systex | 4761df116ab92fd926e68da72f952e75bf489a4ce16a13d41c3138f50c48d6f8

Analysis

max time kernel
150s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 13:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_841712443e066451d8e465879e735fb0_amadey_darkgate_elex_smoke-loader_stop.exe
Size 384KB
Sample260720-qag8wsa13l
SHA256 4761df116ab92fd926e68da72f952e75bf489a4ce16a13d41c3138f50c48d6f8
MD5 841712443e066451d8e465879e735fb0
SHA1 ea78bb6b10fb680df2534e05081edc2b949f4fd0
SHA512 2c96d7d1e59d2eabfe4493ec5134741849752fc7b72ee5cda722746be55750f21ae2a76bb92e4a7655d380704a86cab1790fbc5de676fd9a1dc4d4c147accb45
SSDEEP 3072:Y9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:actFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T16B847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
3328	fzxrpkhcausmkecx.exe
3608	fzxrpkhcausmkecx.sys
4436	CreateProcess.exe
832	hczxspkhfz.exe
2544	CreateProcess.exe
932	CreateProcess.exe
5396	i_hczxspkhfz.exe
4420	hbzurpjhcz.sys
5320	CreateProcess.exe
1496	zurpmhecwu.exe
3244	CreateProcess.exe
5840	CreateProcess.exe
2000	i_zurpmhecwu.exe
1864	ljebwuomjh.sys
5392	CreateProcess.exe
1256	jebzwuomje.exe
1080	CreateProcess.exe
4896	CreateProcess.exe
1776	i_jebzwuomje.exe
2520	eywuomgeyw.sys
1936	CreateProcess.exe
3368	ebwtomgeyw.exe
5572	CreateProcess.exe
2760	CreateProcess.exe
1344	i_ebwtomgeyw.exe
1888	vtrljdbytr.sys
1212	CreateProcess.exe
2208	lgdyvtnlgd.exe
3512	CreateProcess.exe
1216	CreateProcess.exe
3076	i_lgdyvtnlgd.exe
920	fdbywqolfd.sys
2648	CreateProcess.exe
5148	dyvqnifdyv.exe
4160	CreateProcess.exe
4184	CreateProcess.exe
5888	i_dyvqnifdyv.exe
5648	ysqkidavtn.sys
3676	CreateProcess.exe
3808	sqnifdxvsq.exe
3412	CreateProcess.exe
2960	CreateProcess.exe
560	i_sqnifdxvsq.exe
1948	sqkicausnk.sys
5364	CreateProcess.exe
1632	pnhfcxvpnh.exe
1344	CreateProcess.exe
4260	CreateProcess.exe
5476	i_pnhfcxvpnh.exe
1996	xspkicausn.sys
3464	CreateProcess.exe
2828	czxspkecxu.exe
4468	CreateProcess.exe
2876	CreateProcess.exe
2844	i_czxspkecxu.exe
4720	wusmkhczus.sys
4192	CreateProcess.exe
2516	wuspkhfzxu.exe
3860	CreateProcess.exe
5048	CreateProcess.exe
5484	i_wuspkhfzxu.exe
5200	urmkecwuom.sys
5928	CreateProcess.exe
804	pjhbzurmke.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4144_413105247\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4144_1061903015\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4144_1061903015\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhfcxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhbzurmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtrljgebwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgdyvtnlgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuspkhfzxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuspkhfzxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkezxupnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_841712443e066451d8e465879e735fb0_amadey_darkgate_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icavsnkfca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dyvqnifdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hczxspkhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zurpmhecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgdyvtnlgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbytqljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigdbvtnli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jheczurpmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jheczurpmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zurpmhecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebwtomgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkifdbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icausmkfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebwtomgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhfcxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhbzurmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jebzwuomje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dyvqnifdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czxspkecxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtrljgebwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbytqljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkifdbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icavsnkfca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkezxupnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxrpkhcausmkecx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hczxspkhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqnifdxvsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqnifdxvsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czxspkecxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigdbvtnli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icausmkfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jebzwuomje.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4652	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2928	ipconfig.exe
4176	ipconfig.exe
3868	ipconfig.exe
4700	ipconfig.exe
5404	ipconfig.exe
1332	ipconfig.exe
5672	ipconfig.exe
3080	ipconfig.exe
1224	ipconfig.exe
1640	ipconfig.exe
3016	ipconfig.exe
1012	ipconfig.exe
4592	ipconfig.exe
4684	ipconfig.exe
4700	ipconfig.exe
1204	ipconfig.exe
3324	ipconfig.exe
5144	ipconfig.exe
3436	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134290262112059438"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2246396966-3025826688-3847171515-1000\{EAB25D53-1894-486E-90E4-D556CCF88199}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2676	2026-07-20_841712443e066451d8e465879e735fb0_amadey_darkgate_elex_smoke-loader_stop.exe
2676	2026-07-20_841712443e066451d8e465879e735fb0_amadey_darkgate_elex_smoke-loader_stop.exe
2676	2026-07-20_841712443e066451d8e465879e735fb0_amadey_darkgate_elex_smoke-loader_stop.exe
2676	2026-07-20_841712443e066451d8e465879e735fb0_amadey_darkgate_elex_smoke-loader_stop.exe
2676	2026-07-20_841712443e066451d8e465879e735fb0_amadey_darkgate_elex_smoke-loader_stop.exe
2676	2026-07-20_841712443e066451d8e465879e735fb0_amadey_darkgate_elex_smoke-loader_stop.exe
2676	2026-07-20_841712443e066451d8e465879e735fb0_amadey_darkgate_elex_smoke-loader_stop.exe
2676	2026-07-20_841712443e066451d8e465879e735fb0_amadey_darkgate_elex_smoke-loader_stop.exe
2676	2026-07-20_841712443e066451d8e465879e735fb0_amadey_darkgate_elex_smoke-loader_stop.exe
2676	2026-07-20_841712443e066451d8e465879e735fb0_amadey_darkgate_elex_smoke-loader_stop.exe
2676	2026-07-20_841712443e066451d8e465879e735fb0_amadey_darkgate_elex_smoke-loader_stop.exe
2676	2026-07-20_841712443e066451d8e465879e735fb0_amadey_darkgate_elex_smoke-loader_stop.exe
2676	2026-07-20_841712443e066451d8e465879e735fb0_amadey_darkgate_elex_smoke-loader_stop.exe
2676	2026-07-20_841712443e066451d8e465879e735fb0_amadey_darkgate_elex_smoke-loader_stop.exe
2676	2026-07-20_841712443e066451d8e465879e735fb0_amadey_darkgate_elex_smoke-loader_stop.exe
2676	2026-07-20_841712443e066451d8e465879e735fb0_amadey_darkgate_elex_smoke-loader_stop.exe
2676	2026-07-20_841712443e066451d8e465879e735fb0_amadey_darkgate_elex_smoke-loader_stop.exe
2676	2026-07-20_841712443e066451d8e465879e735fb0_amadey_darkgate_elex_smoke-loader_stop.exe
2676	2026-07-20_841712443e066451d8e465879e735fb0_amadey_darkgate_elex_smoke-loader_stop.exe
2676	2026-07-20_841712443e066451d8e465879e735fb0_amadey_darkgate_elex_smoke-loader_stop.exe
2676	2026-07-20_841712443e066451d8e465879e735fb0_amadey_darkgate_elex_smoke-loader_stop.exe
2676	2026-07-20_841712443e066451d8e465879e735fb0_amadey_darkgate_elex_smoke-loader_stop.exe
2676	2026-07-20_841712443e066451d8e465879e735fb0_amadey_darkgate_elex_smoke-loader_stop.exe
2676	2026-07-20_841712443e066451d8e465879e735fb0_amadey_darkgate_elex_smoke-loader_stop.exe
2676	2026-07-20_841712443e066451d8e465879e735fb0_amadey_darkgate_elex_smoke-loader_stop.exe
2676	2026-07-20_841712443e066451d8e465879e735fb0_amadey_darkgate_elex_smoke-loader_stop.exe
2676	2026-07-20_841712443e066451d8e465879e735fb0_amadey_darkgate_elex_smoke-loader_stop.exe
2676	2026-07-20_841712443e066451d8e465879e735fb0_amadey_darkgate_elex_smoke-loader_stop.exe
2676	2026-07-20_841712443e066451d8e465879e735fb0_amadey_darkgate_elex_smoke-loader_stop.exe
2676	2026-07-20_841712443e066451d8e465879e735fb0_amadey_darkgate_elex_smoke-loader_stop.exe
2676	2026-07-20_841712443e066451d8e465879e735fb0_amadey_darkgate_elex_smoke-loader_stop.exe
2676	2026-07-20_841712443e066451d8e465879e735fb0_amadey_darkgate_elex_smoke-loader_stop.exe
2676	2026-07-20_841712443e066451d8e465879e735fb0_amadey_darkgate_elex_smoke-loader_stop.exe
2676	2026-07-20_841712443e066451d8e465879e735fb0_amadey_darkgate_elex_smoke-loader_stop.exe
2676	2026-07-20_841712443e066451d8e465879e735fb0_amadey_darkgate_elex_smoke-loader_stop.exe
2676	2026-07-20_841712443e066451d8e465879e735fb0_amadey_darkgate_elex_smoke-loader_stop.exe
2676	2026-07-20_841712443e066451d8e465879e735fb0_amadey_darkgate_elex_smoke-loader_stop.exe
2676	2026-07-20_841712443e066451d8e465879e735fb0_amadey_darkgate_elex_smoke-loader_stop.exe
2676	2026-07-20_841712443e066451d8e465879e735fb0_amadey_darkgate_elex_smoke-loader_stop.exe
2676	2026-07-20_841712443e066451d8e465879e735fb0_amadey_darkgate_elex_smoke-loader_stop.exe
2676	2026-07-20_841712443e066451d8e465879e735fb0_amadey_darkgate_elex_smoke-loader_stop.exe
2676	2026-07-20_841712443e066451d8e465879e735fb0_amadey_darkgate_elex_smoke-loader_stop.exe
2676	2026-07-20_841712443e066451d8e465879e735fb0_amadey_darkgate_elex_smoke-loader_stop.exe
2676	2026-07-20_841712443e066451d8e465879e735fb0_amadey_darkgate_elex_smoke-loader_stop.exe
2676	2026-07-20_841712443e066451d8e465879e735fb0_amadey_darkgate_elex_smoke-loader_stop.exe
2676	2026-07-20_841712443e066451d8e465879e735fb0_amadey_darkgate_elex_smoke-loader_stop.exe
2676	2026-07-20_841712443e066451d8e465879e735fb0_amadey_darkgate_elex_smoke-loader_stop.exe
2676	2026-07-20_841712443e066451d8e465879e735fb0_amadey_darkgate_elex_smoke-loader_stop.exe
2676	2026-07-20_841712443e066451d8e465879e735fb0_amadey_darkgate_elex_smoke-loader_stop.exe
2676	2026-07-20_841712443e066451d8e465879e735fb0_amadey_darkgate_elex_smoke-loader_stop.exe
2676	2026-07-20_841712443e066451d8e465879e735fb0_amadey_darkgate_elex_smoke-loader_stop.exe
2676	2026-07-20_841712443e066451d8e465879e735fb0_amadey_darkgate_elex_smoke-loader_stop.exe
3328	fzxrpkhcausmkecx.exe
2676	2026-07-20_841712443e066451d8e465879e735fb0_amadey_darkgate_elex_smoke-loader_stop.exe
3328	fzxrpkhcausmkecx.exe
2676	2026-07-20_841712443e066451d8e465879e735fb0_amadey_darkgate_elex_smoke-loader_stop.exe
3328	fzxrpkhcausmkecx.exe
2676	2026-07-20_841712443e066451d8e465879e735fb0_amadey_darkgate_elex_smoke-loader_stop.exe
3328	fzxrpkhcausmkecx.exe
2676	2026-07-20_841712443e066451d8e465879e735fb0_amadey_darkgate_elex_smoke-loader_stop.exe
3328	fzxrpkhcausmkecx.exe
3328	fzxrpkhcausmkecx.exe
3328	fzxrpkhcausmkecx.exe
3328	fzxrpkhcausmkecx.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	5396	i_hczxspkhfz.exe
Token: SeDebugPrivilege	2000	i_zurpmhecwu.exe
Token: SeDebugPrivilege	1776	i_jebzwuomje.exe
Token: SeDebugPrivilege	1344	i_ebwtomgeyw.exe
Token: SeDebugPrivilege	3076	i_lgdyvtnlgd.exe
Token: SeDebugPrivilege	5888	i_dyvqnifdyv.exe
Token: SeDebugPrivilege	560	i_sqnifdxvsq.exe
Token: SeDebugPrivilege	5476	i_pnhfcxvpnh.exe
Token: SeDebugPrivilege	2844	i_czxspkecxu.exe
Token: SeDebugPrivilege	5484	i_wuspkhfzxu.exe
Token: SeDebugPrivilege	6100	i_pjhbzurmke.exe
Token: SeDebugPrivilege	3424	i_wtrljgebwu.exe
Token: SeDebugPrivilege	4100	i_ljdbytqljd.exe
Token: SeDebugPrivilege	3376	i_oigdbvtnli.exe
Token: SeDebugPrivilege	2788	i_qkifdbvtnl.exe
Token: SeDebugPrivilege	5412	i_icavsnkfca.exe
Token: SeDebugPrivilege	3068	i_icausmkfcx.exe
Token: SeDebugPrivilege	3928	i_nkezxupnhf.exe
Token: SeDebugPrivilege	1556	i_jheczurpmh.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4144	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 3328	2676	2026-07-20_841712443e066451d8e465879e735fb0_amadey_darkgate_elex_smoke-loader_stop.exe	89
PID 2676 wrote to memory of 3884	2676	2026-07-20_841712443e066451d8e465879e735fb0_amadey_darkgate_elex_smoke-loader_stop.exe	90
PID 3884 wrote to memory of 4144	3884	iexplore.exe	91
PID 4144 wrote to memory of 944	4144	msedge.exe	92
PID 4144 wrote to memory of 2900	4144	msedge.exe	93
PID 4144 wrote to memory of 4652	4144	msedge.exe	94
PID 4144 wrote to memory of 2900	4144	msedge.exe	93
PID 4144 wrote to memory of 2900	4144	msedge.exe	93
PID 4144 wrote to memory of 1620	4144	msedge.exe	95
PID 4144 wrote to memory of 1620	4144	msedge.exe	95
PID 4144 wrote to memory of 4084	4144	msedge.exe	97
PID 4144 wrote to memory of 1908	4144	msedge.exe	98
PID 4144 wrote to memory of 4084	4144	msedge.exe	97
PID 4144 wrote to memory of 4084	4144	msedge.exe	97
PID 4144 wrote to memory of 1908	4144	msedge.exe	98
PID 4144 wrote to memory of 1908	4144	msedge.exe	98
PID 4144 wrote to memory of 364	4144	msedge.exe	99
PID 4144 wrote to memory of 364	4144	msedge.exe	99
PID 4144 wrote to memory of 364	4144	msedge.exe	99
PID 4144 wrote to memory of 236	4144	msedge.exe	100
PID 4144 wrote to memory of 236	4144	msedge.exe	100
PID 4144 wrote to memory of 236	4144	msedge.exe	100
PID 4144 wrote to memory of 848	4144	msedge.exe	101
PID 4144 wrote to memory of 848	4144	msedge.exe	101
PID 4144 wrote to memory of 6132	4144	msedge.exe	106
PID 4144 wrote to memory of 3724	4144	msedge.exe	105
PID 4144 wrote to memory of 6132	4144	msedge.exe	106
PID 4144 wrote to memory of 3724	4144	msedge.exe	105
PID 4144 wrote to memory of 2492	4144	msedge.exe	108
PID 3328 wrote to memory of 4436	3328	fzxrpkhcausmkecx.exe	110
PID 4144 wrote to memory of 1624	4144	msedge.exe	114
PID 4144 wrote to memory of 1624	4144	msedge.exe	114
PID 832 wrote to memory of 2544	832	hczxspkhfz.exe	115
PID 4144 wrote to memory of 5908	4144	msedge.exe	118
PID 4144 wrote to memory of 5908	4144	msedge.exe	118
PID 3328 wrote to memory of 932	3328	fzxrpkhcausmkecx.exe	119
PID 3328 wrote to memory of 5320	3328	fzxrpkhcausmkecx.exe	123
PID 1496 wrote to memory of 3244	1496	zurpmhecwu.exe	125
PID 3328 wrote to memory of 5840	3328	fzxrpkhcausmkecx.exe	128
PID 3328 wrote to memory of 5392	3328	fzxrpkhcausmkecx.exe	132
PID 1256 wrote to memory of 1080	1256	jebzwuomje.exe	134
PID 3328 wrote to memory of 4896	3328	fzxrpkhcausmkecx.exe	137
PID 3328 wrote to memory of 1936	3328	fzxrpkhcausmkecx.exe	142
PID 3368 wrote to memory of 5572	3368	ebwtomgeyw.exe	144
PID 3328 wrote to memory of 2760	3328	fzxrpkhcausmkecx.exe	147
PID 4144 wrote to memory of 5848	4144	msedge.exe	149
PID 4144 wrote to memory of 3576	4144	msedge.exe	150
PID 4144 wrote to memory of 4524	4144	msedge.exe	151
PID 3328 wrote to memory of 1212	3328	fzxrpkhcausmkecx.exe	154
PID 2208 wrote to memory of 3512	2208	lgdyvtnlgd.exe	156
PID 3328 wrote to memory of 1216	3328	fzxrpkhcausmkecx.exe	159
PID 3328 wrote to memory of 2648	3328	fzxrpkhcausmkecx.exe	163
PID 5148 wrote to memory of 4160	5148	dyvqnifdyv.exe	165
PID 3328 wrote to memory of 4184	3328	fzxrpkhcausmkecx.exe	168
PID 3328 wrote to memory of 3676	3328	fzxrpkhcausmkecx.exe	172
PID 3808 wrote to memory of 3412	3808	sqnifdxvsq.exe	174
PID 3328 wrote to memory of 2960	3328	fzxrpkhcausmkecx.exe	177
PID 3328 wrote to memory of 5364	3328	fzxrpkhcausmkecx.exe	181
PID 1632 wrote to memory of 1344	1632	pnhfcxvpnh.exe	183
PID 3328 wrote to memory of 4260	3328	fzxrpkhcausmkecx.exe	186
PID 4144 wrote to memory of 4776	4144	msedge.exe	188
PID 4144 wrote to memory of 4776	4144	msedge.exe	188
PID 3328 wrote to memory of 3464	3328	fzxrpkhcausmkecx.exe	194
PID 2828 wrote to memory of 4468	2828	czxspkecxu.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-07-20_841712443e066451d8e465879e735fb0_amadey_darkgate_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_841712443e066451d8e465879e735fb0_amadey_darkgate_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Temp\fzxrpkhcausmkecx.exe
  C:\Temp\fzxrpkhcausmkecx.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3328
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hczxspkhfz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4436
  - - C:\Temp\hczxspkhfz.exe
      C:\Temp\hczxspkhfz.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:832
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2544
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4700
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hczxspkhfz.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:932
  - - C:\Temp\i_hczxspkhfz.exe
      C:\Temp\i_hczxspkhfz.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5396
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zurpmhecwu.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5320
  - - C:\Temp\zurpmhecwu.exe
      C:\Temp\zurpmhecwu.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1496
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3244
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4684
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zurpmhecwu.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5840
  - - C:\Temp\i_zurpmhecwu.exe
      C:\Temp\i_zurpmhecwu.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2000
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jebzwuomje.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5392
  - - C:\Temp\jebzwuomje.exe
      C:\Temp\jebzwuomje.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1256
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1080
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4700
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jebzwuomje.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4896
  - - C:\Temp\i_jebzwuomje.exe
      C:\Temp\i_jebzwuomje.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1776
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ebwtomgeyw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1936
  - - C:\Temp\ebwtomgeyw.exe
      C:\Temp\ebwtomgeyw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3368
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5572
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3436
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ebwtomgeyw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2760
  - - C:\Temp\i_ebwtomgeyw.exe
      C:\Temp\i_ebwtomgeyw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1344
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lgdyvtnlgd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1212
  - - C:\Temp\lgdyvtnlgd.exe
      C:\Temp\lgdyvtnlgd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2208
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3512
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2928
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lgdyvtnlgd.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1216
  - - C:\Temp\i_lgdyvtnlgd.exe
      C:\Temp\i_lgdyvtnlgd.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3076
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dyvqnifdyv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2648
  - - C:\Temp\dyvqnifdyv.exe
      C:\Temp\dyvqnifdyv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5148
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4160
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5404
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dyvqnifdyv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4184
  - - C:\Temp\i_dyvqnifdyv.exe
      C:\Temp\i_dyvqnifdyv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5888
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqnifdxvsq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3676
  - - C:\Temp\sqnifdxvsq.exe
      C:\Temp\sqnifdxvsq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3808
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3412
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4176
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqnifdxvsq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2960
  - - C:\Temp\i_sqnifdxvsq.exe
      C:\Temp\i_sqnifdxvsq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:560
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pnhfcxvpnh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5364
  - - C:\Temp\pnhfcxvpnh.exe
      C:\Temp\pnhfcxvpnh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1632
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1344
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1640
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pnhfcxvpnh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4260
  - - C:\Temp\i_pnhfcxvpnh.exe
      C:\Temp\i_pnhfcxvpnh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5476
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\czxspkecxu.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3464
  - - C:\Temp\czxspkecxu.exe
      C:\Temp\czxspkecxu.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2828
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4468
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3016
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_czxspkecxu.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2876
  - - C:\Temp\i_czxspkecxu.exe
      C:\Temp\i_czxspkecxu.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2844
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wuspkhfzxu.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4192
  - - C:\Temp\wuspkhfzxu.exe
      C:\Temp\wuspkhfzxu.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2516
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3860
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1012
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wuspkhfzxu.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5048
  - - C:\Temp\i_wuspkhfzxu.exe
      C:\Temp\i_wuspkhfzxu.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5484
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pjhbzurmke.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5928
  - - C:\Temp\pjhbzurmke.exe
      C:\Temp\pjhbzurmke.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:804
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2232
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1204
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pjhbzurmke.exe ups_ins
    3⤵
    PID:5424
  - - C:\Temp\i_pjhbzurmke.exe
      C:\Temp\i_pjhbzurmke.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6100
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wtrljgebwu.exe ups_run
    3⤵
    PID:4264
  - - C:\Temp\wtrljgebwu.exe
      C:\Temp\wtrljgebwu.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5828
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4332
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3868
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wtrljgebwu.exe ups_ins
    3⤵
    PID:4828
  - - C:\Temp\i_wtrljgebwu.exe
      C:\Temp\i_wtrljgebwu.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3424
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljdbytqljd.exe ups_run
    3⤵
    PID:4340
  - - C:\Temp\ljdbytqljd.exe
      C:\Temp\ljdbytqljd.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6092
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4352
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3324
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljdbytqljd.exe ups_ins
    3⤵
    PID:1452
  - - C:\Temp\i_ljdbytqljd.exe
      C:\Temp\i_ljdbytqljd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4100
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\oigdbvtnli.exe ups_run
    3⤵
    PID:2836
  - - C:\Temp\oigdbvtnli.exe
      C:\Temp\oigdbvtnli.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4928
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3612
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4592
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_oigdbvtnli.exe ups_ins
    3⤵
    PID:3044
  - - C:\Temp\i_oigdbvtnli.exe
      C:\Temp\i_oigdbvtnli.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3376
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qkifdbvtnl.exe ups_run
    3⤵
    PID:6016
  - - C:\Temp\qkifdbvtnl.exe
      C:\Temp\qkifdbvtnl.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1696
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5888
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5144
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qkifdbvtnl.exe ups_ins
    3⤵
    PID:3052
  - - C:\Temp\i_qkifdbvtnl.exe
      C:\Temp\i_qkifdbvtnl.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2788
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\icavsnkfca.exe ups_run
    3⤵
    PID:4132
  - - C:\Temp\icavsnkfca.exe
      C:\Temp\icavsnkfca.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5180
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3104
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1332
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_icavsnkfca.exe ups_ins
    3⤵
    PID:1560
  - - C:\Temp\i_icavsnkfca.exe
      C:\Temp\i_icavsnkfca.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5412
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\icausmkfcx.exe ups_run
    3⤵
    PID:2612
  - - C:\Temp\icausmkfcx.exe
      C:\Temp\icausmkfcx.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5984
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5408
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5672
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_icausmkfcx.exe ups_ins
    3⤵
    PID:5812
  - - C:\Temp\i_icausmkfcx.exe
      C:\Temp\i_icausmkfcx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3068
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nkezxupnhf.exe ups_run
    3⤵
    PID:3720
  - - C:\Temp\nkezxupnhf.exe
      C:\Temp\nkezxupnhf.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1296
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4500
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3080
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nkezxupnhf.exe ups_ins
    3⤵
    PID:4548
  - - C:\Temp\i_nkezxupnhf.exe
      C:\Temp\i_nkezxupnhf.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3928
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jheczurpmh.exe ups_run
    3⤵
    PID:2540
  - - C:\Temp\jheczurpmh.exe
      C:\Temp\jheczurpmh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2012
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3096
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1224
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jheczurpmh.exe ups_ins
    3⤵
    PID:6032
  - - C:\Temp\i_jheczurpmh.exe
      C:\Temp\i_jheczurpmh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1556
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ojhbztrlje.exe ups_run
    3⤵
    PID:828
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffac4f0c188,0x7ffac4f0c194,0x7ffac4f0c1a0
      4⤵
      PID:944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,8535649373858663152,9133249628783217530,262144 --field-trial-handle=2364,i,2812998957131109958,2730815704605703429,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:2
      4⤵
      PID:2900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1928,i,779273229591884197,3851824528916722923,524288 --field-trial-handle=2364,i,2812998957131109958,2730815704605703429,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:11
      4⤵
      System Time Discovery
      PID:4652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2516,i,10371067480543837454,5733678293714454643,524288 --field-trial-handle=2364,i,2812998957131109958,2730815704605703429,262144 --variations-seed-version --mojo-platform-channel-handle=3188 /prefetch:13
      4⤵
      PID:1620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3612,i,10370890957770842787,3449777576001475282,2097152 --field-trial-handle=2364,i,2812998957131109958,2730815704605703429,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
      4⤵
      PID:4084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3604,i,6707282796388199111,7679447058540780266,2097152 --field-trial-handle=2364,i,2812998957131109958,2730815704605703429,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
      4⤵
      PID:1908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,4948014777382719254,17433841862687660183,2097152 --field-trial-handle=2364,i,2812998957131109958,2730815704605703429,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:1
      4⤵
      PID:364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,4792358838499796886,8093613515554423258,2097152 --field-trial-handle=2364,i,2812998957131109958,2730815704605703429,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:9
      4⤵
      PID:236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3920,i,14912301828209421924,18040995664735967574,524288 --field-trial-handle=2364,i,2812998957131109958,2730815704605703429,262144 --variations-seed-version --mojo-platform-channel-handle=3936 /prefetch:14
      4⤵
      PID:848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5456,i,12531561711182127085,16789954265311705234,524288 --field-trial-handle=2364,i,2812998957131109958,2730815704605703429,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:14
      4⤵
      PID:3724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,2821851266751279210,9588510567554350373,524288 --field-trial-handle=2364,i,2812998957131109958,2730815704605703429,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:14
      4⤵
      PID:6132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,1673887523435381419,77058716852562031,524288 --field-trial-handle=2364,i,2812998957131109958,2730815704605703429,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:14
      4⤵
      PID:3700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,1673887523435381419,77058716852562031,524288 --field-trial-handle=2364,i,2812998957131109958,2730815704605703429,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:14
      4⤵
      PID:2492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,13452313513993347814,3134560330879711771,524288 --field-trial-handle=2364,i,2812998957131109958,2730815704605703429,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:14
      4⤵
      PID:1624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6656,i,1064839347011214597,9784824852181911172,524288 --field-trial-handle=2364,i,2812998957131109958,2730815704605703429,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:14
      4⤵
      PID:5908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,9706825847447697223,17940864807840714433,524288 --field-trial-handle=2364,i,2812998957131109958,2730815704605703429,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:14
      4⤵
      PID:5848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6756,i,14186159208434250182,2438092399481831070,524288 --field-trial-handle=2364,i,2812998957131109958,2730815704605703429,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:14
      4⤵
      PID:3576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6752,i,11705440401695673615,2602963781356885409,524288 --field-trial-handle=2364,i,2812998957131109958,2730815704605703429,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:14
      4⤵
      PID:4524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2132,i,16521699300920819446,805167990030203194,524288 --field-trial-handle=2364,i,2812998957131109958,2730815704605703429,262144 --variations-seed-version --mojo-platform-channel-handle=2036 /prefetch:14
      4⤵
      PID:4776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=924,i,2805578962376596361,9376230134063746299,524288 --field-trial-handle=2364,i,2812998957131109958,2730815704605703429,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:14
      4⤵
      PID:3576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6208,i,12098025031923257690,3141826210592887174,262144 --field-trial-handle=2364,i,2812998957131109958,2730815704605703429,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:10
      4⤵
      PID:1720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,6655249673443210796,2177192968260966940,524288 --field-trial-handle=2364,i,2812998957131109958,2730815704605703429,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:14
      4⤵
      PID:2292

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4104

C:\Temp\fzxrpkhcausmkecx.sys
C:\Temp\fzxrpkhcausmkecx.sys
1⤵
- Executes dropped EXE
PID:3608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1496

C:\Temp\hbzurpjhcz.sys
C:\Temp\hbzurpjhcz.sys
1⤵
- Executes dropped EXE
PID:4420

C:\Temp\ljebwuomjh.sys
C:\Temp\ljebwuomjh.sys
1⤵
- Executes dropped EXE
PID:1864

C:\Temp\eywuomgeyw.sys
C:\Temp\eywuomgeyw.sys
1⤵
- Executes dropped EXE
PID:2520

C:\Temp\vtrljdbytr.sys
C:\Temp\vtrljdbytr.sys
1⤵
- Executes dropped EXE
PID:1888

C:\Temp\fdbywqolfd.sys
C:\Temp\fdbywqolfd.sys
1⤵
- Executes dropped EXE
PID:920

C:\Temp\ysqkidavtn.sys
C:\Temp\ysqkidavtn.sys
1⤵
- Executes dropped EXE
PID:5648

C:\Temp\sqkicausnk.sys
C:\Temp\sqkicausnk.sys
1⤵
- Executes dropped EXE
PID:1948

C:\Temp\xspkicausn.sys
C:\Temp\xspkicausn.sys
1⤵
- Executes dropped EXE
PID:1996

C:\Temp\wusmkhczus.sys
C:\Temp\wusmkhczus.sys
1⤵
- Executes dropped EXE
PID:4720

C:\Temp\urmkecwuom.sys
C:\Temp\urmkecwuom.sys
1⤵
- Executes dropped EXE
PID:5200

C:\Temp\bwurmjdbyw.sys
C:\Temp\bwurmjdbyw.sys
1⤵
PID:3044

C:\Temp\dbwtomgeyw.sys
C:\Temp\dbwtomgeyw.sys
1⤵
PID:3408

C:\Temp\lgdbvtnljg.sys
C:\Temp\lgdbvtnljg.sys
1⤵
PID:2592

C:\Temp\qnlfdyvqnl.sys
C:\Temp\qnlfdyvqnl.sys
1⤵
PID:1016

C:\Temp\lfdxvpnlfd.sys
C:\Temp\lfdxvpnlfd.sys
1⤵
PID:3324

C:\Temp\sqkhfdavsn.sys
C:\Temp\sqkhfdavsn.sys
1⤵
PID:4768

C:\Temp\pkhczuspkh.sys
C:\Temp\pkhczuspkh.sys
1⤵
PID:4604

C:\Temp\mkecwupmke.sys
C:\Temp\mkecwupmke.sys
1⤵
PID:4904

C:\Temp\omgezwrojh.sys
C:\Temp\omgezwrojh.sys
1⤵
PID:5200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dyvqnifdyv.exe

Path C:\Temp\dyvqnifdyv.exe
Size 384KB
SHA256 7bb623f76d5e2c66021fd41973fd0c3dc7222c1e8183e99f1abf7bb24ad4626b
MD5 bdec443c16df4700ff6327617f33091d
SHA1 560fa993441ae02169e293be15ad644b91bc49fa
SHA512 75280feb20a1b5f0de542bb1b8185f13f13abafa7cac64b9d3196bb1fba44fabf5a70bf9c145c264513161eef2921c6ad39f04beffd585b223d54e6d65fbdbc7
SSDEEP 3072:l9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:HctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T14A846A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ebwtomgeyw.exe

Path C:\Temp\ebwtomgeyw.exe
Size 384KB
SHA256 ab3842256db3e26a615a60e9b14ed9e3fb24b11f5db2e5a1dfef2445b0ce8342
MD5 9abdc91f504249ecf60eb1fde301a3f5
SHA1 55f70bfce224676297d116429d9dd21347143b6a
SHA512 03b332f4d9215b9ac4e6d46e77ba587928890d9b59f82958b202a25f2c996b8ec0e6656692f647adf0dec78a480e33c6d39fee42f22961b027c956ebc5b98420
SSDEEP 3072:09ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:OctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E0847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eywuomgeyw.sys

Path C:\Temp\eywuomgeyw.sys
Size 293KB
SHA256 e4ae7d159cd91efa2aa5139c3e42365468b3d3c60ecb1f97f9f601a0e6f75244
MD5 3c068aac5b3d347fe478220bd787dd17
SHA1 c792a2204fae09d85e6423720490c8ad3cf2a0b7
SHA512 48693ed2483ebbaf7bd9e8c85eb8fe32ccf701a293f687198d4e62387e0081ab1fbd5f2db2782cb21570ba321a75f4952cb57dddaa3ca023fb2723b9beb53d22
SSDEEP 3072:dtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:dIJjiJcbI03GBc3ucY5DCSj
TLSH
T14D545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdbywqolfd.sys

Path C:\Temp\fdbywqolfd.sys
Size 293KB
SHA256 93af9a9c30833d2a3593dfaef0853d18a7f367f390ca68cc8bd08a3598b1f929
MD5 e857c5bf6b1b528e2f143d886ed5afe0
SHA1 9d07acfa16ec606fa5e3a3b3a1078ec07a531a8c
SHA512 8ed6abc450d7627197bc75bcb7e36b792c3dfc27599d1f95a82e192af5dd1ea0453a650bf4f09842477891df78c414378904d69ae11bb1d09a668f9ea3ce7e1b
SSDEEP 3072:4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:4IJjiJcbI03GBc3ucY5DCSj
TLSH
T1C9545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fzxrpkhcausmkecx.exe

Path C:\Temp\fzxrpkhcausmkecx.exe
Size 384KB
SHA256 809089498da333fbdaaed59e5971031fb0c01de642760d6320e0363f87d4c397
MD5 4569501023b0e54631bdf34d6a60f2ed
SHA1 86ba9433ffc8e68def663d54828474fbd4b4e2ee
SHA512 e2f04d00300e7e34da15b5cda625d7b91c272eb261589575193309fe486dcd673fc2a6cb767db466f88cd9b052a50434b1e1b05d0d1bd19edb0efff88676a0e1
SSDEEP 3072:S9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:octFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T122847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fzxrpkhcausmkecx.sys

Path C:\Temp\fzxrpkhcausmkecx.sys
Size 293KB
SHA256 f11a6bb6043f6e0c31ee48023c425cf1866c8cc15777a3aad78f0c2100fff89a
MD5 96216366d302bdc867471c53c3b41baa
SHA1 bde0e6149410c9d899ad9abde1c21bf263eb5011
SHA512 7719d20d1134e49ae3a14e6ec301ebc2fdd0094c2e452c06666bb94932738d152b16e5efe4f1bcd4c9716668933e474aaec1a1a4e1de316260af69d9b6378523
SSDEEP 3072:htKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:hIJjiJcbI03GBc3ucY5DCSj
TLSH
T160545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hbzurpjhcz.sys

Path C:\Temp\hbzurpjhcz.sys
Size 293KB
SHA256 bef455fec76e22b8f002fc15e95e8e1cba6f824c9e940d406837d3f34b9b58fa
MD5 40ff5ff6d0439e5a876c2bdae25dd608
SHA1 c5ad8ff24ab4a9a25789fb3e51b7acd152300a21
SHA512 d604eb3f49889204362f9c305d142ab890916741d5b9062f499f811de717b4900c13c780c99f3ecaf989ecc61a4983c91d2badc5b248439fb6adc34ab6d15a44
SSDEEP 3072:ftKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:fIJjiJcbI03GBc3ucY5DCSj
TLSH
T1B4545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hczxspkhfz.exe

Path C:\Temp\hczxspkhfz.exe
Size 384KB
SHA256 b70ff7f5e21f45633b1712a55c62769d1873141d9d79cb91363c32f4c612f748
MD5 eda142b97ebc35ceec9ce12e425a07a6
SHA1 b1b60e003ecc6a53fd00b9bd38a644cf12fe510f
SHA512 023942cade8786d7426367fa40d789ef6ec0d4691cb5f43fc5ea3c3966dddce37332663fc67b3395caa641a2a3554ce6090be8067a12eee77dcf7e5273d823eb
SSDEEP 3072:o9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:qctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1FC847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ebwtomgeyw.exe

Path C:\Temp\i_ebwtomgeyw.exe
Size 384KB
SHA256 75abf3f3087da12187ee7d3fa84448b27a2b61c7a4318ef2e9f45ad2d47d492e
MD5 8ef9b562a452b44bbb9ec617799ab543
SHA1 63f933a1b915699026c5a7d259a178c6662e971a
SHA512 980302de21107d5849a8a20248835c0f8844729dc0056f0877f246516a3a4f0983fa6ff7e92da171f17bad7f104f1e0b8dafbd4e1063e0d901c0e45c8617e96a
SSDEEP 3072:P9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:VctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T14D847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hczxspkhfz.exe

Path C:\Temp\i_hczxspkhfz.exe
Size 384KB
SHA256 296fdc9b2996d51630464fd2f0cf127ea81f2ad3717894f66ec27afbc2dcd0aa
MD5 8686ac8abdef2079d0d887406c27cc4d
SHA1 89e69ac6471874011d81e03d929629309c22043f
SHA512 1c2932bb53a524187c159bf0df72bccd3dff6675e701bff5424046c303576926c0c909ede8ae2b7fe2598ea10003378d66cd8bd37b8565877b026740e5e34223
SSDEEP 3072:99ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:PctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T154847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jebzwuomje.exe

Path C:\Temp\i_jebzwuomje.exe
Size 384KB
SHA256 4d2ebd405a4c13a838858aa35813c3ed484f5a1f6b390d3451efddaba5016021
MD5 2ee8d2d8c5ccfb54d882540d9f0a7c07
SHA1 b12ad85dc84391edebb81f5b66e45eb4aa28b0f9
SHA512 8f3b46946f37cffb2d8e7d449968c3a8f3a9d642f24c5789a870938c053a007689fe657f7cc81e5c7734e8d1490ea77808a19b674e405eaea13c8b22937b2a56
SSDEEP 3072:F9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:nctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T132847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lgdyvtnlgd.exe

Path C:\Temp\i_lgdyvtnlgd.exe
Size 384KB
SHA256 c68579d56470666d3a5aed13c3214bfd588d5deddce77b69c347529f9ecd98c7
MD5 fc2a49acf29e30ba6280dc2179437833
SHA1 641cef28008d1f3d1614cba89c8543021d7831f1
SHA512 2468c864f91b6f869afc26a49062ce91dee5c2f74f437904b2cbc2f4c5754319b597bc80d845be093819e9018f063ffe80ab94053a69fb7e6b2e791fe3a1adfb
SSDEEP 3072:s9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:2ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T106847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zurpmhecwu.exe

Path C:\Temp\i_zurpmhecwu.exe
Size 384KB
SHA256 08e3397b1d7eec06ecf503aa793e434b21c478e92f1d97a39ce51b60d6ef27ed
MD5 741cc18c34d329a8502822d97b44a7d8
SHA1 65f17b0555c747e97a53e70ce7e87bfd004de2da
SHA512 3118d9fe6802429f4905d9332bac26677523049c6b6091fdedf6f74bb5468e654352335130775db47267c3b1f7b3ae4089ecc9f167c568ba2a989b044bb58f14
SSDEEP 3072:w9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:CctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T178847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jebzwuomje.exe

Path C:\Temp\jebzwuomje.exe
Size 384KB
SHA256 7a8daadeb5e6572e0a605d824e2e7aa086f291abd256b1c5cab4f69efb61fe28
MD5 600c3215ee1d0da094d21e31175b12e0
SHA1 6e3c823aa15e38c729c5f1616b77de5ead4c5eff
SHA512 cab5c7efe72744229df3ca127cb87b6ef60743ada7db80e07bbf86cf51ba4d7de2b16a6b8ee69d6dff80e70b3ae31d335b213c6e41daf045a45057ef6df851fe
SSDEEP 3072:V9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:3ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T140847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgdyvtnlgd.exe

Path C:\Temp\lgdyvtnlgd.exe
Size 384KB
SHA256 e824e27e496bcced56aa93b4c67241c2e704d94d05851f9841ccc42da692608a
MD5 cfe283b996ea037d11b3a7b66ec93c86
SHA1 543aeb139969941c569294177e52e1f04d74ca27
SHA512 b347f34ed517e9fe54b382d2115ac48b95647124038dbc075a2e3cac7efd25e2d133cd56337ba97b1383f445ab91f80016d4470b24964de58288db2df88b919f
SSDEEP 3072:i9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:4ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T14B847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljebwuomjh.sys

Path C:\Temp\ljebwuomjh.sys
Size 293KB
SHA256 82b9b368116910e66287917bb4df23bf52ae45622369e49f6980368519a3cbea
MD5 1b7aa3dbc7c23ff682d7af4e43885168
SHA1 06bdda4c114be1ffd1e57ab8c28dc8d4eb43ae20
SHA512 92a0f618863f010f31816bc33a31d084c1fc1b08d53395f60e9500ce8a32354499c593c0401f7489f2b0c60a28a54ce6b23a7a4d9dd1997b51f84e3802a36e4d
SSDEEP 3072:ZtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:ZIJjiJcbI03GBc3ucY5DCSj
TLSH
T1C7545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtrljdbytr.sys

Path C:\Temp\vtrljdbytr.sys
Size 293KB
SHA256 96ed84da2243e4adec2bbe3f790e00c86e71f01fba23f19259b5bd73e23600eb
MD5 d58183cf9871af22b2a70fa854c718ae
SHA1 77b01360be8b78da5313ebb11c7b95bf6227a5ce
SHA512 38af0d4d3682edb5f0467f4c4f2ac0993fe80ff7d3cb1f05f7a3a59b6af5db464dc4ab6f81d027607acb8c60c4e5811cc0c2d1d38864b9aa88768775a66351ed
SSDEEP 3072:WtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:WIJjiJcbI03GBc3ucY5DCSj
TLSH
T1EF545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zurpmhecwu.exe

Path C:\Temp\zurpmhecwu.exe
Size 384KB
SHA256 28a48fe68e10e8b227acfd7ea05407370ccba95a2c5a6ea99204682bcc5f98de
MD5 9eb66ee7e15c28fdd63b6d07552be8fe
SHA1 29d15de99d2f6c7d19dd78f4eeeb1aea305807bf
SHA512 a5fec0e73c65c758fa8d931ff569c256eb193cbe132c1d9a0c3cefc61d40589a576d40940bfc294a23617b77637e79def96e523d6d9035dce2c77436a9d632a7
SSDEEP 3072:b9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:JctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T17D847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 719f844e62c5a3916fba05dc2f32d02dadec54c424efb41ba161d1fca59227ae
MD5 e633a9ff8da83df3b4dca0ad6f30e5d9
SHA1 610df135117504b2857ee3cc03a5ac9797b10333
SHA512 56404607616c88e3d1268893aa0c748db1db04fe698a8f5d214c6a2a533823ff606c3f2a3f007d08bc16bd8838597597f9fdcfe0f631495c1928104ff11d002f
TLSH
T16BD0C0303948E188C9832172DCA033117310007020B147054031F42CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 67b546fed422708faf33930b82ff4826bc323bc64f67af30b02bb9e565fa27ee
MD5 04925ec9b8ab191e010732cba0eeefe1
SHA1 a6847bd1b4e86ab3cf9f2a8e109e78b04f51204d
SHA512 25e65b33281d8c58aaf4bad265d912d01bcadd9284dc1ce818ccc1dcf59200f57de5e8d8f4ce5ef6da06c777b54dd4dbee7a3aad7a16da9542538e92104e9c68
TLSH
T1C7D0C0343948E288C9832172DCA033117320007074B147054031B41CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 8ad456862dad81a7afadaaff031729e40b77c8cd73cc4519e1bd2ae7343e406f
MD5 357e514ac67216809e27de1c515f118c
SHA1 97fafa917e2bbe66a38dcf8a34619fd88348e6c5
SHA512 317b70c42c0111a0bb14b3a952326f56f44a820065ce2ae31a28194e35c3e5d186d52d702219ccfdd0dda0f4d05c4923bd61bf1dbb889b128701adfad58e3224
TLSH
T1215122F7E3EFCED1CF5544BF60E2E5D43238895A47032AB1827650B8697271CA0C92D8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe595421.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe595421.TMP
Size 2KB
SHA256 2aee3f8ed0c6c8fae571c7d9b63806d2baae51e18c3ee5134680146a7e659b8c
MD5 8d9b8b4e5341310e8702d9947ebfa73b
SHA1 947cc3a231612ee818e9ca6bb5d9ebed457a79d3
SHA512 a8468528f67a56898b0f64ecf16606e4f85935c37120620cbe9e942c5c7d9d36b71b31b81fdac101607ff5ada3d97986539f17663c83c12ecf96aa4437a518e5
TLSH
T1ED5121F7E3EFCAD1CF5544BF60E2E5D53238895A47032AB1827650B8697271CA0C92D8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 6a3e31bd33fa31bb576e57b4b2e376c3ecff462ded00a9bc1aedabeaf1dd3a81
MD5 4e68129755ef6387c4be005691d965b8
SHA1 8d790b55a26282f664a5c3340171beeb49383ac5
SHA512 7d18204982730b437b258968cc648860d9a16ec482bd3d3f9ce5aa71c8c0097a517009106e7aed7f9b1c764bcaa2c65507f17dbe008a49a5cb51972686bb27b7
TLSH
T1F9517AF7C3E8852E890556F0AB186E2BDF1D0915832C3D5AC9E4EF1BA3E2471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 de538e164f345612a28fead82732cc9f546fcf55d84a39721257bc122130e916
MD5 c783b832ed2d2196512e41833a123b2a
SHA1 0f9ff284502cd1b46bec258aa13681e46f4e402b
SHA512 6b85066c87c71055c2cdc82cb5d105edff397d6e8800b0a5e3f7d1d8bfec59e295469bad42191af1b073a11cafba6f70d7e8abc6b0b114a36c80711793a8fc6c
SSDEEP 192:sxRbROCP/fgsUIVAfmZ/tvzoA8p9F/g6+WNCDA/YZ7UKsGGoIgVaJ:sxRbTP/fgsU2AfQ/tGb/5d/ZOc
TLSH
T1F542A71AA968993B8CCBD21DFA557F53E2F95032A1D41E48BAFC8A0C05EB6DD130740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 39a01da4ff0cf6620ead684c8803656d42eae44985a00b0e9e479def12ac4aba
MD5 10f322d280187834801d180e0bde00b1
SHA1 2c0f7287780e91ec02ad5cce03fe3642be296742
SHA512 6233b7a791e6721fa8dbb97d60135c3de24d729c2554700ac980d62a1ac19e0ad217711632dd5e1622de67d99e8283483c5d4811ab4d6619ae97ccc7eb8db1ce
SSDEEP 192:sxRoROCP/fgsWIVAymZ/tvzoA8p9F/g6+WNCDA/YZ7U8XsGGoIgDpaJ:sxRoTP/fgsW2AyQ/tGb/5d/s8O0
TLSH
T16142A819A9689D3B5CCBD219BA557F53E2F95032A1D41E48BBFC8B0C05EB6DD130740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 36024879b43884117209330e2d9a5cfd3edb72c1149e7f5f1f5d8cfb70a0519a
MD5 db8c954d25bc02b822e24d0e8d21abf0
SHA1 a9f75a094a850d045d3cff51d91ff156f75c6f4b
SHA512 d9b662c86b9b8d29c51d354f943f1612ee26dd7930f93aa034a0a4a2032df4d3d73134cb0a41a29dc9845452158d56ca7671ac6c956aa8c01f46cec0a361670e
SSDEEP 192:sxRoROCP/fgsWIVAfmZ/tvzoA8p9F/g6+WNCDA/YZ7UKsGGoIgDbaJ:sxRoTP/fgsW2AfQ/tGb/5d/ZOO
TLSH
T11242A71AA968993B4CCBD25DBB557F53E2F95032A1D41E48BAFC8A0C05EB6DD230740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 1954c962b97fc1e8c09e309d6c24720593df3f1523fd190ffc42bee12484975f
MD5 b5a0d02019e859559e05ae2ef03449eb
SHA1 7fc2360119b75ffaa72f789c1b7d4844a97f47b3
SHA512 c867f05fb0d32f953e882ee3f6c39c480e8440cee67d63fb9df2083abdcf579bdf0284d2e0e00542c51be904454ad307c3a7a2c8bcb65a5f58606b5bffce3571
SSDEEP 768:ky2SHS7pLuL7evWgd5f/b8F1+UoAYDCx9Tuqh0VfUC9xbog/OVBXdSV4zrob+O:ky2SHqE7evWgd5f/bu1ja2XdU4AKO
TLSH
T1EBD2E93B640DCB7F4F804ADDA8197E9E6DA802CB96D8CD8047FA951C03C6BEB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 75c7c8ba3a68cb0b238db7ab418a8f4267fa7d71845111675ec8b68e2c4d3854
MD5 fb045d81abbb21ef4674390479497b38
SHA1 db8ab600da4c946edf3ed73f9f60f90e31abd7c8
SHA512 4b6bfd9d7c8e51aedab91f94e6b4b4d11fca57d06d40e5441ba4ae5bb7a1778051a000d3f8ac5ebc3e259614a7ab2d50f58717b374cc8815e10261a42f1a48b8
SSDEEP 48:Kj2PKmgsIkYshPIhukKiBqokeG0fBgG5yJUIDKtic2DIlK8cwDyt7SZ:KIB2KysCqUgKtirDiK8c2x
TLSH
T120916057727E46023C7E2949A6D0D52AD6C271B73159A53B3BE800B91F6EF021EFC4C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 85e7564e9a3b5bf530c565acedac944ed83c2b1adf96de79ed81cd8e4026d2b2
MD5 b38755657f3fae3d8cf6b9ac36888ecd
SHA1 f60174ef8087dd5a97f15343129af83a03a841ff
SHA512 6ce1ad2fda77d4dbfdfb6e61cd3a52e96136ccbfb2b3eb6004e889c89bc899153eb20fb594fee7fa477df14081b57b39a75a2d53c5f5017a9dcade80d2c57321
SSDEEP 768:2j+983JoJqpgRzAam6aQMGdjWca4Ghf9c7L:l983JVgRVmaME6pcH
TLSH
T1F5D29E3198B99D735CAB9695F72B2783BEF012B384C40E44DAD95F0D069718D270BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 4a56185657477fcab5c33f1a885c359d061f61d320c4eae061dfb07627a6e9aa
MD5 2b6fbad625562a19b15b6df0472bf323
SHA1 e644dfceec7345720bf262c6a55de2d2df1b3de5
SHA512 fbbb4f458d61a167f7f254905e5c8b5261b4e7fddddf851340da18daab61108d094e13925e133c2ac100cefe3d67d34156baf72ec8c6ab7e4ab33ef2eda5640d
SSDEEP 768:Wj+983UoJqpgRzAam6aQMGdjWca4Ghf9c7L:F983UVgRVmaME6pcH
TLSH
T1A8D29E3198B99D735CAB9695F72B2783BEF012B384C40E44EAD95F0D069718E270BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 4cae40c7fbf6153e68ccdfcec3c444bb6c3696eb1a873982a02e8645f89edcba
MD5 ba5adb36a4489e2d32d1ec5d7ec02715
SHA1 4ce6277d5fc53128de9a0c55c9790b2989e76e01
SHA512 d9a5e9053ba2dc55ef32f80c6d216f036d2c9a063cce855219529f51c2a2c6951f6fdf9d93344d8d70f0ea0ea77e3c1ca53b1fbf63f78d9101913af078c50a01
SSDEEP 768:/rv+4UNbdq3lJq+AAam6aQMGdjWca4GhfB+PeU/:/bsbc3BKmaME6pWH
TLSH
T1F5F2BE31A8BC9973DDB79A99F21B6787BEF021A385D40E80D9D91B0D439748E3307927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 15356f0402073672526bfc9fb9d648ac3d942f341e7959890b8bb843790b6091
MD5 0ece6eb738336e7f92bac16f079cc280
SHA1 5435486bd0bae45f5a20577b594dabe49af8ccb4
SHA512 140d44f5f64628f6fe9db87e56225ac7b611170ff94ebf28d0a1c05fdac9f42e5f99941f9c10806dd2bb5285c50ec974f65db07f77e959d6f274cfae152a8829
SSDEEP 768:Vrv+4UNbdy3VL40JqpgRzAam6aQMGdjWca4Ghf9cFVI:VbsbQ3VL4JgRVmaME6pcY
TLSH
T12EF2AE31A8BCD9739CB7A595B25B26837EB421B388C40E44EAD95B0D069B4CE370BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 02aa2e1a802c3cd2171695e6aef5b0481719b9e062bf80fde90002ee749d79e5
MD5 6eacbc143f033355b0c441c6c06d984d
SHA1 15675fa06e20221d58fbb2d8f1f4daa3bf867e76
SHA512 bf6c13ac7c79ef84103d5d95932f6089770e1d3e9a353536d5d3561808777704200f3e5723e585599e7754cb6e7bfb4f5479bb93a92d7dfb51d10d4268631913
SSDEEP 768:jF1j+963twg/ldzwzAam6aQMGdjWca4Ghf9c7L:y963DzwVmaME6pcH
TLSH
T1D503F6F588E78937D8AE4783A73D2E46A9BCC163B4885984B7C85D0CCD861BFD307916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4144_1506829854\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 735e5fc7d7ec3b97ed7723dd02c549c86adc736ba4b72b3d0f6d103521f64273
MD5 3b65da856fb0c05a6f24bf680de1bd19
SHA1 b298459c8ebcf4a6c3eb41f05b7b27c1bb8a2eac
SHA512 9fd922c285fde6202b5e4b0d9ec59df4a3a82e43fe94f85e09328799fc0136a9f68e68f6faf3b0cbb8018af66cb28d91f72bd0fbb0c1c9cb912c35cf192ab1a2
TLSH
T10771238357BDD9B3C1DA5FF002835648F2FF2238073330218752598AAB30A3A54B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/920-295-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1016-412-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1864-242-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1888-282-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1948-324-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1996-330-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2520-270-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2592-392-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3044-389-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3324-416-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3408-383-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3608-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4420-191-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4604-426-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4720-334-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4768-421-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4904-437-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5200-359-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5200-457-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5648-320-0x0000000000010000-0x00000000000AB000-memory.dmp

Download