systex | 7053911a9d77f2e26fc4a1cdaddb7f3a2af2f9fb9faa2fce8b153752070eb903

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 09:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_918962f2f94f99d4b3cd9c634fa52c6c_amadey_darkgate_elex_smoke-loader_stop.exe
Size 384KB
Sample260715-lp2tmact9x
SHA256 7053911a9d77f2e26fc4a1cdaddb7f3a2af2f9fb9faa2fce8b153752070eb903
MD5 918962f2f94f99d4b3cd9c634fa52c6c
SHA1 774de880eaae6688c036fdc8f63f39d5750601ec
SHA512 5cc2b30d47a7cfcb8719f469302d10a5d02c275830074ae38c4a5fa8d9eeb2fd5a032291bd5752e45d03b558301135aca6b60039f35ccf888c5a6b577c3583bf
SSDEEP 3072:x9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:7ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1AF847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
2388	czurpmkecwusmjhf.exe
4440	czurpmkecwusmjhf.sys
2852	CreateProcess.exe
4812	pkhbzxrpmh.exe
2400	CreateProcess.exe
5040	CreateProcess.exe
4904	i_pkhbzxrpmh.exe
5500	ezwrojhbzw.sys
6076	CreateProcess.exe
1148	wrojgbzurm.exe
424	CreateProcess.exe
2084	CreateProcess.exe
3724	i_wrojgbzurm.exe
2336	zwromjebwu.sys
3732	CreateProcess.exe
3232	jgeywqojgz.exe
3780	CreateProcess.exe
4088	CreateProcess.exe
1112	i_jgeywqojgz.exe
428	jgeywrljgb.sys
4272	CreateProcess.exe
5544	bywqojdywt.exe
2828	CreateProcess.exe
1720	CreateProcess.exe
3660	i_bywqojdywt.exe
1636	bvtnljdbvt.sys
2668	CreateProcess.exe
5400	sqlidbvtqi.exe
2684	CreateProcess.exe
3052	CreateProcess.exe
2056	i_sqlidbvtqi.exe
1724	dxvtnlfdyv.sys
3944	CreateProcess.exe
4536	vtnlfdxvpn.exe
5428	CreateProcess.exe
6124	CreateProcess.exe
2520	i_vtnlfdxvpn.exe
4416	fdxnhfaxsp.sys
5760	CreateProcess.exe
4512	qnifaxspki.exe
5956	CreateProcess.exe
2464	CreateProcess.exe
264	i_qnifaxspki.exe
108	usqkicausm.sys
6100	CreateProcess.exe
4992	fzxsmkhcau.exe
2036	CreateProcess.exe
2436	CreateProcess.exe
4140	i_fzxsmkhcau.exe
5512	zurpmhfzxu.sys
2468	CreateProcess.exe
3060	xrpjhczusp.exe
4780	CreateProcess.exe
868	CreateProcess.exe
4824	i_xrpjhczusp.exe
5860	hezxrpjhez.sys
3208	CreateProcess.exe
5424	ebztrpjhez.exe
3856	CreateProcess.exe
3316	CreateProcess.exe
108	i_ebztrpjhez.exe
3368	bywuomgezw.sys
5520	CreateProcess.exe
2184	ztrljebwto.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4860_1907124143\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4860_2089783910\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4860_2089783910\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4860_844250082\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4860_2000963084\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4860_1907124143\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4860_844250082\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4860_844250082\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4860_844250082\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqlidbvtqi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnlfdxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebztrpjhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kecxupnhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnlfdaysql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kecxupnhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hecwurpkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bywqojdywt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bywqojdywt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxsmkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpjhczusp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnlgbytrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifaxspkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hecwurpkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnljdbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pkhbzxrpmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrojgbzurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnifaxspki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnlgbytrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhbztrmjeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrojgbzurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgeywqojgz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhbztrmjeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pkhbzxrpmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnifaxspki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnljdbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkfdxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifaxspkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_918962f2f94f99d4b3cd9c634fa52c6c_amadey_darkgate_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqlidbvtqi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpjhczusp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebztrpjhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztrljebwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkfdxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czurpmkecwusmjhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxsmkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztrljebwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnlfdaysql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlfdxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgeywqojgz.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3292	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5744	ipconfig.exe
3856	ipconfig.exe
5896	ipconfig.exe
3612	ipconfig.exe
1068	ipconfig.exe
5492	ipconfig.exe
3196	ipconfig.exe
5484	ipconfig.exe
4212	ipconfig.exe
6000	ipconfig.exe
4140	ipconfig.exe
4312	ipconfig.exe
5676	ipconfig.exe
2368	ipconfig.exe
3060	ipconfig.exe
1132	ipconfig.exe
4364	ipconfig.exe
4940	ipconfig.exe
4876	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134285822120287185"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2301830172-776172150-2531349243-1000\{8CBBE592-8268-4B15-AEE1-BAC11257A9D8}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5872	2026-07-15_918962f2f94f99d4b3cd9c634fa52c6c_amadey_darkgate_elex_smoke-loader_stop.exe
5872	2026-07-15_918962f2f94f99d4b3cd9c634fa52c6c_amadey_darkgate_elex_smoke-loader_stop.exe
5872	2026-07-15_918962f2f94f99d4b3cd9c634fa52c6c_amadey_darkgate_elex_smoke-loader_stop.exe
5872	2026-07-15_918962f2f94f99d4b3cd9c634fa52c6c_amadey_darkgate_elex_smoke-loader_stop.exe
5872	2026-07-15_918962f2f94f99d4b3cd9c634fa52c6c_amadey_darkgate_elex_smoke-loader_stop.exe
5872	2026-07-15_918962f2f94f99d4b3cd9c634fa52c6c_amadey_darkgate_elex_smoke-loader_stop.exe
5872	2026-07-15_918962f2f94f99d4b3cd9c634fa52c6c_amadey_darkgate_elex_smoke-loader_stop.exe
5872	2026-07-15_918962f2f94f99d4b3cd9c634fa52c6c_amadey_darkgate_elex_smoke-loader_stop.exe
5872	2026-07-15_918962f2f94f99d4b3cd9c634fa52c6c_amadey_darkgate_elex_smoke-loader_stop.exe
5872	2026-07-15_918962f2f94f99d4b3cd9c634fa52c6c_amadey_darkgate_elex_smoke-loader_stop.exe
5872	2026-07-15_918962f2f94f99d4b3cd9c634fa52c6c_amadey_darkgate_elex_smoke-loader_stop.exe
5872	2026-07-15_918962f2f94f99d4b3cd9c634fa52c6c_amadey_darkgate_elex_smoke-loader_stop.exe
5872	2026-07-15_918962f2f94f99d4b3cd9c634fa52c6c_amadey_darkgate_elex_smoke-loader_stop.exe
5872	2026-07-15_918962f2f94f99d4b3cd9c634fa52c6c_amadey_darkgate_elex_smoke-loader_stop.exe
5872	2026-07-15_918962f2f94f99d4b3cd9c634fa52c6c_amadey_darkgate_elex_smoke-loader_stop.exe
5872	2026-07-15_918962f2f94f99d4b3cd9c634fa52c6c_amadey_darkgate_elex_smoke-loader_stop.exe
5872	2026-07-15_918962f2f94f99d4b3cd9c634fa52c6c_amadey_darkgate_elex_smoke-loader_stop.exe
5872	2026-07-15_918962f2f94f99d4b3cd9c634fa52c6c_amadey_darkgate_elex_smoke-loader_stop.exe
5872	2026-07-15_918962f2f94f99d4b3cd9c634fa52c6c_amadey_darkgate_elex_smoke-loader_stop.exe
5872	2026-07-15_918962f2f94f99d4b3cd9c634fa52c6c_amadey_darkgate_elex_smoke-loader_stop.exe
5872	2026-07-15_918962f2f94f99d4b3cd9c634fa52c6c_amadey_darkgate_elex_smoke-loader_stop.exe
5872	2026-07-15_918962f2f94f99d4b3cd9c634fa52c6c_amadey_darkgate_elex_smoke-loader_stop.exe
5872	2026-07-15_918962f2f94f99d4b3cd9c634fa52c6c_amadey_darkgate_elex_smoke-loader_stop.exe
5872	2026-07-15_918962f2f94f99d4b3cd9c634fa52c6c_amadey_darkgate_elex_smoke-loader_stop.exe
5872	2026-07-15_918962f2f94f99d4b3cd9c634fa52c6c_amadey_darkgate_elex_smoke-loader_stop.exe
5872	2026-07-15_918962f2f94f99d4b3cd9c634fa52c6c_amadey_darkgate_elex_smoke-loader_stop.exe
5872	2026-07-15_918962f2f94f99d4b3cd9c634fa52c6c_amadey_darkgate_elex_smoke-loader_stop.exe
5872	2026-07-15_918962f2f94f99d4b3cd9c634fa52c6c_amadey_darkgate_elex_smoke-loader_stop.exe
5872	2026-07-15_918962f2f94f99d4b3cd9c634fa52c6c_amadey_darkgate_elex_smoke-loader_stop.exe
5872	2026-07-15_918962f2f94f99d4b3cd9c634fa52c6c_amadey_darkgate_elex_smoke-loader_stop.exe
5872	2026-07-15_918962f2f94f99d4b3cd9c634fa52c6c_amadey_darkgate_elex_smoke-loader_stop.exe
5872	2026-07-15_918962f2f94f99d4b3cd9c634fa52c6c_amadey_darkgate_elex_smoke-loader_stop.exe
5872	2026-07-15_918962f2f94f99d4b3cd9c634fa52c6c_amadey_darkgate_elex_smoke-loader_stop.exe
5872	2026-07-15_918962f2f94f99d4b3cd9c634fa52c6c_amadey_darkgate_elex_smoke-loader_stop.exe
5872	2026-07-15_918962f2f94f99d4b3cd9c634fa52c6c_amadey_darkgate_elex_smoke-loader_stop.exe
5872	2026-07-15_918962f2f94f99d4b3cd9c634fa52c6c_amadey_darkgate_elex_smoke-loader_stop.exe
5872	2026-07-15_918962f2f94f99d4b3cd9c634fa52c6c_amadey_darkgate_elex_smoke-loader_stop.exe
5872	2026-07-15_918962f2f94f99d4b3cd9c634fa52c6c_amadey_darkgate_elex_smoke-loader_stop.exe
5872	2026-07-15_918962f2f94f99d4b3cd9c634fa52c6c_amadey_darkgate_elex_smoke-loader_stop.exe
5872	2026-07-15_918962f2f94f99d4b3cd9c634fa52c6c_amadey_darkgate_elex_smoke-loader_stop.exe
5872	2026-07-15_918962f2f94f99d4b3cd9c634fa52c6c_amadey_darkgate_elex_smoke-loader_stop.exe
5872	2026-07-15_918962f2f94f99d4b3cd9c634fa52c6c_amadey_darkgate_elex_smoke-loader_stop.exe
5872	2026-07-15_918962f2f94f99d4b3cd9c634fa52c6c_amadey_darkgate_elex_smoke-loader_stop.exe
5872	2026-07-15_918962f2f94f99d4b3cd9c634fa52c6c_amadey_darkgate_elex_smoke-loader_stop.exe
5872	2026-07-15_918962f2f94f99d4b3cd9c634fa52c6c_amadey_darkgate_elex_smoke-loader_stop.exe
5872	2026-07-15_918962f2f94f99d4b3cd9c634fa52c6c_amadey_darkgate_elex_smoke-loader_stop.exe
5872	2026-07-15_918962f2f94f99d4b3cd9c634fa52c6c_amadey_darkgate_elex_smoke-loader_stop.exe
5872	2026-07-15_918962f2f94f99d4b3cd9c634fa52c6c_amadey_darkgate_elex_smoke-loader_stop.exe
5872	2026-07-15_918962f2f94f99d4b3cd9c634fa52c6c_amadey_darkgate_elex_smoke-loader_stop.exe
5872	2026-07-15_918962f2f94f99d4b3cd9c634fa52c6c_amadey_darkgate_elex_smoke-loader_stop.exe
2388	czurpmkecwusmjhf.exe
5872	2026-07-15_918962f2f94f99d4b3cd9c634fa52c6c_amadey_darkgate_elex_smoke-loader_stop.exe
5872	2026-07-15_918962f2f94f99d4b3cd9c634fa52c6c_amadey_darkgate_elex_smoke-loader_stop.exe
2388	czurpmkecwusmjhf.exe
2388	czurpmkecwusmjhf.exe
5872	2026-07-15_918962f2f94f99d4b3cd9c634fa52c6c_amadey_darkgate_elex_smoke-loader_stop.exe
2388	czurpmkecwusmjhf.exe
5872	2026-07-15_918962f2f94f99d4b3cd9c634fa52c6c_amadey_darkgate_elex_smoke-loader_stop.exe
2388	czurpmkecwusmjhf.exe
2388	czurpmkecwusmjhf.exe
5872	2026-07-15_918962f2f94f99d4b3cd9c634fa52c6c_amadey_darkgate_elex_smoke-loader_stop.exe
5872	2026-07-15_918962f2f94f99d4b3cd9c634fa52c6c_amadey_darkgate_elex_smoke-loader_stop.exe
2388	czurpmkecwusmjhf.exe
2388	czurpmkecwusmjhf.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	4904	i_pkhbzxrpmh.exe
Token: SeDebugPrivilege	3724	i_wrojgbzurm.exe
Token: SeDebugPrivilege	1112	i_jgeywqojgz.exe
Token: SeDebugPrivilege	3660	i_bywqojdywt.exe
Token: SeDebugPrivilege	2056	i_sqlidbvtqi.exe
Token: SeDebugPrivilege	2520	i_vtnlfdxvpn.exe
Token: SeDebugPrivilege	264	i_qnifaxspki.exe
Token: SeDebugPrivilege	4140	i_fzxsmkhcau.exe
Token: SeDebugPrivilege	4824	i_xrpjhczusp.exe
Token: SeDebugPrivilege	108	i_ebztrpjhez.exe
Token: SeDebugPrivilege	2460	i_ztrljebwto.exe
Token: SeDebugPrivilege	4336	i_tnlgbytrlj.exe
Token: SeDebugPrivilege	1776	i_vtnljdbvtn.exe
Token: SeDebugPrivilege	5796	i_qnlfdaysql.exe
Token: SeDebugPrivilege	856	i_nkfdxvpnhf.exe
Token: SeDebugPrivilege	6048	i_ifaxspkica.exe
Token: SeDebugPrivilege	5064	i_kecxupnhfz.exe
Token: SeDebugPrivilege	1712	i_hecwurpkec.exe
Token: SeDebugPrivilege	4600	i_jhbztrmjeb.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4860	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5872 wrote to memory of 2388	5872	2026-07-15_918962f2f94f99d4b3cd9c634fa52c6c_amadey_darkgate_elex_smoke-loader_stop.exe	87
PID 5872 wrote to memory of 4672	5872	2026-07-15_918962f2f94f99d4b3cd9c634fa52c6c_amadey_darkgate_elex_smoke-loader_stop.exe	88
PID 4672 wrote to memory of 4860	4672	iexplore.exe	89
PID 4860 wrote to memory of 4884	4860	msedge.exe	90
PID 4860 wrote to memory of 3292	4860	msedge.exe	91
PID 4860 wrote to memory of 5868	4860	msedge.exe	92
PID 4860 wrote to memory of 2624	4860	msedge.exe	93
PID 4860 wrote to memory of 5868	4860	msedge.exe	92
PID 4860 wrote to memory of 5868	4860	msedge.exe	92
PID 4860 wrote to memory of 2624	4860	msedge.exe	93
PID 4860 wrote to memory of 2616	4860	msedge.exe	95
PID 4860 wrote to memory of 2616	4860	msedge.exe	95
PID 4860 wrote to memory of 2616	4860	msedge.exe	95
PID 4860 wrote to memory of 3444	4860	msedge.exe	96
PID 4860 wrote to memory of 3444	4860	msedge.exe	96
PID 4860 wrote to memory of 3444	4860	msedge.exe	96
PID 4860 wrote to memory of 2688	4860	msedge.exe	97
PID 4860 wrote to memory of 2688	4860	msedge.exe	97
PID 4860 wrote to memory of 2688	4860	msedge.exe	97
PID 4860 wrote to memory of 2860	4860	msedge.exe	98
PID 4860 wrote to memory of 2860	4860	msedge.exe	98
PID 4860 wrote to memory of 2860	4860	msedge.exe	98
PID 4860 wrote to memory of 3188	4860	msedge.exe	100
PID 4860 wrote to memory of 3188	4860	msedge.exe	100
PID 2388 wrote to memory of 2852	2388	czurpmkecwusmjhf.exe	103
PID 4812 wrote to memory of 2400	4812	pkhbzxrpmh.exe	106
PID 4860 wrote to memory of 548	4860	msedge.exe	109
PID 4860 wrote to memory of 1448	4860	msedge.exe	110
PID 4860 wrote to memory of 548	4860	msedge.exe	109
PID 4860 wrote to memory of 1448	4860	msedge.exe	110
PID 4860 wrote to memory of 4256	4860	msedge.exe	112
PID 4860 wrote to memory of 4112	4860	msedge.exe	114
PID 4860 wrote to memory of 4112	4860	msedge.exe	114
PID 4860 wrote to memory of 4188	4860	msedge.exe	116
PID 4860 wrote to memory of 4188	4860	msedge.exe	116
PID 2388 wrote to memory of 5040	2388	czurpmkecwusmjhf.exe	117
PID 2388 wrote to memory of 6076	2388	czurpmkecwusmjhf.exe	121
PID 1148 wrote to memory of 424	1148	wrojgbzurm.exe	123
PID 2388 wrote to memory of 2084	2388	czurpmkecwusmjhf.exe	126
PID 4860 wrote to memory of 2564	4860	msedge.exe	130
PID 4860 wrote to memory of 2564	4860	msedge.exe	130
PID 4860 wrote to memory of 2564	4860	msedge.exe	130
PID 2388 wrote to memory of 3732	2388	czurpmkecwusmjhf.exe	131
PID 3232 wrote to memory of 3780	3232	jgeywqojgz.exe	133
PID 4860 wrote to memory of 3564	4860	msedge.exe	136
PID 4860 wrote to memory of 3564	4860	msedge.exe	136
PID 4860 wrote to memory of 3564	4860	msedge.exe	136
PID 2388 wrote to memory of 4088	2388	czurpmkecwusmjhf.exe	137
PID 2388 wrote to memory of 4272	2388	czurpmkecwusmjhf.exe	142
PID 5544 wrote to memory of 2828	5544	bywqojdywt.exe	144
PID 4860 wrote to memory of 2476	4860	msedge.exe	147
PID 4860 wrote to memory of 3368	4860	msedge.exe	148
PID 4860 wrote to memory of 4992	4860	msedge.exe	149
PID 2388 wrote to memory of 1720	2388	czurpmkecwusmjhf.exe	150
PID 2388 wrote to memory of 2668	2388	czurpmkecwusmjhf.exe	154
PID 5400 wrote to memory of 2684	5400	sqlidbvtqi.exe	156
PID 2388 wrote to memory of 3052	2388	czurpmkecwusmjhf.exe	159
PID 2388 wrote to memory of 3944	2388	czurpmkecwusmjhf.exe	163
PID 4536 wrote to memory of 5428	4536	vtnlfdxvpn.exe	165
PID 2388 wrote to memory of 6124	2388	czurpmkecwusmjhf.exe	168
PID 2388 wrote to memory of 5760	2388	czurpmkecwusmjhf.exe	172
PID 4512 wrote to memory of 5956	4512	qnifaxspki.exe	174
PID 4860 wrote to memory of 5840	4860	msedge.exe	177
PID 4860 wrote to memory of 5840	4860	msedge.exe	177

C:\Users\Admin\AppData\Local\Temp\2026-07-15_918962f2f94f99d4b3cd9c634fa52c6c_amadey_darkgate_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_918962f2f94f99d4b3cd9c634fa52c6c_amadey_darkgate_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5872
- C:\Temp\czurpmkecwusmjhf.exe
  C:\Temp\czurpmkecwusmjhf.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2388
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pkhbzxrpmh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2852
  - - C:\Temp\pkhbzxrpmh.exe
      C:\Temp\pkhbzxrpmh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4812
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2400
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3060
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pkhbzxrpmh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5040
  - - C:\Temp\i_pkhbzxrpmh.exe
      C:\Temp\i_pkhbzxrpmh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4904
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wrojgbzurm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6076
  - - C:\Temp\wrojgbzurm.exe
      C:\Temp\wrojgbzurm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1148
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:424
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1068
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wrojgbzurm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2084
  - - C:\Temp\i_wrojgbzurm.exe
      C:\Temp\i_wrojgbzurm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3724
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jgeywqojgz.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3732
  - - C:\Temp\jgeywqojgz.exe
      C:\Temp\jgeywqojgz.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3232
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3780
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5492
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jgeywqojgz.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4088
  - - C:\Temp\i_jgeywqojgz.exe
      C:\Temp\i_jgeywqojgz.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1112
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bywqojdywt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4272
  - - C:\Temp\bywqojdywt.exe
      C:\Temp\bywqojdywt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5544
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2828
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5744
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bywqojdywt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1720
  - - C:\Temp\i_bywqojdywt.exe
      C:\Temp\i_bywqojdywt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3660
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqlidbvtqi.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2668
  - - C:\Temp\sqlidbvtqi.exe
      C:\Temp\sqlidbvtqi.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5400
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2684
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6000
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqlidbvtqi.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3052
  - - C:\Temp\i_sqlidbvtqi.exe
      C:\Temp\i_sqlidbvtqi.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2056
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtnlfdxvpn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3944
  - - C:\Temp\vtnlfdxvpn.exe
      C:\Temp\vtnlfdxvpn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4536
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5428
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1132
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtnlfdxvpn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6124
  - - C:\Temp\i_vtnlfdxvpn.exe
      C:\Temp\i_vtnlfdxvpn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2520
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qnifaxspki.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5760
  - - C:\Temp\qnifaxspki.exe
      C:\Temp\qnifaxspki.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4512
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5956
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3856
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qnifaxspki.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2464
  - - C:\Temp\i_qnifaxspki.exe
      C:\Temp\i_qnifaxspki.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:264
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fzxsmkhcau.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6100
  - - C:\Temp\fzxsmkhcau.exe
      C:\Temp\fzxsmkhcau.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4992
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2036
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4364
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fzxsmkhcau.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2436
  - - C:\Temp\i_fzxsmkhcau.exe
      C:\Temp\i_fzxsmkhcau.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4140
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xrpjhczusp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2468
  - - C:\Temp\xrpjhczusp.exe
      C:\Temp\xrpjhczusp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3060
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4780
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4940
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xrpjhczusp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:868
  - - C:\Temp\i_xrpjhczusp.exe
      C:\Temp\i_xrpjhczusp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4824
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ebztrpjhez.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3208
  - - C:\Temp\ebztrpjhez.exe
      C:\Temp\ebztrpjhez.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5424
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3856
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4876
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ebztrpjhez.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3316
  - - C:\Temp\i_ebztrpjhez.exe
      C:\Temp\i_ebztrpjhez.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:108
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ztrljebwto.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5520
  - - C:\Temp\ztrljebwto.exe
      C:\Temp\ztrljebwto.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2184
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4344
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4140
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ztrljebwto.exe ups_ins
    3⤵
    PID:2060
  - - C:\Temp\i_ztrljebwto.exe
      C:\Temp\i_ztrljebwto.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2460
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tnlgbytrlj.exe ups_run
    3⤵
    PID:5132
  - - C:\Temp\tnlgbytrlj.exe
      C:\Temp\tnlgbytrlj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3952
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2484
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3196
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tnlgbytrlj.exe ups_ins
    3⤵
    PID:3252
  - - C:\Temp\i_tnlgbytrlj.exe
      C:\Temp\i_tnlgbytrlj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4336
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtnljdbvtn.exe ups_run
    3⤵
    PID:2000
  - - C:\Temp\vtnljdbvtn.exe
      C:\Temp\vtnljdbvtn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5252
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4692
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2368
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtnljdbvtn.exe ups_ins
    3⤵
    PID:1528
  - - C:\Temp\i_vtnljdbvtn.exe
      C:\Temp\i_vtnljdbvtn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1776
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qnlfdaysql.exe ups_run
    3⤵
    PID:6104
  - - C:\Temp\qnlfdaysql.exe
      C:\Temp\qnlfdaysql.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4368
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5276
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3612
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qnlfdaysql.exe ups_ins
    3⤵
    PID:5000
  - - C:\Temp\i_qnlfdaysql.exe
      C:\Temp\i_qnlfdaysql.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5796
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nkfdxvpnhf.exe ups_run
    3⤵
    PID:5608
  - - C:\Temp\nkfdxvpnhf.exe
      C:\Temp\nkfdxvpnhf.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5388
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2688
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5484
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nkfdxvpnhf.exe ups_ins
    3⤵
    PID:760
  - - C:\Temp\i_nkfdxvpnhf.exe
      C:\Temp\i_nkfdxvpnhf.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:856
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ifaxspkica.exe ups_run
    3⤵
    PID:5904
  - - C:\Temp\ifaxspkica.exe
      C:\Temp\ifaxspkica.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:528
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1388
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4312
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ifaxspkica.exe ups_ins
    3⤵
    PID:3144
  - - C:\Temp\i_ifaxspkica.exe
      C:\Temp\i_ifaxspkica.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6048
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kecxupnhfz.exe ups_run
    3⤵
    PID:2424
  - - C:\Temp\kecxupnhfz.exe
      C:\Temp\kecxupnhfz.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4624
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3436
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5676
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kecxupnhfz.exe ups_ins
    3⤵
    PID:1504
  - - C:\Temp\i_kecxupnhfz.exe
      C:\Temp\i_kecxupnhfz.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5064
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hecwurpkec.exe ups_run
    3⤵
    PID:3200
  - - C:\Temp\hecwurpkec.exe
      C:\Temp\hecwurpkec.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4144
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2664
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5896
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hecwurpkec.exe ups_ins
    3⤵
    PID:924
  - - C:\Temp\i_hecwurpkec.exe
      C:\Temp\i_hecwurpkec.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1712
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jhbztrmjeb.exe ups_run
    3⤵
    PID:3244
  - - C:\Temp\jhbztrmjeb.exe
      C:\Temp\jhbztrmjeb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6020
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4640
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4212
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jhbztrmjeb.exe ups_ins
    3⤵
    PID:5776
  - - C:\Temp\i_jhbztrmjeb.exe
      C:\Temp\i_jhbztrmjeb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4600
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffc467ac188,0x7ffc467ac194,0x7ffc467ac1a0
      4⤵
      PID:4884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,16447973782690801245,7962640345011914793,524288 --field-trial-handle=2944,i,11213556392801038040,9265631435379752085,262144 --variations-seed-version --mojo-platform-channel-handle=2988 /prefetch:11
      4⤵
      System Time Discovery
      PID:3292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1696,i,4989021497940734713,16132131742481487814,262144 --field-trial-handle=2944,i,11213556392801038040,9265631435379752085,262144 --variations-seed-version --mojo-platform-channel-handle=2676 /prefetch:2
      4⤵
      PID:5868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2192,i,6196007116559321992,9072463017277708484,524288 --field-trial-handle=2944,i,11213556392801038040,9265631435379752085,262144 --variations-seed-version --mojo-platform-channel-handle=3024 /prefetch:13
      4⤵
      PID:2624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3560,i,13179549149801437020,12745323067726533418,2097152 --field-trial-handle=2944,i,11213556392801038040,9265631435379752085,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
      4⤵
      PID:2616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3564,i,13037528083680178221,12366362624581671189,2097152 --field-trial-handle=2944,i,11213556392801038040,9265631435379752085,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
      4⤵
      PID:3444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,13106899290846700643,14286144154696960509,2097152 --field-trial-handle=2944,i,11213556392801038040,9265631435379752085,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:1
      4⤵
      PID:2688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4272,i,10468998589822872053,196306383200518399,2097152 --field-trial-handle=2944,i,11213556392801038040,9265631435379752085,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:9
      4⤵
      PID:2860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3736,i,6665370550978404915,10043844950768773286,524288 --field-trial-handle=2944,i,11213556392801038040,9265631435379752085,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:14
      4⤵
      PID:3188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,13339480111954039859,7142040421702133339,524288 --field-trial-handle=2944,i,11213556392801038040,9265631435379752085,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:14
      4⤵
      PID:548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,17593965829462864641,947620077008796808,524288 --field-trial-handle=2944,i,11213556392801038040,9265631435379752085,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:14
      4⤵
      PID:1448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,14719326720034571237,7793933860966224555,524288 --field-trial-handle=2944,i,11213556392801038040,9265631435379752085,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:14
      4⤵
      PID:1284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,14719326720034571237,7793933860966224555,524288 --field-trial-handle=2944,i,11213556392801038040,9265631435379752085,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:14
      4⤵
      PID:4256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,9234426592899970602,2848085130261141142,524288 --field-trial-handle=2944,i,11213556392801038040,9265631435379752085,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:14
      4⤵
      PID:4112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6620,i,8758943719612544512,7702124031121031267,524288 --field-trial-handle=2944,i,11213556392801038040,9265631435379752085,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:14
      4⤵
      PID:4188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4280,i,4152954779423036186,17637753407707571058,2097152 --field-trial-handle=2944,i,11213556392801038040,9265631435379752085,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:1
      4⤵
      PID:2564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3644,i,12814193380153969848,4355291814152331985,2097152 --field-trial-handle=2944,i,11213556392801038040,9265631435379752085,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:1
      4⤵
      PID:3564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,1799474057391094726,3631378685964578500,524288 --field-trial-handle=2944,i,11213556392801038040,9265631435379752085,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
      4⤵
      PID:2476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,8349473783659536504,6311385065296034098,524288 --field-trial-handle=2944,i,11213556392801038040,9265631435379752085,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:14
      4⤵
      PID:3368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,2690454423201792244,2426492801455253135,524288 --field-trial-handle=2944,i,11213556392801038040,9265631435379752085,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:14
      4⤵
      PID:4992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=4936,i,4147753985367376038,13081396461788470194,2097152 --field-trial-handle=2944,i,11213556392801038040,9265631435379752085,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:1
      4⤵
      PID:5840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,11522659084550131470,11631969319754506599,524288 --field-trial-handle=2944,i,11213556392801038040,9265631435379752085,262144 --variations-seed-version --mojo-platform-channel-handle=3820 /prefetch:14
      4⤵
      PID:1760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,2179790675692711664,17330622135481598166,524288 --field-trial-handle=2944,i,11213556392801038040,9265631435379752085,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:14
      4⤵
      PID:2000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,15319251824063806012,2402788890391312038,524288 --field-trial-handle=2944,i,11213556392801038040,9265631435379752085,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:14
      4⤵
      PID:5536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,14418527550720834254,11951826974117067457,524288 --field-trial-handle=2944,i,11213556392801038040,9265631435379752085,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:14
      4⤵
      PID:972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6180,i,5048951647767578140,4196623582462880210,262144 --field-trial-handle=2944,i,11213556392801038040,9265631435379752085,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:10
      4⤵
      PID:1284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,16749005718735895444,2327497940815118690,524288 --field-trial-handle=2944,i,11213556392801038040,9265631435379752085,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:14
      4⤵
      PID:2808

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5404

C:\Temp\czurpmkecwusmjhf.sys
C:\Temp\czurpmkecwusmjhf.sys
1⤵
- Executes dropped EXE
PID:4440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4088

C:\Temp\ezwrojhbzw.sys
C:\Temp\ezwrojhbzw.sys
1⤵
- Executes dropped EXE
PID:5500

C:\Temp\zwromjebwu.sys
C:\Temp\zwromjebwu.sys
1⤵
- Executes dropped EXE
PID:2336

C:\Temp\jgeywrljgb.sys
C:\Temp\jgeywrljgb.sys
1⤵
- Executes dropped EXE
PID:428

C:\Temp\bvtnljdbvt.sys
C:\Temp\bvtnljdbvt.sys
1⤵
- Executes dropped EXE
PID:1636

C:\Temp\dxvtnlfdyv.sys
C:\Temp\dxvtnlfdyv.sys
1⤵
- Executes dropped EXE
PID:1724

C:\Temp\fdxnhfaxsp.sys
C:\Temp\fdxnhfaxsp.sys
1⤵
- Executes dropped EXE
PID:4416

C:\Temp\usqkicausm.sys
C:\Temp\usqkicausm.sys
1⤵
- Executes dropped EXE
PID:108

C:\Temp\zurpmhfzxu.sys
C:\Temp\zurpmhfzxu.sys
1⤵
- Executes dropped EXE
PID:5512

C:\Temp\hezxrpjhez.sys
C:\Temp\hezxrpjhez.sys
1⤵
- Executes dropped EXE
PID:5860

C:\Temp\bywuomgezw.sys
C:\Temp\bywuomgezw.sys
1⤵
- Executes dropped EXE
PID:3368

C:\Temp\ywqomgdbzt.sys
C:\Temp\ywqomgdbzt.sys
1⤵
PID:4532

C:\Temp\wqolgeywqo.sys
C:\Temp\wqolgeywqo.sys
1⤵
PID:4424

C:\Temp\nlfdaysqnl.sys
C:\Temp\nlfdaysqnl.sys
1⤵
PID:420

C:\Temp\sqkicavsnl.sys
C:\Temp\sqkicavsnl.sys
1⤵
PID:1096

C:\Temp\vpnhfaxvpn.sys
C:\Temp\vpnhfaxvpn.sys
1⤵
PID:428

C:\Temp\hfzxspkhcz.sys
C:\Temp\hfzxspkhcz.sys
1⤵
PID:548

C:\Temp\hfzxrpjhec.sys
C:\Temp\hfzxrpjhec.sys
1⤵
PID:3396

C:\Temp\jebzwromjh.sys
C:\Temp\jebzwromjh.sys
1⤵
PID:1540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bvtnljdbvt.sys

Path C:\Temp\bvtnljdbvt.sys
Size 293KB
SHA256 5295ce21a954043ccdb69347f36977647432f1ddee88a35328dcb63111864d60
MD5 74f5004da75539696a58d26850beec3a
SHA1 91b9e0e76f9bc3a4e205e57b4c87c0298df4085c
SHA512 68c356a70563363088d8465de08bfd718100c1891a6394cfb8b67d853be8274673c577402282bdde7d3d77613be54371af7c6443453a8480b1c27103071f77c3
SSDEEP 3072:QtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:QIJjiJcbI03GBc3ucY5DCSj
TLSH
T17C545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bywqojdywt.exe

Path C:\Temp\bywqojdywt.exe
Size 384KB
SHA256 0051e4d22700dd6c093b33540887e62513083b2fc634c83673b7186c1f74efcd
MD5 0f1eec3bb0b3e713fdef6e83fea770db
SHA1 5d5a066605c27d6a4a23de7ef2ec25faae410384
SHA512 2a10bdc96103a015edbda7ae9334884f40f825e5f9a425242c17b587e486706cd59f524d7a7e643baaca9f00f22a40dea61528febaeac1e9dce3c9823b423f9a
SSDEEP 3072:l9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:HctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T112847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

czurpmkecwusmjhf.exe

Path C:\Temp\czurpmkecwusmjhf.exe
Size 384KB
SHA256 1dd8eede1dfacbb958278d0463f897d51d666a81535926276f40d24e25221cbd
MD5 a3802b2c2ad961975add5495244be42a
SHA1 bc04315f37f0879817bc2e385b297ac5a81050ba
SHA512 a9c3458080ec6a04be81e2b1a586ad6a6de80f0a5fbd2691c30b6de04f83bc44143f51f7ea14ea9ed18cfea2467f6729d12358a747daa199ee895d8d8df972ac
SSDEEP 3072:q9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:QctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T161847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

czurpmkecwusmjhf.sys

Path C:\Temp\czurpmkecwusmjhf.sys
Size 293KB
SHA256 18ebcacee3893a9f0998587b2814d8a44be2eb9ea9a6e2fa7fdbbadea680769e
MD5 0442cef0bb983fd2d3947a4d78b31ebe
SHA1 cf46f0b5b835ba0b71a288565284ee4a3b576c51
SHA512 186e53799386c1fcc0d504a345eda60ce01d4df38059114e76ec6fc20a55291bcf5586d5283ef0baf3605ce45f9417043d01ae9b8927aeeec013511d0ff10049
SSDEEP 3072:LtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:LIJjiJcbI03GBc3ucY5DCSj
TLSH
T137545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxvtnlfdyv.sys

Path C:\Temp\dxvtnlfdyv.sys
Size 293KB
SHA256 914672d2842a1eb5c463ba61dba8ce3d794f86523d5d7d56cbf7d6257ca6932f
MD5 ef164759bac177dd5f46cff20f22b6d1
SHA1 ad4705f0deac96687972f73eaf3bbe49160140a4
SHA512 7b9aeea87cb3e2a08ec233ebb2281235041d8d9448786d6ca004d89230e0d338e67e1ebc63437e2b67928f03b96d245b8b3a687819bc3593deaeccdcb9f4e50e
SSDEEP 3072:YtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:YIJjiJcbI03GBc3ucY5DCSj
TLSH
T1B0545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ezwrojhbzw.sys

Path C:\Temp\ezwrojhbzw.sys
Size 293KB
SHA256 546b4672d2c090e382c41e4a5241bd00f41ac4c0f2c1fba4b7db6439e03c0d29
MD5 1292af207c4ef7a3fcbd2a6b5f031472
SHA1 9631aed1088f39545088dd7e78b6beab2f673daf
SHA512 2d36c311e66d134d99bb3745bd38daae9d4023f4617598e64e1964223b508553b647779a7460e62ac05c907d97234b3fdd8f8030041ab097e3e4c7d0c293d7f7
SSDEEP 3072:xtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:xIJjiJcbI03GBc3ucY5DCSj
TLSH
T1DC545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bywqojdywt.exe

Path C:\Temp\i_bywqojdywt.exe
Size 384KB
SHA256 d5313eb97d4d48d0609e6655eac1d59528f715975e5579d553f7b7468fcef798
MD5 88f3d7aebe2433e08e225d0b72c882aa
SHA1 80ee4f480007658ee8bb82008bdd6b10f8cd69aa
SHA512 5ee6470bd55dd0262b9e4c1256d21fb423f41b9af211d34d139c2d7cab2e1df3e3a173b3bd53026d033af66247ad16ac47caeef9c9c5055916aa044bf17539fb
SSDEEP 3072:X9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:tctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1AC847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jgeywqojgz.exe

Path C:\Temp\i_jgeywqojgz.exe
Size 384KB
SHA256 d97aab084cd5818db0f495a80af402b0a92c0fb2f34ee5cc7e13da5006d2cb5a
MD5 8871cbe6126e8739350177afe60aea50
SHA1 347418f773e1757635e12e95af17cbd5350e4c3b
SHA512 a0f05e28e14ec9e4215c88df5607035d6806cc17be643893f3ec3402766fc23fbc95d78d880821fe0d8568e7d8c86f7a89c5058fa82f83eefe4e269bef6c8350
SSDEEP 3072:X9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:tctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1DB847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pkhbzxrpmh.exe

Path C:\Temp\i_pkhbzxrpmh.exe
Size 384KB
SHA256 2a8eac5bdc3bc734cc3db1018f08748ff8f3b559ce428741188ccb5e53df8ca7
MD5 8f248671bba9dbcaef7c54e078f8862b
SHA1 676713e545024e548580c0bf04d671a872cd4814
SHA512 631749b358ba84856bd8456fab57b853fa5d3ff47cc6dc926b1067075a7de5b72139d28ad4e6576bcf66b3a7cecf653ad6fcf8df4da28928ab0f8decb7585045
SSDEEP 3072:y9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:IctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T195847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_sqlidbvtqi.exe

Path C:\Temp\i_sqlidbvtqi.exe
Size 384KB
SHA256 9bca11b7deee77cd0a4a4ff0d336f788aef53982f4b1c01e9c66336c61845360
MD5 6e656b17af9b3bdacf9f2526366042f8
SHA1 d94933f144ec831821021401f029724790ce33d0
SHA512 b193c89ccd02e7b566f8749a1a982223b897943551560ec2fe2138f8a5e3d83e0cee7946b157ddceaa2a787f168b1ae73a28e11402ccde854532383e8b6b8a5f
SSDEEP 3072:S9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:octFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T123847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wrojgbzurm.exe

Path C:\Temp\i_wrojgbzurm.exe
Size 384KB
SHA256 d82ae56ab1fd459ba1b8a11fa7ba277483d5f6e2cd8e61f5fa37b592f3e34f8e
MD5 951aa72c2e696b62ba06ff8acc4ad829
SHA1 1d0158c6135c534a7af68b4e29d95a2155899c83
SHA512 babda276a6c4ae1afcf5a58578ddb751ca96a2358fd327b315949e6974668b201986736bb47dc8fba48dcc08315de40deae98bbcfee83db71c87d9105d172292
SSDEEP 3072:S9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:octFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T12C847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jgeywqojgz.exe

Path C:\Temp\jgeywqojgz.exe
Size 384KB
SHA256 99942253920390f67251c32b4ffca2441f4aae55fbd919aad44131d625ecf2f8
MD5 c02a7ed79b68ed0b8ca5ad71866df5f1
SHA1 4cd71e73d736b7c2efbaae9e05ec0b8a12f70a0f
SHA512 5b14a743415fdcc03359ba6c7100772432fa84e288db5efba74f4eee0aca0bbef70dbc939ce833883c233d83896fb61491b3eb669926e0ef94c74e085f61c65b
SSDEEP 3072:39ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:NctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T117847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jgeywrljgb.sys

Path C:\Temp\jgeywrljgb.sys
Size 293KB
SHA256 62c0bf69ef3055e9929b3f28d246c405660411879d846213ce3adf1973addfd8
MD5 21850d3a9d75286c5f03cad043f11917
SHA1 d5f7072e7356f69d7e28dc050bb661cb63807808
SHA512 9aade7192feab9a29320eaf8383bbd9281ed819d856e6e903ebbacba678f5372aaf3ae0334d1aad9a75a2740d1d8b459e3202de9de3d924701fa61b60c81e33e
SSDEEP 3072:1tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:1IJjiJcbI03GBc3ucY5DCSj
TLSH
T1AD545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkhbzxrpmh.exe

Path C:\Temp\pkhbzxrpmh.exe
Size 384KB
SHA256 3999aa742f6f9b3af9a2392dd7edfc0050087f3401b73f951062360a8af28fd3
MD5 cfdcb73a7131cb337082b2ca5652051d
SHA1 5bc986aaa3d9e83212b592272133efe4e8b3187c
SHA512 c3528b1c1c3ca9519f926c85b08cba704db648418057afd3d858c07ae7a4c12d53a65b2bf29ef236134af83eaff7e70e0b3006ae7193b1010320b60ef53384c4
SSDEEP 3072:s49ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9N:s6ctFtIJjiJcbI03GBc3ucY5DCSjX7
TLSH
T14B847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlidbvtqi.exe

Path C:\Temp\sqlidbvtqi.exe
Size 384KB
SHA256 eb4abcd1b27df69fc425a335b088d44be38cae157c1c58c293e3c6855d1c208a
MD5 824d9c205c7ac86861c9eaa91b04acca
SHA1 48f7a9de9944c54bc44756515459a07eca80e3f8
SHA512 a418ac35b45dcc88b72a23bd2cf4584aa310cce8e77862963477f57357f8a809112fd8736b8a9a0dabe860480aa7b4b372185cf786aab6c142d47de8c87ad220
SSDEEP 3072:h9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:rctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F6847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtnlfdxvpn.exe

Path C:\Temp\vtnlfdxvpn.exe
Size 384KB
SHA256 dedb86b0db70c5088e5ec649abfc536224ea6e90e104b0852bba642c9a1c515b
MD5 8bb57b05b0bc30276559cd24cfaaca8a
SHA1 4271bd282862b636ea9cfc43a800e56ccb514295
SHA512 a7cd6962e5e15636fb2771190a8e7d32123b2e5a56855e034beaa1feae9f4186d2a674868e2ef72abea2093ea60869d16dc7edc9f88e1c21afbd5a84a35819a2
SSDEEP 3072:q9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:QctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T12B847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrojgbzurm.exe

Path C:\Temp\wrojgbzurm.exe
Size 384KB
SHA256 2aa8786e7e4493570bb7b24885dbfcd29a59d38ca14a5c440f5a5c5ecf4c57ec
MD5 e6d2e8ca7f244fcd8620a366fb7d0424
SHA1 2bd0b17570136722f35bb76ed789ceafc95f085f
SHA512 12b117a64035899249057e9b2670d5b2a0ac59168f35ac755080abe0c1887f0732c1f3683a1906b2152da382a4bfbeaae258e93f1d616e3d63113d84213f64a1
SSDEEP 3072:99ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:PctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T192847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zwromjebwu.sys

Path C:\Temp\zwromjebwu.sys
Size 293KB
SHA256 7766c90e843fe2c58755d8fb615a5f3be6aadd494fbc49ef371846e4c484df67
MD5 c21beaf19a3587c2695fb6c894281328
SHA1 f6fd6dc4ced430628d8a1e68ad06fd71e68216ab
SHA512 3f4ececf37b1710d63d786602ead056f42110413ed45dbf6b90d3eb8dfc504b5f99fc7ad6e1043b57b3e91d7f7b8932130c9462c6fe36ed1bc41cedfc99f1bae
SSDEEP 3072:StKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:SIJjiJcbI03GBc3ucY5DCSj
TLSH
T152545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 ae10af80c983ecdad438965cb208911f945e43bc36fe488247e2cd8bad97b450
MD5 f5ccd04bc3cab603843f2aa41a035cdb
SHA1 a4745772a8bc8f2c6e201e674b2ae558abaeb5f0
SHA512 e655264449a4bb6b25d28102be4b80887fc34a446f6baa3f02657035b3c41c200becbfdfe3947962121baf11f7b7315d8b709736af52453e82162331001d4608
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7A:fwUQC5VwBIiElEd2K57P7A
TLSH
T121B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b53c58762bff2a5723ae446675e8f65fd50818b95383c8f3c7efef01af06e466
MD5 629a18fe1b7a241215c77a30d7d8d7ee
SHA1 5e7bd5b514f4e46a4b986c8b89d0025cf81a1f36
SHA512 04fd58619789dc107f680a57dba3aec42e4bab7c29c0defd7e1b8ca2d078ca4c91317932ff076171bae60d370b28de32c94039c6ab690d5004ddcb857977f38a
TLSH
T182D09BD575146914C5A1303E21D2935392504835601945874051E56D5C5479743FB5AD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c36ac766a384a109222b8b647d2f5c1c2e6c4672a4a2c6b8a01f6eac0a5df074
MD5 f9f896b0e6f281d55b1ca3fa3c1ccdcd
SHA1 db44df3874cd86a961c82d25f3ae2004f249b2df
SHA512 6b8c8d305c2d7e4a3b5efb6e1967d7db1b1ffdb7979edd315013037da369c923060dae4ef8a7219176aa7e0bc1fa4cb98e48470ea2f569243a95d3301f5a40bd
TLSH
T160D09BD575046A14C5A1303A21D1935392604835741945874051E55D5C5479743FB5BD
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ce08237e748fc2bcf46518136404282267f99977fff0466fce8214027987521b
MD5 7e0e504efabff0d05a9a3c4bf74ef619
SHA1 5589a3b9c429e05dd46f59e4f54f0f18c6cf5924
SHA512 3acd3fe9c5247496f52760d5d9b3d6347f3d04b65f7eca48acec4134faf7032377bbcdd6bc316f50c1783d5a46612ccb0d5ff0b76774974741a20cf5c7c9f2ef
TLSH
T1D361DA937F1D19E3DB26B9FC50A5C4F834BB48E507CB6A1452706A3D940369D10380A5
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5964fa.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5964fa.TMP
Size 3KB
SHA256 89e1603bf2ca5ec1bcbe06a5eb87c26108b47cdd443759ccefdcd252882f1323
MD5 4475aae75853ba7cfe9c4ddcf69c5b9c
SHA1 641d43dbe9ddae7ccf6ab37797b57f03856cde86
SHA512 1376797dbc2ea5df964eb74d2563f47a3d2b1c168f15ec612c09b80c593c1b14ebfb45702e48563805915b1d4dd4816b82fc7e9fa972cc8cd876ccfaeb824f43
TLSH
T12161FA937F1E15E3EB26B9FC50E5C4F835BB88E507CBAE1452B0AB7D940369D10390A5
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 caac61836fb330133a34d30467e70dbeb8e7234e1e86485d18afda5910d1f5ad
MD5 0ea4e343dd1888a0c44a92bf0ae00608
SHA1 91a492929517616de67a1f38916b4ede45ebc7b3
SHA512 c4b22cadb4b2f20b983cd3f260550b9c5ebeb1cef5cd8afb5b1c17c9212fc8435fbd7a498991c7ddde387edb042909a9a5a2df86a3e1112cdf3a36419101cd3e
TLSH
T1AC217CF3C3E5856E890156F06A28AE2BCE1D0905432C3D5AC9E4EF1B97E2875E10199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 a282d44691166e5477a1b0c12f9dfb61ad62069a5f5d8b503ba96424b6cfa5c0
MD5 d286a9d3c206e53fc26b2ce6b3870511
SHA1 3b3473e4b0cc19446ce913bbd85c7e4b6bbc4f1a
SHA512 3dc4f34723528cf8b27c1e99435f862a5d4c008b9d544d2c4683399dcd84e3094f3cf15aad8f998204d42bb1faeaaf873a161657955c7421a7369ff016e65bb0
SSDEEP 192:sxRXRiyM/jK1Ml8wC4/fKs+LrZTyzoA8prc/g6+WNCq2/YxpGJqGnIgDfJ:sxRXE84/fKs+LFT/o/5y/08pd
TLSH
T19462E916AA245D7BDCDBD209FA517F93D6F81573E1900E44ABFC9A0C00E66DD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 10021ac956c12ec890962ff2f121473239b04aac71be233359bc2873b851f4b4
MD5 037a5ddf3087874099584c231802fb51
SHA1 c3576fe5343b16e9efca440b974703fbc72febe7
SHA512 be140bdd2c3d66f5a8ef7a3a1499970fba2cb086a53f97012a2c9a63925b0b43c74197420be36cca62ff42661477dc792d07de04ce74ef26256e694b1e8b5b5a
SSDEEP 192:sxR4RiyM/jK1Ml8wC4/fKsPKrZT2zoA8pi/g6+WNIYxWJqGnIgtJ:sxR4084/fKsPKFTri/5Ifp3
TLSH
T17A52EB15AA24993BCCDBD20DFA557F93D6F81573E1901E44AAFC9A0C04E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 bc9ea43a70a3900f87639ae9e24ee6af86b4906a1ceea1b58b7cc78e8e1cc312
MD5 b8b382b8b878e4ae13da6cdd997c5927
SHA1 e5c64530d9799d9732e6fe9128e2bf100c8afa99
SHA512 69afe8ab662ae0286c82b68e215c670aa57adb38b70c600127aea376577ee618e80f0d5ed98bcf8477cfdd48ca90fcc4d33114ff8c02e19d101b18d772cb63ac
SSDEEP 192:sxRXRiyM/jK1Ml8UQomC4/fKs+LrZTyzoA8prc/g6+WNCq2/YxpGJqGnIgDfJ:sxRXEqoB4/fKs+LFT/o/5y/08pd
TLSH
T10862E916AA249D7BDCDBD20DFA517F93D6F81573A1900E44AAFC9B0C00E66DD621381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 8551b13ed3a01e494a8d3a8dfd7e1e95029e919e33c417b61b1e664c1cd90a66
MD5 50f27fb0311aa2e69d256ce568f1d9da
SHA1 01b95d53942bec3b711875d32b72a33d843f3d8b
SHA512 2e5a4d5261cfcb7eaa32680f639cdcda9001eac0b19e00360236c3c7b0ccb11e0f9c3afffcf9e2ad1678daaf48ee2a407a45cd3ff846f7f8e341d958d9e2b57a
SSDEEP 192:sxRXRiyM/jK1Ml8wC4/fKs+KrZTyzoA8p9X/g6+WNIYxKJqGnIgD9J:sxRX084/fKs+KFT/p/5Ihpz
TLSH
T11262FA16AA245D7BCCDBD20DFA517F93D6F81573E1901E44AAFC9A0C00E66ED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 2f8fe92d509d712256d0b182a1b163f397dd3768051dcf386f5ba41343b53a6d
MD5 da74854798aeb1813ab19f7ada2ab3e5
SHA1 35437927b6fd5f0e27ee65eb897f98856dfc6cb8
SHA512 76bee253f96108694c85654e1f8839724e6272a2c94b2d6dc7122fb5e4339c664ea054de4be7f0988a5e1d3e5dd2afca5d84ff51e725e3c14c67ed63841d0af9
SSDEEP 768:0xCyDs7pLuL7ijWgbrfM18F1+UoAYDCx9Tuqh0VfUC9xbog/OVHgHrVA6roJqtXW:0xCyDQE7ijWgbrfM1u1jaQgHpAxJqdW
TLSH
T1EEE2EC7B680CCB7E4F404A9DEC297EDEADE802CF96D8C95447EA440C03C66EB51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 ddfb61e4ee6a81c68d26d1f77219644243c1a602cf24a46b071cfb07f4ea51d1
MD5 ae6cf17988bdb1da9d1dfe9b294cc35b
SHA1 cca9d4d8b6832add11117383fa6d951356a40116
SHA512 11745c216a5572336b4fab5c5f521c795007378814880164b6b0933f82fe214c983515cc3a2c69e22c7cb95ad79248afa2998479698b22e7622092d68a6a8181
SSDEEP 48:KseIvKrCYLytnItKIEY4vIhK0Isby5WIXKLKAI:KseUKrCO2nSKIE7v6K0Iq6WMKLKv
TLSH
T174C10B52B13A5A8439BE650891A4D626CAC1B4B33417A52B37E840B61F7FF054EFC8FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fb02615e-945b-456c-a8dc-7cbc922a716a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\fb02615e-945b-456c-a8dc-7cbc922a716a.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 7ba666b88ad44d5e41db22ab969be149687823ac8784db9c36da1d5d819cc9e4
MD5 5e7316020da97506c8c602cb534c0d07
SHA1 6fa1d870f1e2ac7e2513066fa723374acf9c73f3
SHA512 105c8527c52bf22215da0506e68df535dbb90a1b49331c9906daea72c882ed285fe3eeca17ea82c60dc859e5f577702cbb445d15f5086ec8f3a19899501169ed
SSDEEP 768:6j+9U3/E+N6kKL20atfnjF669yrqUjWiIwwxMtiQG44Z71Po:59U3vrsGnjF66INWZTM8QG44B1Q
TLSH
T161F2BE70A8925DB7CCF6D785B22337C3EEB051A395C50E98D6DCAB0E01479DC2B4792A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 0c06fbbc839c42aef8cef37315c5e8e5b18e5365655006006d3dd3ac8ce67b82
MD5 039b836817a39b7d3e5f82fa08b2416c
SHA1 06019c29d854ae4c48eebba89c1b7d9aaa8f720b
SHA512 35afda091e9807e920c8588b80f37eed260f2e70f8035f295257ac2a47fb3c939b579da201f68c97fb44b095caf5ce4bc2089153b32f56765c8f2d3c5a3b9406
SSDEEP 768:LFKj+9t3TwgaE+NROatf3HPF669yrqUjWiIwwxMtiQG44Z71Po:r9t3eiG3HPF66INWZTM8QG44B1Q
TLSH
T107038D75E891CAABDDF6CB85B21237C6EEE011A385C84ED8E6C86E0D00875DD1B47D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 e9fa701adb06079a372a0504db4aa87ef529ae892a2d294e3d21bdd33c05fe8b
MD5 1dc9dba424266fbcb5d8f16bec549745
SHA1 40e8dd7969388878124d13ceadf148d810e17295
SHA512 583334b9f2417a7bfabca396c9ab0e946b7f99291c2ea460aa1bbe595d1a53f3c584d9b82f462bee6b3a75508f864a835e8ea05aeba20ea0310098d9dd363371
SSDEEP 768:mrv+4UNbd236E+n6kKL20atfnjF669yrqUjWiIwwxMtiQqi:mbsbw3oBsGnjF66INWZTM8Qx
TLSH
T17503AE70A8988A77CDF6D781B14337C3BFB420A385C50F88DAD9670D464B4D92B4B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 eb2e244ff7f8a4dc2c10412e4908b3b353455b83e100d5b82ffcb1db06d3afdc
MD5 2a193c0082cc6138d6d6d9f46c3216c8
SHA1 c35d49a00d5dc8a1a2ec02e23e4c4269bf84d502
SHA512 4da13f9016ec418a85df45d4b3ac74c3fcf8c4aef4a55355cfbb1470742c42b74d38fff8af0023e4ada7c47502ace511e5f483bdf3d55e369fb654af00c9340e
SSDEEP 768:Uj+9U3aE+N6kKL20atfnjF669yrqUjWiIwwxMtiQG44Z71Po:D9U3IrsGnjF66INWZTM8QG44B1Q
TLSH
T16DF2BE70A8925DB7CDF6C785B22337C3EEB051A395C10E98D6DCAB0E01479DC2B4792A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 e48670d90fe1941b71a5fe664fb05f6ce5a59a3dcec095ecfe88fe525c39874f
MD5 7e2846a7c3b773601d6fca9623339b11
SHA1 2ef9533daea239cffa83cec501b9471ff888c756
SHA512 f185f6661a9d15f9064a39fc1d26f81d328af4bcb85465db8b533bc7ac287bea14044cd1f6d8a0ca8842bf6ab26ba68cf06929d5121b105ea98fbd7de1b0fbf7
SSDEEP 768:arv+4UNbdl3dPkKL20atqjF669yrqUjWiIwwxMRCUiler:absbX3KsjjF66INWZTMsUsQ
TLSH
T18D03CE35AC589AB7CCF2D68672433783BFB4109396C50B88CACD670D469B4DD2347A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 4d047896e04651b1073789b8904ce09f66d3e5e7dc0b4ec2257ce875ebdd4b85
MD5 902e870c29aed12218930ef8b1138345
SHA1 68a7fc9785f8c0c2c15c227680b8897cfb5a2b5a
SHA512 911172757c03afe5489151fc01fcfb007276be7569fb58a985e553072f4e94b14fdd6e43af0add4d4095f0c48b7b8d2a98010f8300c207b0f6886e987221d6ab
SSDEEP 768:LFKj+9t36wgaE+NPOatfxnF669yrqUjWiIwwxMtiQG44Z71Po:f9t3xIGxnF66INWZTM8QG44B1Q
TLSH
T176038D75E891CAABDDF2C7C5B21237C6EEE011A385C94DD8E6C86E0D00875DD1B47D2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

5da6480f-1407-48a0-8b19-c4b829018c3e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5da6480f-1407-48a0-8b19-c4b829018c3e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4860_1201000517\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 d222bcdd7533bf8765f55bff2784e646ad59148a197440b4f54810d050cf9d99
MD5 0ece5e8f04c09e919bddf105c9d06796
SHA1 6f446e20e50e38d93dfaf9ee75026bd8b07ce66b
SHA512 74cc67310df49a9a73c9ef342f1b96eac1c7dd1b96502743d18d3f4f300a2c3f0de24eed0d61aab45e18923f246155616c65e17e562ef65e1b4f5d5250521978
TLSH
T12571008356B9C9B3C59A5BF002835248F1BF62380723202147555546AE30A7A18B9F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/108-327-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/420-436-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/428-451-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/428-273-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/548-472-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1096-440-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1540-501-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1636-318-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1636-285-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1724-315-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2336-245-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3368-376-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3396-484-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4416-323-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4424-416-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4440-65-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4532-396-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5500-198-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5512-342-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5512-372-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5860-367-0x0000000000010000-0x00000000000AB000-memory.dmp

Download