b560684b60b5dd45c3b1e1bced48b08faf88593dd35427b68307999fe2568cac4014c11ae24ca23fb72db4479f54501d119692a69c035a0c075482784f827e16
TLSH
T13E418CF383E4866EC91156F0AA187E2BCE1D0915832C3D5AC9E4AE5BA3E2871E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 dde6f722547219eb97928a427bf7f6e57758686f263dd21836d3552418890125
MD5 84913bde2885ff69927335ffbd3565f9
SHA1 1d3bc8813298b81f5647d1612beb0d2615f2d54f
SHA512 7516677a57e5fe1181fe897ca54fe52b0e0cf4170291fb24ad0581d0d843f50f39be9493ba70706525132347fc0da36b73326d5a2a7e89808dc24b2a77d405e4
SSDEEP 192:sxRwRxyM/jK1Ml8wCf/fIsKTN9mZ/FzoA8pi/g6+WNIYD9a6S7G2gLIgtJ:sxRwR8f/fIsQN9Qgi/5I2SNI3
TLSH
T16752D8056A38593B9CDBD209FA557F93D6F81573A2901E44AAFCCA0C00E6AED2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 a6cd6e57dad22fb97907be5d2d10dee79f402720717da542f27370d077367b06
MD5 7f2b9bd1f06d876a82e2d5c63e1ca605
SHA1 c2c145a2b6b5d73b2d7c43a9187c5dd46473f2f6
SHA512 ea36c4457f7242434e6f313ca5914ddc638e8a566ac503ed1361e4aca5e23124c62d6c9200632903bdb01fb336fa90f5307c9fa2d9ab57715e3eafe5c31b0110
SSDEEP 192:sxRjRxyM/jK1Ml8wCf/fIsITN9mZ/hzoA8p9A/g6+WNCn1/YD916S7G2gLIgDfJ:sxRjj8f/fIsSN9Qky/5U/hSNIl
TLSH
T1CE62EA06AA3459779CDBD209FA557F93D6F81573A2901E48ABFCDA0C00E66ED2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 88f9ccf5ed135002b38e94d0101b372e6d73ffeb7515996001781e097213c314
MD5 5ec0fe4277818394d214a056d8c7fdc6
SHA1 698ac101ece96451a0cc77123f739c2376b85ee9
SHA512 593e25606ee43f4d35b803f5c2d89264f7e1e3803a434b7fa6dccf08fc27d35170559310d02e382b48897a8a733441efc5bd457be69685f62a6ad699497e36f3
SSDEEP 192:sxRjRxyM/jK1Ml8UQKCf/fIsITNAomZ/hzoA8prA/g6+WNCn1/YD9B6S7G2gLIgj:sxRjjqtf/fIsSNAoQkc/5U/nSNIj
TLSH
T17B62D816AA3859779CDBD209FA517F93D6F81573A2901E48AAFCCB0C00E66DD2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 2efbe245a1e3e92051219d0e77b8b9a6b8126e23a0209a01bca31fdad3692cb3
MD5 b589f8704a19b61d0465e4721d33caca
SHA1 738fcdbae0ad3d4018faa2ad8e396e2884bb2701
SHA512 4fd11da2aa63d4cb58ed85710e854ffcde50cef12eb4d12e4a5eb0b60d5fd21ef21274681c209a04672c318d257e20b9788b6fe52846ab410dbe5de7dfe4abcb
SSDEEP 768:aW5WFL7pLuL710Wg/XfCf8F1+UoAYDCx9Tuqh0VfUC9xbog/OVq4Ac1sgro/lDfN:aW5WFdE710Wg/XfCfu1jaN4Aysr/l5
TLSH
T1CAE2EB3B280CCB7E4F444A9CAD297DDAADA801CB96DCCD5447EA840C03C6BEB56165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 8ce700e0053ecc09889ddae4fc074543cf9eccac18807c2c6f8958f1760c58cc
MD5 9772eeba56d12f482303d7e92336a107
SHA1 c9d2c7131346e1554dfd01a406ff385f98992709
SHA512 af1910afa59dbd7db96b43fea6d1870804d0c51c353dd8b53d48282722093ab1bb4bc98fd6600340dd614fc8837d52b03156f08c8eeb3c5b0ee5f5adbafb193c
SSDEEP 96:KREWELEaE2EQE4E4EeWEIEdEFgEWEeK4ErgEEEecE+EWE1E0EmE/HEmE7EKEmEgv:CEWELEaE2EQE4E4E5EIEdEGEWEWErgEk
TLSH
T1D1918785317B4240387E690885E49D5BC6C3B8637068A4AB3FE841668F2BE175EFD4D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

35b59c0c-85e9-40b6-9cad-1017c44e72f7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\35b59c0c-85e9-40b6-9cad-1017c44e72f7.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 07ba210569d8a8804277ca3b12796c37b524cfaa80292b443e3addc4b328ff0e
MD5 773e0213aeb1d1daeee8c423798ffedc
SHA1 a935c6fed0d481d3a23403d1d963fed4cce2a621
SHA512 b674a614976a17d1c8343a2e22e66cf1da3650fe13860f0673041a42816b373d893232cf28ca65bad588dd119112a0d0f4e34f55aebe3f5687a87352f122429e
SSDEEP 768:rrv+4UNbdS3Ami09rEnjN3Gac1ZWseVH1SCz:rbsbg339QnjMaoEH1V
TLSH
T16803CF3669A89AB38CEB9385714776037FF4125386C40BE4CADD6B0D069B5EC130BD67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 c9db3264d50a3275439a13b328594f71e0aa80d31b2766bd28b357e755b1ddcc
MD5 8607e4a7a90dc9ded2ad4b1205360d56
SHA1 5fffcf9cb939a0fc11915ace69a5374285832c3c
SHA512 ad60eb074efca9d083df900def16d1bfc9712087ef1ba7a4f21a077258da65cc337723041717ee454061e6b25c0bb8fcb1ef63ce8816614deaabfda8df4dbe36
SSDEEP 384:nKtNn/s3n9SI38NpECEyRseIaWZlf8hyEGSO1RwOiF1y2rEoajo4cdR8eHhVODj6:Kj+9v37bzi0mrEnjN3Gac1Fvb9Mw
TLSH
T124F2BF3478659EB38CEBD38572477B92AEE017A385C40E98DAD9AB0D05D36EC1707827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 ca21608afbad7b9fa62332f3e12457391332ed287c54f6bb382f51add5a7588c
MD5 3d892c335db5c96455614ab4a6c151b6
SHA1 db48e48244c93724542af98c1b5c51bd0d2d939a
SHA512 7a7d224043a0bf7ba4fecc223d118b31e0d675831ecba863f87da2b6f29c0ace59d7b2017e590df17838c8bd3d3a4e6d3f8074f0e4385b029e652e760f679c26
SSDEEP 384:nTtNn/s3n9SI38NpRCEyRseIaWZlf8hyEGSO1RwOiF1y2rEoajo4cdR8eHhVODj6:Tj+9v3Obzi0mrEnjN3Gac1Fvb9Mw
TLSH
T132F2BF3478659EB38CEBD38572473B92BEE017A385C40E98DAD9AB0D05D36EC1707827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 d0b888fd1546610d6186ddb5112afaff967ee48ffbcf0d78f5394729db55c41c
MD5 8c45f5ee4002a704b8da8dec971b5201
SHA1 5f4362797773358360bb64f566ce3cc5170eabd2
SHA512 cadb03ab561f5d5aff3d8cde8df56c2872c8a7c1638960d44026310d85e8b52e2d3e25aba08d997bd96d81f9da65b90f6cbafb7bf9afcf4167f32d86c5cb3213
SSDEEP 384:nwiF1tNn/s3n9Sq38NL8TUNTUlIlRCEyRsesa4Hf05yEGSO1RwOiFqy2rEoajo4G:LF1j+9x3owg17QsHrEnjN3Gac1Fvb9Mw
TLSH
T1351317F598D78A73D8DE8787637E6E4299BCC2A3B5844994B7C45D0CCC821BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 f2358c2c3eaf70fe2274c17df3fc9e61fc1ea7f65f424fdf9de05068492b4539
MD5 5db588de0591d0dc23772c648f25b359
SHA1 72f27cc90bfbac6e75fbfface2158bc2842959c1
SHA512 af544753b9fb1f62a57c62d3f96f7b31257a557d94ed8c6a162684e5b36c0994eca2ebd6dd04760b84a3e7cf5b060c13c879a6d9b1e2adf53ec61ea082bd57cd
SSDEEP 384:zKtNn/s3n9SI38NpECEyRsTnIaWZlf8hyEGSO1RwOiFDy2rEoajo4cdR8eHhVOD+:Wj+9v37FIzi0arEnjN3Gac1Fvb9Mw
TLSH
T14CF2BF3478659EB38CEBD38572477B93BEE016A385C40E98DAD9AB0D05D36EC1707827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1940_456328906\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 015311357f2d8d9e0aca35ff9962a2f2ad89d9924540e7d92abd3b07be184a93
MD5 610379d61cc7a7d043e8e7e5ccbf01f7
SHA1 8da73bbfa6bb6bae5184886d4b8335274c63f13c
SHA512 c58822dd2a224f2222db2a7cca7e30320cd96eb59bc776614799993d755e32bec7d1e2004bd2dcd7dc49fe4e9f6f40e2c419a495c8028ff48c389bfbe70d52bf
TLSH
T17F71238357B8C5B3C2DA5FF002835604F5FB22380B2370340B915546AB30A7E28B8F48
MD5 SHA1 SHA512 TLSH

Submit Download

memory/908-332-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1088-291-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1512-194-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2056-305-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2264-426-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2380-442-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3640-392-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3764-417-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3900-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4324-355-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4444-409-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4524-430-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4588-413-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4860-405-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5008-271-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5036-422-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5612-351-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5648-380-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5752-336-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6076-241-0x0000000000010000-0x00000000000AB000-memory.dmp

Download