systex | 6c35b5b936d4e10ec61d009db8a1cbf029ce54eb2cdc6b105ae4b5c45eb74688

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/07/2026, 14:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_b34be50c006643a3b6b709fe35a7e164_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 361KB
Sample260717-sa2cwady2q
SHA256 6c35b5b936d4e10ec61d009db8a1cbf029ce54eb2cdc6b105ae4b5c45eb74688
MD5 b34be50c006643a3b6b709fe35a7e164
SHA1 de9621aa8927c9eb7af6bc736d4a3799139298d1
SHA512 c7d39aa6553a12f6458f992a040e318ef922c5f01904b494fe90f8e2c58679294b89b52df948c38571f71d92d339427a2764b47b90efffc943951ca89d95c61b
SSDEEP 6144:gflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:gflfAsiVGjSGecvX
TLSH
T103747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
2544	lgeywqoigbywqomg.exe
1056	lgeywqoigbywqomg.sys
5732	CreateProcess.exe
4384	tolgebwtol.exe
4224	CreateProcess.exe
6300	CreateProcess.exe
4544	i_tolgebwtol.exe
980	vtgdyvqoig.sys
4556	CreateProcess.exe
3372	dyvtqljdbv.exe
5640	CreateProcess.exe
2836	CreateProcess.exe
5516	i_dyvtqljdbv.exe
1636	tnlidbvtnl.sys
996	CreateProcess.exe
4640	dxvqkidavs.exe
4948	CreateProcess.exe
5920	CreateProcess.exe
6916	i_dxvqkidavs.exe
796	dxvqnlidav.sys
5668	CreateProcess.exe
1756	axvsnlfdxv.exe
5452	CreateProcess.exe
5772	CreateProcess.exe
1060	i_axvsnlfdxv.exe
2556	xspkicausm.sys
3992	CreateProcess.exe
4764	vpnhfzxspk.exe
5060	CreateProcess.exe
7012	CreateProcess.exe
2956	i_vpnhfzxspk.exe
5776	mkhczxrpnk.sys
2444	CreateProcess.exe
4324	pmkhczxupn.exe
360	CreateProcess.exe
5864	CreateProcess.exe
5444	i_pmkhczxupn.exe
1840	pkhcausmke.sys
6284	CreateProcess.exe
2128	zwupjhezxr.exe
4544	CreateProcess.exe
692	CreateProcess.exe
5512	i_zwupjhezxr.exe
5540	bzurmjhecw.sys
3484	CreateProcess.exe
6088	bzwurmjhec.exe
2712	CreateProcess.exe
1852	CreateProcess.exe
6096	i_bzwurmjhec.exe
4932	jhbztrljeb.sys
1692	CreateProcess.exe
2224	ztrljebzto.exe
6740	CreateProcess.exe
2636	CreateProcess.exe
5072	i_ztrljebzto.exe
3024	tqljdbywqo.sys
2800	CreateProcess.exe
6108	trljdbvtol.exe
3684	CreateProcess.exe
4936	CreateProcess.exe
2732	i_trljdbvtol.exe
3324	ljdbwqnljd.sys
240	CreateProcess.exe
3440	aysqnigdyv.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5768_1111320577\Microsoft.CognitiveServices.Speech.core.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5768_1924723659\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5768_1924723659\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5768_1111320577\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxvqkidavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztrljebzto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecauspnhfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezwrpmhecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtrmjebwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbvtnlgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dyvtqljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igayvqkiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwupmhezwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwupmhezwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwupjhezxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bzwurmjhec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljdbvtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faysqkifax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_b34be50c006643a3b6b709fe35a7e164_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tolgebwtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axvsnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpnhfzxspk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwupjhezxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faysqkifax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtrmjebwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqoigbytrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tolgebwtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dyvtqljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dxvqkidavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpnhfzxspk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecauspnhfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbvtnlgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axvsnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmkhczxupn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzwurmjhec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljdbvtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqnigdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezwrpmhecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqoigbytrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmkhczxupn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztrljebzto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqnigdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgeywqoigbywqomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igayvqkiga.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1268	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3668	ipconfig.exe
3472	ipconfig.exe
1056	ipconfig.exe
3536	ipconfig.exe
2680	ipconfig.exe
6292	ipconfig.exe
2728	ipconfig.exe
3148	ipconfig.exe
5484	ipconfig.exe
3528	ipconfig.exe
3716	ipconfig.exe
4564	ipconfig.exe
1700	ipconfig.exe
5728	ipconfig.exe
2596	ipconfig.exe
5900	ipconfig.exe
5824	ipconfig.exe
6472	ipconfig.exe
3300	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134287737828669796"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{77684909-C311-4D61-AD62-0688544DD2DE}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2884	2026-07-17_b34be50c006643a3b6b709fe35a7e164_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2884	2026-07-17_b34be50c006643a3b6b709fe35a7e164_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2884	2026-07-17_b34be50c006643a3b6b709fe35a7e164_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2884	2026-07-17_b34be50c006643a3b6b709fe35a7e164_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2884	2026-07-17_b34be50c006643a3b6b709fe35a7e164_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2884	2026-07-17_b34be50c006643a3b6b709fe35a7e164_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2884	2026-07-17_b34be50c006643a3b6b709fe35a7e164_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2884	2026-07-17_b34be50c006643a3b6b709fe35a7e164_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2884	2026-07-17_b34be50c006643a3b6b709fe35a7e164_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2884	2026-07-17_b34be50c006643a3b6b709fe35a7e164_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2884	2026-07-17_b34be50c006643a3b6b709fe35a7e164_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2884	2026-07-17_b34be50c006643a3b6b709fe35a7e164_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2884	2026-07-17_b34be50c006643a3b6b709fe35a7e164_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2884	2026-07-17_b34be50c006643a3b6b709fe35a7e164_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2884	2026-07-17_b34be50c006643a3b6b709fe35a7e164_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2884	2026-07-17_b34be50c006643a3b6b709fe35a7e164_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2884	2026-07-17_b34be50c006643a3b6b709fe35a7e164_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2884	2026-07-17_b34be50c006643a3b6b709fe35a7e164_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2884	2026-07-17_b34be50c006643a3b6b709fe35a7e164_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2884	2026-07-17_b34be50c006643a3b6b709fe35a7e164_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2884	2026-07-17_b34be50c006643a3b6b709fe35a7e164_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2884	2026-07-17_b34be50c006643a3b6b709fe35a7e164_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2884	2026-07-17_b34be50c006643a3b6b709fe35a7e164_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2884	2026-07-17_b34be50c006643a3b6b709fe35a7e164_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2884	2026-07-17_b34be50c006643a3b6b709fe35a7e164_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2884	2026-07-17_b34be50c006643a3b6b709fe35a7e164_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2884	2026-07-17_b34be50c006643a3b6b709fe35a7e164_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2884	2026-07-17_b34be50c006643a3b6b709fe35a7e164_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2884	2026-07-17_b34be50c006643a3b6b709fe35a7e164_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2884	2026-07-17_b34be50c006643a3b6b709fe35a7e164_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2884	2026-07-17_b34be50c006643a3b6b709fe35a7e164_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2884	2026-07-17_b34be50c006643a3b6b709fe35a7e164_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2884	2026-07-17_b34be50c006643a3b6b709fe35a7e164_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2884	2026-07-17_b34be50c006643a3b6b709fe35a7e164_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2884	2026-07-17_b34be50c006643a3b6b709fe35a7e164_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2884	2026-07-17_b34be50c006643a3b6b709fe35a7e164_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2884	2026-07-17_b34be50c006643a3b6b709fe35a7e164_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2884	2026-07-17_b34be50c006643a3b6b709fe35a7e164_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2884	2026-07-17_b34be50c006643a3b6b709fe35a7e164_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2884	2026-07-17_b34be50c006643a3b6b709fe35a7e164_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2884	2026-07-17_b34be50c006643a3b6b709fe35a7e164_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2884	2026-07-17_b34be50c006643a3b6b709fe35a7e164_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2884	2026-07-17_b34be50c006643a3b6b709fe35a7e164_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2884	2026-07-17_b34be50c006643a3b6b709fe35a7e164_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2884	2026-07-17_b34be50c006643a3b6b709fe35a7e164_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2884	2026-07-17_b34be50c006643a3b6b709fe35a7e164_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2884	2026-07-17_b34be50c006643a3b6b709fe35a7e164_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2884	2026-07-17_b34be50c006643a3b6b709fe35a7e164_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2884	2026-07-17_b34be50c006643a3b6b709fe35a7e164_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2884	2026-07-17_b34be50c006643a3b6b709fe35a7e164_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2884	2026-07-17_b34be50c006643a3b6b709fe35a7e164_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2884	2026-07-17_b34be50c006643a3b6b709fe35a7e164_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2884	2026-07-17_b34be50c006643a3b6b709fe35a7e164_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2884	2026-07-17_b34be50c006643a3b6b709fe35a7e164_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2884	2026-07-17_b34be50c006643a3b6b709fe35a7e164_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2884	2026-07-17_b34be50c006643a3b6b709fe35a7e164_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2544	lgeywqoigbywqomg.exe
2544	lgeywqoigbywqomg.exe
2544	lgeywqoigbywqomg.exe
2544	lgeywqoigbywqomg.exe
2544	lgeywqoigbywqomg.exe
2544	lgeywqoigbywqomg.exe
2544	lgeywqoigbywqomg.exe
2544	lgeywqoigbywqomg.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5768	msedge.exe
5768	msedge.exe
5768	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	4544	i_tolgebwtol.exe
Token: SeDebugPrivilege	5516	i_dyvtqljdbv.exe
Token: SeDebugPrivilege	6916	i_dxvqkidavs.exe
Token: SeDebugPrivilege	1060	i_axvsnlfdxv.exe
Token: SeDebugPrivilege	2956	i_vpnhfzxspk.exe
Token: SeDebugPrivilege	5444	i_pmkhczxupn.exe
Token: SeDebugPrivilege	5512	i_zwupjhezxr.exe
Token: SeDebugPrivilege	6096	i_bzwurmjhec.exe
Token: SeDebugPrivilege	5072	i_ztrljebzto.exe
Token: SeDebugPrivilege	2732	i_trljdbvtol.exe
Token: SeDebugPrivilege	5980	i_aysqnigdyv.exe
Token: SeDebugPrivilege	1236	i_igayvqkiga.exe
Token: SeDebugPrivilege	4348	i_faysqkifax.exe
Token: SeDebugPrivilege	3148	i_ecauspnhfc.exe
Token: SeDebugPrivilege	1124	i_cwupmhezwu.exe
Token: SeDebugPrivilege	5960	i_ezwrpmhecw.exe
Token: SeDebugPrivilege	3404	i_wtrmjebwuo.exe
Token: SeDebugPrivilege	4112	i_wqoigbytrl.exe
Token: SeDebugPrivilege	4144	i_ljdbvtnlgd.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5768	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 2544	2884	2026-07-17_b34be50c006643a3b6b709fe35a7e164_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	91
PID 2884 wrote to memory of 4532	2884	2026-07-17_b34be50c006643a3b6b709fe35a7e164_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	92
PID 4532 wrote to memory of 5768	4532	iexplore.exe	93
PID 5768 wrote to memory of 5688	5768	msedge.exe	94
PID 5768 wrote to memory of 5696	5768	msedge.exe	96
PID 5768 wrote to memory of 1268	5768	msedge.exe	97
PID 5768 wrote to memory of 5616	5768	msedge.exe	98
PID 5768 wrote to memory of 5696	5768	msedge.exe	96
PID 5768 wrote to memory of 5696	5768	msedge.exe	96
PID 5768 wrote to memory of 5616	5768	msedge.exe	98
PID 5768 wrote to memory of 4312	5768	msedge.exe	99
PID 5768 wrote to memory of 4312	5768	msedge.exe	99
PID 5768 wrote to memory of 4312	5768	msedge.exe	99
PID 5768 wrote to memory of 4872	5768	msedge.exe	100
PID 5768 wrote to memory of 4872	5768	msedge.exe	100
PID 5768 wrote to memory of 4872	5768	msedge.exe	100
PID 5768 wrote to memory of 2348	5768	msedge.exe	103
PID 5768 wrote to memory of 2348	5768	msedge.exe	103
PID 5768 wrote to memory of 6788	5768	msedge.exe	104
PID 5768 wrote to memory of 6788	5768	msedge.exe	104
PID 2544 wrote to memory of 5732	2544	lgeywqoigbywqomg.exe	105
PID 5768 wrote to memory of 988	5768	msedge.exe	108
PID 4384 wrote to memory of 4224	4384	tolgebwtol.exe	110
PID 2544 wrote to memory of 6300	2544	lgeywqoigbywqomg.exe	115
PID 2544 wrote to memory of 4556	2544	lgeywqoigbywqomg.exe	119
PID 3372 wrote to memory of 5640	3372	dyvtqljdbv.exe	121
PID 2544 wrote to memory of 2836	2544	lgeywqoigbywqomg.exe	124
PID 2544 wrote to memory of 996	2544	lgeywqoigbywqomg.exe	128
PID 4640 wrote to memory of 4948	4640	dxvqkidavs.exe	130
PID 2544 wrote to memory of 5920	2544	lgeywqoigbywqomg.exe	133
PID 2544 wrote to memory of 5668	2544	lgeywqoigbywqomg.exe	138
PID 1756 wrote to memory of 5452	1756	axvsnlfdxv.exe	140
PID 2544 wrote to memory of 5772	2544	lgeywqoigbywqomg.exe	143
PID 5768 wrote to memory of 6244	5768	msedge.exe	145
PID 5768 wrote to memory of 6760	5768	msedge.exe	146
PID 5768 wrote to memory of 6688	5768	msedge.exe	147
PID 2544 wrote to memory of 3992	2544	lgeywqoigbywqomg.exe	150
PID 4764 wrote to memory of 5060	4764	vpnhfzxspk.exe	152
PID 2544 wrote to memory of 7012	2544	lgeywqoigbywqomg.exe	155
PID 2544 wrote to memory of 2444	2544	lgeywqoigbywqomg.exe	159
PID 4324 wrote to memory of 360	4324	pmkhczxupn.exe	161
PID 2544 wrote to memory of 5864	2544	lgeywqoigbywqomg.exe	164
PID 2544 wrote to memory of 6284	2544	lgeywqoigbywqomg.exe	168
PID 2128 wrote to memory of 4544	2128	zwupjhezxr.exe	170
PID 2544 wrote to memory of 692	2544	lgeywqoigbywqomg.exe	173
PID 2544 wrote to memory of 3484	2544	lgeywqoigbywqomg.exe	177
PID 6088 wrote to memory of 2712	6088	bzwurmjhec.exe	179
PID 2544 wrote to memory of 1852	2544	lgeywqoigbywqomg.exe	182
PID 5768 wrote to memory of 3816	5768	msedge.exe	184
PID 5768 wrote to memory of 3816	5768	msedge.exe	184
PID 2544 wrote to memory of 1692	2544	lgeywqoigbywqomg.exe	188
PID 2224 wrote to memory of 6740	2224	ztrljebzto.exe	190
PID 2544 wrote to memory of 2636	2544	lgeywqoigbywqomg.exe	193
PID 2544 wrote to memory of 2800	2544	lgeywqoigbywqomg.exe	197
PID 6108 wrote to memory of 3684	6108	trljdbvtol.exe	199
PID 2544 wrote to memory of 4936	2544	lgeywqoigbywqomg.exe	202
PID 2544 wrote to memory of 240	2544	lgeywqoigbywqomg.exe	206
PID 3440 wrote to memory of 6940	3440	aysqnigdyv.exe	208
PID 2544 wrote to memory of 6908	2544	lgeywqoigbywqomg.exe	211
PID 2544 wrote to memory of 4212	2544	lgeywqoigbywqomg.exe	215
PID 2448 wrote to memory of 6348	2448	igayvqkiga.exe	217
PID 2544 wrote to memory of 4720	2544	lgeywqoigbywqomg.exe	220
PID 5768 wrote to memory of 6344	5768	msedge.exe	224
PID 5768 wrote to memory of 6344	5768	msedge.exe	224

C:\Users\Admin\AppData\Local\Temp\2026-07-17_b34be50c006643a3b6b709fe35a7e164_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_b34be50c006643a3b6b709fe35a7e164_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Temp\lgeywqoigbywqomg.exe
  C:\Temp\lgeywqoigbywqomg.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2544
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tolgebwtol.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5732
  - - C:\Temp\tolgebwtol.exe
      C:\Temp\tolgebwtol.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4384
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4224
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3668
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tolgebwtol.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6300
  - - C:\Temp\i_tolgebwtol.exe
      C:\Temp\i_tolgebwtol.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4544
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dyvtqljdbv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4556
  - - C:\Temp\dyvtqljdbv.exe
      C:\Temp\dyvtqljdbv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3372
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5640
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3300
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dyvtqljdbv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2836
  - - C:\Temp\i_dyvtqljdbv.exe
      C:\Temp\i_dyvtqljdbv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5516
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dxvqkidavs.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:996
  - - C:\Temp\dxvqkidavs.exe
      C:\Temp\dxvqkidavs.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4640
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4948
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3472
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dxvqkidavs.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5920
  - - C:\Temp\i_dxvqkidavs.exe
      C:\Temp\i_dxvqkidavs.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6916
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\axvsnlfdxv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5668
  - - C:\Temp\axvsnlfdxv.exe
      C:\Temp\axvsnlfdxv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1756
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5452
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6292
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_axvsnlfdxv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5772
  - - C:\Temp\i_axvsnlfdxv.exe
      C:\Temp\i_axvsnlfdxv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1060
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vpnhfzxspk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3992
  - - C:\Temp\vpnhfzxspk.exe
      C:\Temp\vpnhfzxspk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4764
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5060
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1056
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vpnhfzxspk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:7012
  - - C:\Temp\i_vpnhfzxspk.exe
      C:\Temp\i_vpnhfzxspk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2956
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pmkhczxupn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2444
  - - C:\Temp\pmkhczxupn.exe
      C:\Temp\pmkhczxupn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4324
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:360
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2728
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pmkhczxupn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5864
  - - C:\Temp\i_pmkhczxupn.exe
      C:\Temp\i_pmkhczxupn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5444
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zwupjhezxr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6284
  - - C:\Temp\zwupjhezxr.exe
      C:\Temp\zwupjhezxr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2128
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4544
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3148
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zwupjhezxr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:692
  - - C:\Temp\i_zwupjhezxr.exe
      C:\Temp\i_zwupjhezxr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5512
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bzwurmjhec.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3484
  - - C:\Temp\bzwurmjhec.exe
      C:\Temp\bzwurmjhec.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6088
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2712
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4564
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bzwurmjhec.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1852
  - - C:\Temp\i_bzwurmjhec.exe
      C:\Temp\i_bzwurmjhec.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6096
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ztrljebzto.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1692
  - - C:\Temp\ztrljebzto.exe
      C:\Temp\ztrljebzto.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2224
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6740
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1700
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ztrljebzto.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2636
  - - C:\Temp\i_ztrljebzto.exe
      C:\Temp\i_ztrljebzto.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5072
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\trljdbvtol.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2800
  - - C:\Temp\trljdbvtol.exe
      C:\Temp\trljdbvtol.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6108
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3684
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5728
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_trljdbvtol.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4936
  - - C:\Temp\i_trljdbvtol.exe
      C:\Temp\i_trljdbvtol.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2732
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\aysqnigdyv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:240
  - - C:\Temp\aysqnigdyv.exe
      C:\Temp\aysqnigdyv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3440
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6940
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5484
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_aysqnigdyv.exe ups_ins
    3⤵
    PID:6908
  - - C:\Temp\i_aysqnigdyv.exe
      C:\Temp\i_aysqnigdyv.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5980
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\igayvqkiga.exe ups_run
    3⤵
    PID:4212
  - - C:\Temp\igayvqkiga.exe
      C:\Temp\igayvqkiga.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2448
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6348
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3536
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_igayvqkiga.exe ups_ins
    3⤵
    PID:4720
  - - C:\Temp\i_igayvqkiga.exe
      C:\Temp\i_igayvqkiga.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1236
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\faysqkifax.exe ups_run
    3⤵
    PID:2524
  - - C:\Temp\faysqkifax.exe
      C:\Temp\faysqkifax.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4692
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3248
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2596
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_faysqkifax.exe ups_ins
    3⤵
    PID:5192
  - - C:\Temp\i_faysqkifax.exe
      C:\Temp\i_faysqkifax.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4348
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ecauspnhfc.exe ups_run
    3⤵
    PID:5272
  - - C:\Temp\ecauspnhfc.exe
      C:\Temp\ecauspnhfc.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4632
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5400
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5900
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ecauspnhfc.exe ups_ins
    3⤵
    PID:1948
  - - C:\Temp\i_ecauspnhfc.exe
      C:\Temp\i_ecauspnhfc.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3148
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cwupmhezwu.exe ups_run
    3⤵
    PID:6264
  - - C:\Temp\cwupmhezwu.exe
      C:\Temp\cwupmhezwu.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3988
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5080
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2680
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cwupmhezwu.exe ups_ins
    3⤵
    PID:2876
  - - C:\Temp\i_cwupmhezwu.exe
      C:\Temp\i_cwupmhezwu.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1124
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ezwrpmhecw.exe ups_run
    3⤵
    PID:1700
  - - C:\Temp\ezwrpmhecw.exe
      C:\Temp\ezwrpmhecw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1696
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:704
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3528
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ezwrpmhecw.exe ups_ins
    3⤵
    PID:6092
  - - C:\Temp\i_ezwrpmhecw.exe
      C:\Temp\i_ezwrpmhecw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5960
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wtrmjebwuo.exe ups_run
    3⤵
    PID:5212
  - - C:\Temp\wtrmjebwuo.exe
      C:\Temp\wtrmjebwuo.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4748
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1344
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5824
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wtrmjebwuo.exe ups_ins
    3⤵
    PID:1388
  - - C:\Temp\i_wtrmjebwuo.exe
      C:\Temp\i_wtrmjebwuo.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3404
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wqoigbytrl.exe ups_run
    3⤵
    PID:4992
  - - C:\Temp\wqoigbytrl.exe
      C:\Temp\wqoigbytrl.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6836
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5840
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3716
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wqoigbytrl.exe ups_ins
    3⤵
    PID:2572
  - - C:\Temp\i_wqoigbytrl.exe
      C:\Temp\i_wqoigbytrl.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4112
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljdbvtnlgd.exe ups_run
    3⤵
    PID:3648
  - - C:\Temp\ljdbvtnlgd.exe
      C:\Temp\ljdbvtnlgd.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4240
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1056
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6472
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljdbvtnlgd.exe ups_ins
    3⤵
    PID:5596
  - - C:\Temp\i_ljdbvtnlgd.exe
      C:\Temp\i_ljdbvtnlgd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4144
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x2cc,0x7ff9505fc188,0x7ff9505fc194,0x7ff9505fc1a0
      4⤵
      PID:5688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,10358925492559109129,566902713167925331,262144 --field-trial-handle=2396,i,7452993511138106649,7007257232132045420,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:2
      4⤵
      PID:5696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,9483086931799479450,8613312883664277238,524288 --field-trial-handle=2396,i,7452993511138106649,7007257232132045420,262144 --variations-seed-version --mojo-platform-channel-handle=3256 /prefetch:11
      4⤵
      System Time Discovery
      PID:1268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2340,i,7954405552256240792,1217121257190674202,524288 --field-trial-handle=2396,i,7452993511138106649,7007257232132045420,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:13
      4⤵
      PID:5616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3216,i,9297434816301911625,12997544687945297850,2097152 --field-trial-handle=2396,i,7452993511138106649,7007257232132045420,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
      4⤵
      PID:4312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3220,i,13788116709440685887,7478344489204406527,2097152 --field-trial-handle=2396,i,7452993511138106649,7007257232132045420,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
      4⤵
      PID:4872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,4926482749886295131,3606083027998002996,524288 --field-trial-handle=2396,i,7452993511138106649,7007257232132045420,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:14
      4⤵
      PID:2348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,8833917767630850878,3518377936254069209,524288 --field-trial-handle=2396,i,7452993511138106649,7007257232132045420,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:14
      4⤵
      PID:6788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5660,i,5360035971678872358,12313472335784441580,524288 --field-trial-handle=2396,i,7452993511138106649,7007257232132045420,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:14
      4⤵
      PID:3364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5660,i,5360035971678872358,12313472335784441580,524288 --field-trial-handle=2396,i,7452993511138106649,7007257232132045420,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:14
      4⤵
      PID:988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5744,i,7458071697582948518,8187481824267576977,524288 --field-trial-handle=2396,i,7452993511138106649,7007257232132045420,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:14
      4⤵
      PID:6244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,16150894726669945235,5828235719979732941,524288 --field-trial-handle=2396,i,7452993511138106649,7007257232132045420,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:14
      4⤵
      PID:6760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,13485307331875001177,4520234806098705737,524288 --field-trial-handle=2396,i,7452993511138106649,7007257232132045420,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:14
      4⤵
      PID:6688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,4093957291628405393,5262641953711148054,524288 --field-trial-handle=2396,i,7452993511138106649,7007257232132045420,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
      4⤵
      PID:3816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,17561503823334575577,615375198293815772,524288 --field-trial-handle=2396,i,7452993511138106649,7007257232132045420,262144 --variations-seed-version --mojo-platform-channel-handle=940 /prefetch:14
      4⤵
      PID:6344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,17736074972841737448,6865438156933798537,524288 --field-trial-handle=2396,i,7452993511138106649,7007257232132045420,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:14
      4⤵
      PID:4380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5272,i,13807767692638034492,4259013681110167037,262144 --field-trial-handle=2396,i,7452993511138106649,7007257232132045420,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:10
      4⤵
      PID:6916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5456,i,6522808732662949332,8137348771378681996,524288 --field-trial-handle=2396,i,7452993511138106649,7007257232132045420,262144 --variations-seed-version --mojo-platform-channel-handle=3128 /prefetch:14
      4⤵
      PID:4628

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3956

C:\Temp\lgeywqoigbywqomg.sys
C:\Temp\lgeywqoigbywqomg.sys
1⤵
- Executes dropped EXE
PID:1056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2084

C:\Temp\vtgdyvqoig.sys
C:\Temp\vtgdyvqoig.sys
1⤵
- Executes dropped EXE
PID:980

C:\Temp\tnlidbvtnl.sys
C:\Temp\tnlidbvtnl.sys
1⤵
- Executes dropped EXE
PID:1636

C:\Temp\dxvqnlidav.sys
C:\Temp\dxvqnlidav.sys
1⤵
- Executes dropped EXE
PID:796

C:\Temp\xspkicausm.sys
C:\Temp\xspkicausm.sys
1⤵
- Executes dropped EXE
PID:2556

C:\Temp\mkhczxrpnk.sys
C:\Temp\mkhczxrpnk.sys
1⤵
- Executes dropped EXE
PID:5776

C:\Temp\pkhcausmke.sys
C:\Temp\pkhcausmke.sys
1⤵
- Executes dropped EXE
PID:1840

C:\Temp\bzurmjhecw.sys
C:\Temp\bzurmjhecw.sys
1⤵
- Executes dropped EXE
PID:5540

C:\Temp\jhbztrljeb.sys
C:\Temp\jhbztrljeb.sys
1⤵
- Executes dropped EXE
PID:4932

C:\Temp\tqljdbywqo.sys
C:\Temp\tqljdbywqo.sys
1⤵
- Executes dropped EXE
PID:3024

C:\Temp\ljdbwqnljd.sys
C:\Temp\ljdbwqnljd.sys
1⤵
- Executes dropped EXE
PID:3324

C:\Temp\oigaysqkid.sys
C:\Temp\oigaysqkid.sys
1⤵
PID:6788

C:\Temp\fcavsqkica.sys
C:\Temp\fcavsqkica.sys
1⤵
PID:7036

C:\Temp\causmkiczx.sys
C:\Temp\causmkiczx.sys
1⤵
PID:4736

C:\Temp\mkecxusmke.sys
C:\Temp\mkecxusmke.sys
1⤵
PID:4580

C:\Temp\ezwurpjhbz.sys
C:\Temp\ezwurpjhbz.sys
1⤵
PID:5044

C:\Temp\zwuomgeywu.sys
C:\Temp\zwuomgeywu.sys
1⤵
PID:1408

C:\Temp\wqoigbytrl.sys
C:\Temp\wqoigbytrl.sys
1⤵
PID:2916

C:\Temp\ytqojgbywq.sys
C:\Temp\ytqojgbywq.sys
1⤵
PID:4308

C:\Temp\sqoigaytql.sys
C:\Temp\sqoigaytql.sys
1⤵
PID:5256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

axvsnlfdxv.exe

Path C:\Temp\axvsnlfdxv.exe
Size 361KB
SHA256 e83978b4c48cb7ecd1298721e247123835d572f35169b8c5eeb4deb05fe3002d
MD5 461fc1d65abcd5335b070f176e49fabd
SHA1 f7d8e2929b528bedcec1e0a0e6679b00c5dedd7d
SHA512 6e417d80eca5ba6eee70afd50bf67b4b47024ac9d9d87c6eb60c39d6b33212dcaa65401cb539695a30f6b588a6a171f7e0476dc6962b21befe4b7ced2b9a6c94
SSDEEP 6144:FflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:FflfAsiVGjSGecvX
TLSH
T105747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxvqkidavs.exe

Path C:\Temp\dxvqkidavs.exe
Size 361KB
SHA256 769f094f72b71e9f5da687d16a7352b2ad7b8b0224729420bc6f0d35af746642
MD5 f8f722b43f78670a15b6d8f84b36179e
SHA1 9a7f9d51b700b50169d4fc395f17b208ca523da2
SHA512 372bc09e84432270f97eaa30744be0c014d0cead3934bf8cbd953a19f811eb0f3e973ec2889b3d2e4329cd38dc04bef425564e67041cf4fd77583caff42c3f18
SSDEEP 6144:hflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:hflfAsiVGjSGecvX
TLSH
T1EA747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxvqnlidav.sys

Path C:\Temp\dxvqnlidav.sys
Size 293KB
SHA256 83936a34865386ca71fbaec6edf7e75eef3d50e1dcb6d6ffc33bffa0fc346ce8
MD5 72cefd4f2e0fec2ffedcd37a9cb255b7
SHA1 815a02bfa4bbd603f8c962c44633c026ca3e71a2
SHA512 4630158c01dfb50d5a645281fdc0e4220564f20e4cb985db9754fb5d5ac467f92459a9d88c73b6e36e12fab5f44b07dd38269005adc757283d0eb737d0ad1dc6
SSDEEP 3072:gtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:gIJjiJcbI03GBc3ucY5DCSj
TLSH
T126545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dyvtqljdbv.exe

Path C:\Temp\dyvtqljdbv.exe
Size 361KB
SHA256 abf7a21d066953df25b992642ffd1f9191f3b2be831a63e45d56a51a7876ea85
MD5 a8496aaa8a7ab1f98ada37849345123f
SHA1 49490536b712456f4c80a8c67e5557f999218001
SHA512 34a8c2716c1d85f448a114febecc3d93240ce4c71db59cdc2228d0d7642a6f2d8866b60f9f9fe15c29e8bf81f4fa527909a883b383abad35cf9d3ef0f00a12c5
SSDEEP 6144:+flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:+flfAsiVGjSGecvX
TLSH
T186747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_axvsnlfdxv.exe

Path C:\Temp\i_axvsnlfdxv.exe
Size 361KB
SHA256 1e6efba611eba35de49167d294d35d0153c482981fda0f04dfe31eea32b1a3a1
MD5 330e9f74820ee5598323e8d0da5a2bba
SHA1 3705ac5d26c43728945f044518de1153ca5e07e6
SHA512 cbefc1296604334de7bc1bbdfedf029610a7ac0969e11a87870c873ce77d842a2a3cebfb3b3f3f2bcb7501541bee80a605bec504b96ae864ce629e5c02334c1a
SSDEEP 6144:vflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:vflfAsiVGjSGecvX
TLSH
T196747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dxvqkidavs.exe

Path C:\Temp\i_dxvqkidavs.exe
Size 361KB
SHA256 b5d85dde0d4e6605089b7938503bcb65b7b3db2014b27b3c9f8579b972cc1d11
MD5 c3b394e992faf00aaabe562a3be1aae1
SHA1 80fad36f24bc2d7dc66631b22d4dc7868a4d6c7d
SHA512 d46255edfa0190c24473f81827fcacd861e9b314422f7d90d3fc6792e021e91d1111c8c67c8cb7a9633e328e561666ea18dec24557b22ab799c492a839c2dbaf
SSDEEP 6144:8flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:8flfAsiVGjSGecvX
TLSH
T16E747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dyvtqljdbv.exe

Path C:\Temp\i_dyvtqljdbv.exe
Size 361KB
SHA256 d9884cbafbd037cf262ef4f14111b215f2a7765a9fe81f7a307de21cdeb511fc
MD5 749f8150bc963b3d36b1ad9e223748b1
SHA1 243f1055c640a9757b0a33a7d1b600ead8d3d968
SHA512 594d9fc458ec8dc52d98101cccad6da2dc474694b7f5e5e43ad19a3eca6f6d0acab77f839cef9e387db2330397c16c7671bb360d8b2592787410b677846287a7
SSDEEP 6144:aflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:aflfAsiVGjSGecvX
TLSH
T1B6747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pmkhczxupn.exe

Path C:\Temp\i_pmkhczxupn.exe
Size 361KB
SHA256 250d32b1a903566a48fe54f4121ed430caac9237b3cf61a7d3681af3db073e26
MD5 0056a8a29cb20ba63ed9a5223b463b3e
SHA1 7d14cd30b7455858e60ac5212732fd26113e16b2
SHA512 158b76d53e0589fda6cfc9a27160957ffddf712804f40c4d4ceffded1fff2806af501ad999cd741019a7fed5ff9a793d5bf4c2e1155ea02a2c75bd25763e8d11
SSDEEP 6144:TflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:TflfAsiVGjSGecvX
TLSH
T125747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tolgebwtol.exe

Path C:\Temp\i_tolgebwtol.exe
Size 361KB
SHA256 6e94125db40a00842ad6166040fee648aa04e2c9799b750ea880ae36582cf101
MD5 088d0e663237851704a314426f2366f5
SHA1 bc840eb9a789fd07316337daea40314ab3488ee4
SHA512 4313236c345c328913965131ce02feb902d6d1f9f0d6aa45e8fef401bf199efb5d1b951ab0ae53f8dd6998207d0b5ccecd970c0f84d27de41cdc00d8bce54d36
SSDEEP 6144:xflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:xflfAsiVGjSGecvX
TLSH
T14F747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vpnhfzxspk.exe

Path C:\Temp\i_vpnhfzxspk.exe
Size 361KB
SHA256 7d1f4e1a59433f08976a1cba941a166bc8b3d31a55e854097dea836f7306b45f
MD5 dc09429826e8d0b7fcde07414a6f6c88
SHA1 7919b5a77aa3d98f2f6f90e5df65a04acb08a285
SHA512 ce2c65ad1fa5fb259962e202d84e566f5b4eb200f2e6168fa8229e67b97d67eb19e70a38f222bf5310f5995d33117161658fcbd68248914353d30e57cd198c67
SSDEEP 6144:0flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:0flfAsiVGjSGecvX
TLSH
T132747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgeywqoigbywqomg.exe

Path C:\Temp\lgeywqoigbywqomg.exe
Size 361KB
SHA256 90de9ce64be4e16d21f4ac8f7d676f9f128a1501fc4027c35bbf9bba3dc6d443
MD5 8cb3a553f51ae459a4421d7f51cdda55
SHA1 fd48478a74876e18337f764d1dfcb6c043764908
SHA512 e76cd652e042392beaff8c0d23e8a03ebed10fa0c7e474678fbd11f384a85f0dfdd8c06aad40911fb2e60aefd716379526af4ddf4e36717dd7c1e9c750e05583
SSDEEP 6144:PflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:PflfAsiVGjSGecvX
TLSH
T1E3747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgeywqoigbywqomg.sys

Path C:\Temp\lgeywqoigbywqomg.sys
Size 293KB
SHA256 0b6ebd113319e57918be80cefd8a49ecc936413e3b038bffcd30a93d93b1379e
MD5 ab9c4f780aca6d5c5f955e3ff033c0ce
SHA1 e7f79808126887f53507ddf76211e86bd4eec644
SHA512 f0019e29c259bfca4bf0da983f82b17e4e0a3904c8d983fab5133114ef4a700354fa443f6be12cebb64c7ea6c79041e1d2e2b2ba8f59fc1a4fcbb46a07fd636b
SSDEEP 3072:jtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:jIJjiJcbI03GBc3ucY5DCSj
TLSH
T17A545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkhczxrpnk.sys

Path C:\Temp\mkhczxrpnk.sys
Size 293KB
SHA256 52837fb1d809c54c5c5a0a202bb13626fd0965906252b556a7b0055152078842
MD5 804252a9c2710624865645f18a41595e
SHA1 6887a9596bd27f80572031efeb2bb565f3851423
SHA512 560f07b38333c7a4ad463c52212f157750c9a7b984f4e947db1fe511235781cc27a2d25b482ea0dbe65a72f1231b589c58d4536edd4ce231087bc610ecaea618
SSDEEP 3072:GtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:GIJjiJcbI03GBc3ucY5DCSj
TLSH
T16A545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkhcausmke.sys

Path C:\Temp\pkhcausmke.sys
Size 293KB
SHA256 caf911bbd961b2a634f512e3b033db72195e186f22e46e1e29df21d8c92f288e
MD5 45ee1df10ee0be94a340242af83007b2
SHA1 ef254c949e952484d580d3253c287a191eeeb1f1
SHA512 6a3adb90daea6bb4819051efd1f1e0ad279db824723ee4bfbc75f7efb2e3847c85894b4481a2e526530cf1714cc522dd0e6ee0081b0572c73ad3b5337d59c396
SSDEEP 3072:jtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:jIJjiJcbI03GBc3ucY5DCSj
TLSH
T136545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmkhczxupn.exe

Path C:\Temp\pmkhczxupn.exe
Size 361KB
SHA256 10e20736be8855ffa9576885ca8b0d1d5eb82f30183b181b90047673cd1e5287
MD5 d8b71453b18ca4439adeff2b57bd449c
SHA1 f6e231fd66343399214dbc96ba7ede17c1c47b22
SHA512 c2fa56c8fc8606f34e7c06bc9949d78df726ca831f6c75fb2fff0213bdf4d3786baed5b7a62c2ede68c01381409676b6717ae4cf4323896146b243b86a428f5e
SSDEEP 6144:3flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:3flfAsiVGjSGecvX
TLSH
T1CB747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnlidbvtnl.sys

Path C:\Temp\tnlidbvtnl.sys
Size 293KB
SHA256 a13768d97db2319b84db898aeadea4f1e18ef8480def478b1dede364e5aa5dfc
MD5 2ade8e64f02a289cc26e52dfb1b2b775
SHA1 76683aea62890bb42d18643a11ffc14afaacbeb6
SHA512 ba48e721bf25bde0459e8dcc75296deff26570a7cd3b3412e4093054978462f6d70ec2dcf2e6fded26cdc31e9cdd580702e4e1e8bbb93969b684867c4dedcc52
SSDEEP 3072:YtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:YIJjiJcbI03GBc3ucY5DCSj
TLSH
T171545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tolgebwtol.exe

Path C:\Temp\tolgebwtol.exe
Size 361KB
SHA256 acb590cf756ccf922218d0d27387c1da5703bde37dbc66b249cce87ea71c5ecc
MD5 eb621807a1bac99c95e4c299a542a7ef
SHA1 6b9dfeb899adda9d86677f7190ce664545921862
SHA512 6ea7cba66280923a0059cac4756262d9b845e6b5cc56bf9308e199630f0c8786dbf1a7c42427fe66d741dd36535ea066c5fe07c0a3b526d1063b9e69e9fd962e
SSDEEP 6144:uflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:uflfAsiVGjSGecvX
TLSH
T1E3747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vpnhfzxspk.exe

Path C:\Temp\vpnhfzxspk.exe
Size 361KB
SHA256 a5ce5582553086181bfb671508b9c8d70e315e33b4306ef2bc5be52cc18840d0
MD5 3894e65678da082732ea4f43f3173240
SHA1 09c3ca025aba8f4b7e937aac6f247d791d54af2c
SHA512 ba84626c27e5bfedce54e80fcaaaafe8612b48694fd8763701b604d76b66359528d1757c47f3c1bc0d857b9e0183486130e92c0e9fded1af41b2a0622906765e
SSDEEP 6144:uflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:uflfAsiVGjSGecvX
TLSH
T1C1747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtgdyvqoig.sys

Path C:\Temp\vtgdyvqoig.sys
Size 293KB
SHA256 47a6a69741e96a51b35f4d4ac1ea54814763e33f95b3341d3333dd1009e7c581
MD5 924c5039a3177b64c6ddfa28ba14c93e
SHA1 6e00873a053ed52d8224eddc5339bcd916bfc291
SHA512 963a948bc73bafd6dde382e0e00fe0da172b3a85b5e451a2ddb679262faa3b8cc5af9aafcf731b65d1a384a2eb0248de9748a11652b60dfbeb9a43acbce6ac25
SSDEEP 3072:WtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:WIJjiJcbI03GBc3ucY5DCSj
TLSH
T182545B44AAA4B0F6D9D5043C00EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xspkicausm.sys

Path C:\Temp\xspkicausm.sys
Size 293KB
SHA256 d24bb8499ba836dc47bb46f8f147deb9466d98432a36da8c83ba0b1318755ee3
MD5 716644ebc81d9d881801d799196fbc0a
SHA1 53b6772383a7f8413ad38e6078758cb10e26ed75
SHA512 fa04ab085956a6f7e7effa3489145b08503ed8f26c642c17bc3309d38a730045eb32d385b1126c3f44d9a6dc6bd348c1429dbc77041c79bde312d616d02ffc72
SSDEEP 3072:StKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:SIJjiJcbI03GBc3ucY5DCSj
TLSH
T127545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zwupjhezxr.exe

Path C:\Temp\zwupjhezxr.exe
Size 361KB
SHA256 fd727b4cd57a4721d187b2b8d8e9da782942fc3885631e171e4b167b6534f341
MD5 f6bc3b1cd0462ff6aedd9742fb2bec53
SHA1 5786388c2e3f3f3545a4f440ab836f8685923d23
SHA512 646c635226d72a1e645f25c3f5ff0ee9b2f319e267bf1336bc36b5ce8003dfbe405d51a0def3f174030c04666e6814e52c8a0e101ae9874d592056de2132a2b8
SSDEEP 6144:2flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:2flfAsiVGjSGecvX
TLSH
T1BD747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e9e31f5fb014f6a7439a4e224bdae6d3d8b22db7c287d9c004b0184cc18e6bf8
MD5 00fe8112e1beaff1b09c3e772b0b70e6
SHA1 1d234f4d61d2fe0153bb63a7a246d37e6fc0aabe
SHA512 aaafc34862d38399e66858477aa9d3d624e9e071371fe2961aac0159845c41dbe1ed0ae62f8b9c52f327e4e4a97abdaf614ae741bcfd2627ec55b1d4f6fb6d74
TLSH
T1EAD08071B7286847D9551931D432CB017A57546365BAD1025160410C6C7BDB553CA155
MD5 SHA1 SHA512 TLSH

Submit Download

25e7506e-5d62-48b1-80db-479ceb4bfec5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\25e7506e-5d62-48b1-80db-479ceb4bfec5.tmp
Size 15KB
SHA256 d685cf12df9c204ceded96cdbd80c45e9ba790f9bd1e771d562a5e7b122b2129
MD5 2cf82f9708015e7b5211569fed2aaedd
SHA1 437a3b85017d53c9898164b53e8f0582f5a91be5
SHA512 2f8b519f596e24ec8bd49baaa5d9333708c58d2a90310b2a9490f5d7ac2a20099007415587b39b1e515a0a7d035bcb0d702e4d463d2038d9bc8cefa4da3b45fd
SSDEEP 384:sxRCe8e/fjsZiN/RIpMX/52/WngsGQNjQo:s2je/f0AWi/5sWngsGQOo
TLSH
T19472EA15A9289D7B9CCBD219FA957F93D6F8157392945E04AAFCCB0C00E66DC211382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 8ab1c844a8adff331af55832e4316923fd1ad068f19e7f71e8f3eda81cbf132b
MD5 6f3e90c1b20b4052b117e68e41b06e7d
SHA1 028cc25d2ceba031ad9c324227436ea0a01b4cfe
SHA512 85f74e06565c07f04b5d35b0745759a098dcb32776e63bd96d91ff1c9058a5a0fb32e2fb8823aa4a666f362f7723bc0cb29b8f7d8a9662cdac47f3372dd539ca
TLSH
T17FF02DA6D921BC3719FC5B1870955B47F750135B3B41984F3B3C820C8FB463B864681C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

e08ed190-f012-4abf-8501-7c3aba3b803b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e08ed190-f012-4abf-8501-7c3aba3b803b.tmp
Size 2KB
SHA256 3cf5383bb3f7066d8210ccf5e532558964b1d1ec826c15dfe8338577dfda7a71
MD5 0b6e1ec7cab13dc5cbcbeb8ef949e96d
SHA1 00af7e84da01fad1b60055d7876340be10d7d2eb
SHA512 80adb6919550d87f3ee724865d48bed5af4d1bfeb1b15c1f3d5d6f49c9dd2466cb60ce4c420849131b8e1c1900fedefc6e20e14c0e0e35eedd2026ae1988fccc
TLSH
T18941AFF783E4866EC90195F0AA18BE2BCE1C0515432C3D5A89E0AE1B93E2471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 9ec4cc567bda55c8bf669fa669d6e881373fc7ac9f9e59b5e55a91e327aa75f6
MD5 b5f79f57319ddb3122a9fd43c806c7ca
SHA1 5b5c3894635c202a285dcedade25f9481b7e0c4b
SHA512 2c736f7f996a6d2076fb876d5e79c5531a7feba8c86eb74003fa01c39410adb229e848811eced65789dc16489acc0f162bb1fc32057e46d0effaf0a5e3018093
SSDEEP 384:sxRCeqhe/fjs4eN/RIpMX/52/WnPsGQNsC:s2hhe/fVsWi/5sWnPsGQp
TLSH
T10C72F916A9385D3B9CCBD219FA957F93D2F8157392945E44AAFCCB0C00E66DC211382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 8aec5daafefb83f35638c76b088f1ca19ed398d6a53cbad428febc9db34493a5
MD5 8c0b9b7481d6a8f09de28e578c18aa79
SHA1 ac96ad9d9db5fe9174bac93a4e3d0c74d98f35d9
SHA512 20db593175a37ed5b791b41e0c4a767a1628a2e70c6eff9685791384e6872f43543a307f76af7e3f3d4e87b296d3b9a7bd50d631938305bd4d1362e43a9714ee
SSDEEP 768:Ob4YZx7pLuL7yTWg1NfwB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVRobbDwzro84N:Ob4YZnE7yTWg1NfwBu1jaCobHwADN
TLSH
T1F1E2EC3B280CCB7E4F804ADDEC29BD9A6DA801CF5AD8C95447FA450C03C6BEB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 0098816412c4782abea7f7106d202a64d80cd50c1589ac90654d6ce4f6e6d66d
MD5 005077ad61fc2ae8ab5caeed3c1657f2
SHA1 edf479d09d80637af4af549abef5638b7e04d785
SHA512 c932e35fa23e34989264af88d3bc4ec4e9e7f72ecc600df4521df7f587eba86c7e1111f5bf726a43c74a90563d7aea8074dd98dc218557288fb85c12cab0d7f3
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9EkRC2kyCtmfyuIwB0ns0X+CJDs3:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRQ
TLSH
T19EB25C51713F4680383EA91C9578981F92C2B4A37419F52F7BA801A65F6BE038DFE8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 6bb4fc6d14c4dc724a745aa4b3bcd2a11489e5a055c75631b6e4a095e5ad811b
MD5 4aeca434b2d5aa3db2cdf2ad0909add4
SHA1 c82a88e456931789345d09a40017b12118a1590a
SHA512 ce8cb297cb175859012535180de8c3a401ea432d8c974e9dd6618fe8a3d7416c9ca99768493471fd4ce0814a743d44b907b42c11def4e605399ac47870ddedff
SSDEEP 384:nfiF1tNn/s3n9Sn8NgH8TUNTUlIRiPvuTuz3REnf+GGrpNdshPWkLmOObjI9G6wc:qF1j+9SXHwgUuw3AGrfdsjm29MA
TLSH
T1FCC25A36EC65CEBBECE64F99B64A7A17EEE01167859C5AC4EAD81D0C00C31ED4703C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 150b4d04a0eecf8a74306e8d2614eb253a7af8964663739b14c048f9b9083da0
MD5 3a0d2760e14d09b7e9c347f8413dd3e7
SHA1 dd22d1b8ff343e41c9ae69266f7afc066857b7e9
SHA512 d871269e9f73965a49479e02b3cdd25d4565b5b0bdc4d81121b270f2d6b2fbce7b9bb3d0e11c1ddc67d8dfb7b466ada443db69134ed47214c25b87c6c01ce3c5
SSDEEP 384:n3iF1tNn/s3n9SCa8NLY8TUNTUlIRHPvuTpNyVMEnf+GGrpNdshPWmBp+F+5LOOQ:yF1j+99aQYwgpunyFGrfdsvPewL29MXQ
TLSH
T1CBD24B32DC64CEB7ECEA8F95B64A3A57DEE01163898C99D4E6C95E4C00C71DD470BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 13027b5093d91ef43e5c328d5351e0405bca42a03a22f44cfb8e5045e207122f
MD5 0ca0c8b2a28a55e8a1c3f8facb8ae118
SHA1 42d5a15cf54dad28ec6d18716724ee05b99ca056
SHA512 db98c23ad72608a4ef1a2e62d9254bac540f50ce6e95f3a3174f8599e4c622f1a6e71515a2c58453a4647feed53c6e0997cd82b5977e8e214dbb83412fe51737
SSDEEP 384:niiF1tNn/s3n9SCa8NLY8TUNTUlIRHPvuTwNyVMEnf+GGrpNdshPWmBp+F+5LOOQ:pF1j+99aQYwgpuAyFGrfdsvPewL29MXQ
TLSH
T13ED25B32DC64CEB7ECEA8F95B64A3A57DEE01163898C99D4E6C95E4C00C71DD470BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 1074f63fc90280c017c4a899786d233d777c96294eb42358c39405e367eab764
MD5 3fd1169445071cd31df97bdfb5be2e09
SHA1 54f25d3992a0a7e66263dab1f43a581738776d0d
SHA512 e27dcc34e7a3a36b73922b1681ddfee4c9f1c0dc1607e57b450d60625aae1f06eec312157065ab4779d7bd7081f854402b9be39fd75743b5ea9cc92c1e08530e
SSDEEP 768:qF1j+9TaQYwgpu6ybDFWUrfdsvPeLL29MXQ:v9TaQKu6gdoC2+XQ
TLSH
T106E2E5F198D78977E89E4B97637E2E569AFCC163B4888984B7C45D0CCC831BFC606806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 e09cec8aff471317f85a32eebd52762101655a5e735cb5ddd6933fe77873dfec
MD5 7a3d1a9a3df8573eac3f9aef35674db0
SHA1 1b63f757fedcb1530bb124f4702cd8d9a747f22b
SHA512 ecfe3804f2dc4c2a554d1660e2bcf20b5422ab907162241cf346df074fd814d2a13a38b3deb3ad0feb819df1db6fac6d7a5c75d928c7ff3b08f129c9a24c08e3
TLSH
T1CC4142E08C382AD1D4BE0E6E749B34FC94ECD726F4A0343D6858DA984A7964D654047F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 135487b3c0b56151c82a1d3dfe8123803f222d790edfe0f21e2a6920007fde1b
MD5 e1b1d30febdc8ca35c0d81e7707915aa
SHA1 549bcc1ac6bec67356243f7e2d4d2daf0d4259ac
SHA512 784718335ed02934a613434a255cd25bff6ef239051299312dde298149d14274d48a910c18279be6b2a680b59987f86527dc68157a63dc87fa1323965a8a6890
TLSH
T1D24141E09C392AD1D4BE0E6F749B34FC94E8D726F4A0343D6858E998477970D654047F
MD5 SHA1 SHA512 TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 2203620c6b2bb617312bf8f405b92001f65f57ee5f05bd176f0ceb893f10323d
MD5 0663f2b5da90ec73272d1d82f3d6f410
SHA1 2ed690f5c5878830c6056c3ae9c2ccae91c9d1ae
SHA512 08eee8334c05778792b0659bcd51d0fcb22ff9ba4a137983a47c7a4bcaf2ba4a73ac71c58d6b663c543cc02c85446c1ff3f0471605badab7a47158391fb49c00
TLSH
T10C71008357A9D6B3C1DA9BF102835244F1BF227C072320200B915986EA30A7A64B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/796-207-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/980-152-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1056-61-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1408-361-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1636-187-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1840-269-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2556-220-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2916-365-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3024-283-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3324-305-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4308-384-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4580-339-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4736-328-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4932-279-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5044-343-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5256-388-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5540-275-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5776-233-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6788-303-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/7036-317-0x0000000000010000-0x00000000000AB000-memory.dmp

Download