systex | fd31785a374b9a534791e076b15fd24247a7114a244613405610ce43595475d5

Analysis

max time kernel
149s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 14:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_383f238b6dfe6f17d8d972e621e11ae5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Size 365KB
Sample260731-r2x9vsvdpc
SHA256 fd31785a374b9a534791e076b15fd24247a7114a244613405610ce43595475d5
MD5 383f238b6dfe6f17d8d972e621e11ae5
SHA1 66a44c9de0c6e9b108382bcdebb635ecc5fa559c
SHA512 d1b5ab42416e5ffc51f774e597f8de89a1f0c8b2dcc88c6f5384c5e7a396a528d037c20e19bb0013deb1d0d6abc2d449fe14d923557724c91ddbd027a0e9dc31
SSDEEP 3072:2uxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:2uxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T11A847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
3264	qljdbvtnlgdywqoi.exe
2060	CreateProcess.exe
436	tnljdbvtnl.exe
2532	CreateProcess.exe
3528	qljdbvtnlgdywqoi.sys
4068	CreateProcess.exe
3344	i_tnljdbvtnl.exe
2892	nifdxvqnli.sys
4412	CreateProcess.exe
3936	ifaysqkiav.exe
5832	CreateProcess.exe
5640	CreateProcess.exe
2808	i_ifaysqkiav.exe
1548	nkfdausmkh.sys
5428	CreateProcess.exe
2064	hfdxusmkfc.exe
3876	CreateProcess.exe
6080	CreateProcess.exe
1192	i_hfdxusmkfc.exe
2388	xspkhfdxvp.sys
1112	CreateProcess.exe
4164	spkhfcwusp.exe
6112	CreateProcess.exe
1896	CreateProcess.exe
4760	i_spkhfcwusp.exe
3428	rpmkecwupm.sys
2968	CreateProcess.exe
5356	mkecwupmhu.exe
2980	CreateProcess.exe
5448	CreateProcess.exe
5560	i_mkecwupmhu.exe
5892	zxrpjhbzur.sys
4624	CreateProcess.exe
2376	trmjebzwuo.exe
4888	CreateProcess.exe
5920	CreateProcess.exe
1192	i_trmjebzwuo.exe
6104	romjebwtom.sys
4804	CreateProcess.exe
1268	trljdbwtoj.exe
3580	CreateProcess.exe
5488	CreateProcess.exe
2168	i_trljdbwtoj.exe
4760	bwtomgeywr.sys
5280	CreateProcess.exe
3428	oigbytrljd.exe
364	CreateProcess.exe
4856	CreateProcess.exe
2684	i_oigbytrljd.exe
4768	olgdyvtqoi.sys
4664	CreateProcess.exe
1508	ljgdytqlig.exe
5956	CreateProcess.exe
3764	CreateProcess.exe
5872	i_ljgdytqlig.exe
2540	fdyvqoigay.sys
2152	CreateProcess.exe
3900	davqnifays.exe
2848	CreateProcess.exe
5104	CreateProcess.exe
1616	i_davqnifays.exe
4800	spnhfdavsq.sys
4652	CreateProcess.exe
2712	vsnkifaxsp.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\msedge_url_fetcher_1360_1350929078\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qljdbvtnlgdywqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifaysqkiav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spkhfcwusp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvtrljdbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnigdbytnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnljdbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljdbwtoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljgdytqlig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsnkifaxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkifaxspki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkifaxspki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wupmhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnigdbytnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkecwupmhu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnljdbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trmjebzwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigbytrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	davqnifays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpnhfcaxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rojhbztrmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvtrljdbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfdxusmkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trmjebzwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpnhfcaxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifaysqkiav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spkhfcwusp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkecwupmhu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsnkifaxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnifaxsqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnifaxsqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljgdytqlig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wupmhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ytrljdbvto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfdxusmkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rojhbztrmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ytrljdbvto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_383f238b6dfe6f17d8d972e621e11ae5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljdbwtoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigbytrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_davqnifays.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5664	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5096	ipconfig.exe
2192	ipconfig.exe
3412	ipconfig.exe
3528	ipconfig.exe
6136	ipconfig.exe
5768	ipconfig.exe
5024	ipconfig.exe
4624	ipconfig.exe
5840	ipconfig.exe
5100	ipconfig.exe
3808	ipconfig.exe
5932	ipconfig.exe
240	ipconfig.exe
1320	ipconfig.exe
5604	ipconfig.exe
2772	ipconfig.exe
5432	ipconfig.exe
4948	ipconfig.exe
5856	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299825301488229"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{91677F5B-B8C0-4012-BFD7-32E82A612FE8}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4376	2026-07-31_383f238b6dfe6f17d8d972e621e11ae5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4376	2026-07-31_383f238b6dfe6f17d8d972e621e11ae5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4376	2026-07-31_383f238b6dfe6f17d8d972e621e11ae5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4376	2026-07-31_383f238b6dfe6f17d8d972e621e11ae5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4376	2026-07-31_383f238b6dfe6f17d8d972e621e11ae5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4376	2026-07-31_383f238b6dfe6f17d8d972e621e11ae5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4376	2026-07-31_383f238b6dfe6f17d8d972e621e11ae5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4376	2026-07-31_383f238b6dfe6f17d8d972e621e11ae5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4376	2026-07-31_383f238b6dfe6f17d8d972e621e11ae5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4376	2026-07-31_383f238b6dfe6f17d8d972e621e11ae5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4376	2026-07-31_383f238b6dfe6f17d8d972e621e11ae5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4376	2026-07-31_383f238b6dfe6f17d8d972e621e11ae5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4376	2026-07-31_383f238b6dfe6f17d8d972e621e11ae5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4376	2026-07-31_383f238b6dfe6f17d8d972e621e11ae5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4376	2026-07-31_383f238b6dfe6f17d8d972e621e11ae5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4376	2026-07-31_383f238b6dfe6f17d8d972e621e11ae5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4376	2026-07-31_383f238b6dfe6f17d8d972e621e11ae5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4376	2026-07-31_383f238b6dfe6f17d8d972e621e11ae5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4376	2026-07-31_383f238b6dfe6f17d8d972e621e11ae5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4376	2026-07-31_383f238b6dfe6f17d8d972e621e11ae5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4376	2026-07-31_383f238b6dfe6f17d8d972e621e11ae5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4376	2026-07-31_383f238b6dfe6f17d8d972e621e11ae5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4376	2026-07-31_383f238b6dfe6f17d8d972e621e11ae5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4376	2026-07-31_383f238b6dfe6f17d8d972e621e11ae5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4376	2026-07-31_383f238b6dfe6f17d8d972e621e11ae5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4376	2026-07-31_383f238b6dfe6f17d8d972e621e11ae5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4376	2026-07-31_383f238b6dfe6f17d8d972e621e11ae5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4376	2026-07-31_383f238b6dfe6f17d8d972e621e11ae5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4376	2026-07-31_383f238b6dfe6f17d8d972e621e11ae5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4376	2026-07-31_383f238b6dfe6f17d8d972e621e11ae5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4376	2026-07-31_383f238b6dfe6f17d8d972e621e11ae5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4376	2026-07-31_383f238b6dfe6f17d8d972e621e11ae5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4376	2026-07-31_383f238b6dfe6f17d8d972e621e11ae5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4376	2026-07-31_383f238b6dfe6f17d8d972e621e11ae5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4376	2026-07-31_383f238b6dfe6f17d8d972e621e11ae5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4376	2026-07-31_383f238b6dfe6f17d8d972e621e11ae5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4376	2026-07-31_383f238b6dfe6f17d8d972e621e11ae5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4376	2026-07-31_383f238b6dfe6f17d8d972e621e11ae5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4376	2026-07-31_383f238b6dfe6f17d8d972e621e11ae5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4376	2026-07-31_383f238b6dfe6f17d8d972e621e11ae5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4376	2026-07-31_383f238b6dfe6f17d8d972e621e11ae5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4376	2026-07-31_383f238b6dfe6f17d8d972e621e11ae5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4376	2026-07-31_383f238b6dfe6f17d8d972e621e11ae5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4376	2026-07-31_383f238b6dfe6f17d8d972e621e11ae5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4376	2026-07-31_383f238b6dfe6f17d8d972e621e11ae5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4376	2026-07-31_383f238b6dfe6f17d8d972e621e11ae5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4376	2026-07-31_383f238b6dfe6f17d8d972e621e11ae5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4376	2026-07-31_383f238b6dfe6f17d8d972e621e11ae5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4376	2026-07-31_383f238b6dfe6f17d8d972e621e11ae5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4376	2026-07-31_383f238b6dfe6f17d8d972e621e11ae5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4376	2026-07-31_383f238b6dfe6f17d8d972e621e11ae5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4376	2026-07-31_383f238b6dfe6f17d8d972e621e11ae5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4376	2026-07-31_383f238b6dfe6f17d8d972e621e11ae5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4376	2026-07-31_383f238b6dfe6f17d8d972e621e11ae5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4376	2026-07-31_383f238b6dfe6f17d8d972e621e11ae5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4376	2026-07-31_383f238b6dfe6f17d8d972e621e11ae5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3264	qljdbvtnlgdywqoi.exe
3264	qljdbvtnlgdywqoi.exe
3264	qljdbvtnlgdywqoi.exe
3264	qljdbvtnlgdywqoi.exe
3264	qljdbvtnlgdywqoi.exe
3264	qljdbvtnlgdywqoi.exe
3264	qljdbvtnlgdywqoi.exe
3264	qljdbvtnlgdywqoi.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	3344	i_tnljdbvtnl.exe
Token: SeDebugPrivilege	2808	i_ifaysqkiav.exe
Token: SeDebugPrivilege	1192	i_hfdxusmkfc.exe
Token: SeDebugPrivilege	4760	i_spkhfcwusp.exe
Token: SeDebugPrivilege	5560	i_mkecwupmhu.exe
Token: SeDebugPrivilege	1192	i_trmjebzwuo.exe
Token: SeDebugPrivilege	2168	i_trljdbwtoj.exe
Token: SeDebugPrivilege	2684	i_oigbytrljd.exe
Token: SeDebugPrivilege	5872	i_ljgdytqlig.exe
Token: SeDebugPrivilege	1616	i_davqnifays.exe
Token: SeDebugPrivilege	3208	i_vsnkifaxsp.exe
Token: SeDebugPrivilege	1056	i_mkifaxspki.exe
Token: SeDebugPrivilege	1300	i_rpnhfcaxsp.exe
Token: SeDebugPrivilege	2868	i_wupmhfzxrp.exe
Token: SeDebugPrivilege	5652	i_rojhbztrmj.exe
Token: SeDebugPrivilege	2528	i_yvtrljdbzt.exe
Token: SeDebugPrivilege	5816	i_ytrljdbvto.exe
Token: SeDebugPrivilege	3484	i_qnigdbytnl.exe
Token: SeDebugPrivilege	3220	i_qnifaxsqki.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1360	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4376 wrote to memory of 3264	4376	2026-07-31_383f238b6dfe6f17d8d972e621e11ae5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	90
PID 4376 wrote to memory of 5496	4376	2026-07-31_383f238b6dfe6f17d8d972e621e11ae5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	91
PID 5496 wrote to memory of 1360	5496	iexplore.exe	92
PID 1360 wrote to memory of 2312	1360	msedge.exe	93
PID 1360 wrote to memory of 5664	1360	msedge.exe	95
PID 1360 wrote to memory of 248	1360	msedge.exe	97
PID 1360 wrote to memory of 248	1360	msedge.exe	97
PID 1360 wrote to memory of 236	1360	msedge.exe	99
PID 1360 wrote to memory of 236	1360	msedge.exe	99
PID 1360 wrote to memory of 2920	1360	msedge.exe	98
PID 1360 wrote to memory of 3508	1360	msedge.exe	96
PID 1360 wrote to memory of 236	1360	msedge.exe	99
PID 1360 wrote to memory of 2920	1360	msedge.exe	98
PID 1360 wrote to memory of 2920	1360	msedge.exe	98
PID 1360 wrote to memory of 3508	1360	msedge.exe	96
PID 1360 wrote to memory of 3508	1360	msedge.exe	96
PID 1360 wrote to memory of 2400	1360	msedge.exe	100
PID 1360 wrote to memory of 2400	1360	msedge.exe	100
PID 1360 wrote to memory of 2400	1360	msedge.exe	100
PID 1360 wrote to memory of 4372	1360	msedge.exe	101
PID 1360 wrote to memory of 4372	1360	msedge.exe	101
PID 1360 wrote to memory of 4372	1360	msedge.exe	101
PID 1360 wrote to memory of 4496	1360	msedge.exe	103
PID 1360 wrote to memory of 4496	1360	msedge.exe	103
PID 3264 wrote to memory of 2060	3264	qljdbvtnlgdywqoi.exe	104
PID 436 wrote to memory of 2532	436	tnljdbvtnl.exe	108
PID 1360 wrote to memory of 4708	1360	msedge.exe	112
PID 1360 wrote to memory of 4708	1360	msedge.exe	112
PID 1360 wrote to memory of 4444	1360	msedge.exe	113
PID 1360 wrote to memory of 4444	1360	msedge.exe	113
PID 1360 wrote to memory of 4980	1360	msedge.exe	115
PID 1360 wrote to memory of 2484	1360	msedge.exe	116
PID 1360 wrote to memory of 2484	1360	msedge.exe	116
PID 1360 wrote to memory of 5992	1360	msedge.exe	117
PID 1360 wrote to memory of 5992	1360	msedge.exe	117
PID 3264 wrote to memory of 4068	3264	qljdbvtnlgdywqoi.exe	120
PID 3264 wrote to memory of 4412	3264	qljdbvtnlgdywqoi.exe	124
PID 3936 wrote to memory of 5832	3936	ifaysqkiav.exe	126
PID 3264 wrote to memory of 5640	3264	qljdbvtnlgdywqoi.exe	129
PID 3264 wrote to memory of 5428	3264	qljdbvtnlgdywqoi.exe	133
PID 2064 wrote to memory of 3876	2064	hfdxusmkfc.exe	135
PID 3264 wrote to memory of 6080	3264	qljdbvtnlgdywqoi.exe	138
PID 3264 wrote to memory of 1112	3264	qljdbvtnlgdywqoi.exe	143
PID 4164 wrote to memory of 6112	4164	spkhfcwusp.exe	145
PID 3264 wrote to memory of 1896	3264	qljdbvtnlgdywqoi.exe	148
PID 1360 wrote to memory of 3304	1360	msedge.exe	150
PID 1360 wrote to memory of 6056	1360	msedge.exe	151
PID 1360 wrote to memory of 4208	1360	msedge.exe	152
PID 3264 wrote to memory of 2968	3264	qljdbvtnlgdywqoi.exe	155
PID 5356 wrote to memory of 2980	5356	mkecwupmhu.exe	157
PID 3264 wrote to memory of 5448	3264	qljdbvtnlgdywqoi.exe	160
PID 3264 wrote to memory of 4624	3264	qljdbvtnlgdywqoi.exe	164
PID 2376 wrote to memory of 4888	2376	trmjebzwuo.exe	166
PID 3264 wrote to memory of 5920	3264	qljdbvtnlgdywqoi.exe	169
PID 3264 wrote to memory of 4804	3264	qljdbvtnlgdywqoi.exe	173
PID 1268 wrote to memory of 3580	1268	trljdbwtoj.exe	175
PID 3264 wrote to memory of 5488	3264	qljdbvtnlgdywqoi.exe	178
PID 3264 wrote to memory of 5280	3264	qljdbvtnlgdywqoi.exe	182
PID 3428 wrote to memory of 364	3428	oigbytrljd.exe	184
PID 3264 wrote to memory of 4856	3264	qljdbvtnlgdywqoi.exe	187
PID 1360 wrote to memory of 5016	1360	msedge.exe	189
PID 1360 wrote to memory of 5016	1360	msedge.exe	189
PID 3264 wrote to memory of 4664	3264	qljdbvtnlgdywqoi.exe	194
PID 1508 wrote to memory of 5956	1508	ljgdytqlig.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-07-31_383f238b6dfe6f17d8d972e621e11ae5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_383f238b6dfe6f17d8d972e621e11ae5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4376
- C:\Temp\qljdbvtnlgdywqoi.exe
  C:\Temp\qljdbvtnlgdywqoi.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3264
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tnljdbvtnl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2060
  - - C:\Temp\tnljdbvtnl.exe
      C:\Temp\tnljdbvtnl.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:436
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2532
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5024
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tnljdbvtnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4068
  - - C:\Temp\i_tnljdbvtnl.exe
      C:\Temp\i_tnljdbvtnl.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3344
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ifaysqkiav.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4412
  - - C:\Temp\ifaysqkiav.exe
      C:\Temp\ifaysqkiav.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3936
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5832
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3528
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ifaysqkiav.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5640
  - - C:\Temp\i_ifaysqkiav.exe
      C:\Temp\i_ifaysqkiav.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2808
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hfdxusmkfc.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5428
  - - C:\Temp\hfdxusmkfc.exe
      C:\Temp\hfdxusmkfc.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2064
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3876
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4624
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hfdxusmkfc.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6080
  - - C:\Temp\i_hfdxusmkfc.exe
      C:\Temp\i_hfdxusmkfc.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1192
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\spkhfcwusp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1112
  - - C:\Temp\spkhfcwusp.exe
      C:\Temp\spkhfcwusp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4164
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6112
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:240
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_spkhfcwusp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1896
  - - C:\Temp\i_spkhfcwusp.exe
      C:\Temp\i_spkhfcwusp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4760
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mkecwupmhu.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2968
  - - C:\Temp\mkecwupmhu.exe
      C:\Temp\mkecwupmhu.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5356
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2980
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1320
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mkecwupmhu.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5448
  - - C:\Temp\i_mkecwupmhu.exe
      C:\Temp\i_mkecwupmhu.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5560
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\trmjebzwuo.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4624
  - - C:\Temp\trmjebzwuo.exe
      C:\Temp\trmjebzwuo.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2376
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4888
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5604
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_trmjebzwuo.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5920
  - - C:\Temp\i_trmjebzwuo.exe
      C:\Temp\i_trmjebzwuo.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1192
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\trljdbwtoj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4804
  - - C:\Temp\trljdbwtoj.exe
      C:\Temp\trljdbwtoj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1268
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3580
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5840
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_trljdbwtoj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5488
  - - C:\Temp\i_trljdbwtoj.exe
      C:\Temp\i_trljdbwtoj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2168
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\oigbytrljd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5280
  - - C:\Temp\oigbytrljd.exe
      C:\Temp\oigbytrljd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3428
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:364
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2772
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_oigbytrljd.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4856
  - - C:\Temp\i_oigbytrljd.exe
      C:\Temp\i_oigbytrljd.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2684
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljgdytqlig.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4664
  - - C:\Temp\ljgdytqlig.exe
      C:\Temp\ljgdytqlig.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1508
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5956
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6136
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljgdytqlig.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3764
  - - C:\Temp\i_ljgdytqlig.exe
      C:\Temp\i_ljgdytqlig.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5872
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\davqnifays.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2152
  - - C:\Temp\davqnifays.exe
      C:\Temp\davqnifays.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3900
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2848
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5768
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_davqnifays.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5104
  - - C:\Temp\i_davqnifays.exe
      C:\Temp\i_davqnifays.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1616
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vsnkifaxsp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4652
  - - C:\Temp\vsnkifaxsp.exe
      C:\Temp\vsnkifaxsp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2712
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4436
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4948
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vsnkifaxsp.exe ups_ins
    3⤵
    PID:5808
  - - C:\Temp\i_vsnkifaxsp.exe
      C:\Temp\i_vsnkifaxsp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3208
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mkifaxspki.exe ups_run
    3⤵
    PID:5968
  - - C:\Temp\mkifaxspki.exe
      C:\Temp\mkifaxspki.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1016
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4944
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5100
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mkifaxspki.exe ups_ins
    3⤵
    PID:2744
  - - C:\Temp\i_mkifaxspki.exe
      C:\Temp\i_mkifaxspki.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1056
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rpnhfcaxsp.exe ups_run
    3⤵
    PID:5840
  - - C:\Temp\rpnhfcaxsp.exe
      C:\Temp\rpnhfcaxsp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4332
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1916
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5856
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rpnhfcaxsp.exe ups_ins
    3⤵
    PID:5768
  - - C:\Temp\i_rpnhfcaxsp.exe
      C:\Temp\i_rpnhfcaxsp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1300
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wupmhfzxrp.exe ups_run
    3⤵
    PID:4680
  - - C:\Temp\wupmhfzxrp.exe
      C:\Temp\wupmhfzxrp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5744
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3184
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3808
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wupmhfzxrp.exe ups_ins
    3⤵
    PID:3164
  - - C:\Temp\i_wupmhfzxrp.exe
      C:\Temp\i_wupmhfzxrp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2868
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rojhbztrmj.exe ups_run
    3⤵
    PID:3956
  - - C:\Temp\rojhbztrmj.exe
      C:\Temp\rojhbztrmj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2832
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4968
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5096
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rojhbztrmj.exe ups_ins
    3⤵
    PID:3360
  - - C:\Temp\i_rojhbztrmj.exe
      C:\Temp\i_rojhbztrmj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5652
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\yvtrljdbzt.exe ups_run
    3⤵
    PID:3396
  - - C:\Temp\yvtrljdbzt.exe
      C:\Temp\yvtrljdbzt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1348
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3536
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5432
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_yvtrljdbzt.exe ups_ins
    3⤵
    PID:5908
  - - C:\Temp\i_yvtrljdbzt.exe
      C:\Temp\i_yvtrljdbzt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2528
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ytrljdbvto.exe ups_run
    3⤵
    PID:988
  - - C:\Temp\ytrljdbvto.exe
      C:\Temp\ytrljdbvto.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3296
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1852
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5932
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ytrljdbvto.exe ups_ins
    3⤵
    PID:5004
  - - C:\Temp\i_ytrljdbvto.exe
      C:\Temp\i_ytrljdbvto.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5816
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qnigdbytnl.exe ups_run
    3⤵
    PID:1300
  - - C:\Temp\qnigdbytnl.exe
      C:\Temp\qnigdbytnl.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2476
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2836
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2192
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qnigdbytnl.exe ups_ins
    3⤵
    PID:4432
  - - C:\Temp\i_qnigdbytnl.exe
      C:\Temp\i_qnigdbytnl.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3484
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qnifaxsqki.exe ups_run
    3⤵
    PID:2492
  - - C:\Temp\qnifaxsqki.exe
      C:\Temp\qnifaxsqki.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2580
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:272
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3412
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qnifaxsqki.exe ups_ins
    3⤵
    PID:4244
  - - C:\Temp\i_qnifaxsqki.exe
      C:\Temp\i_qnifaxsqki.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3220
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f8,0x2fc,0x300,0x2f4,0x2c8,0x7ffe4c0fc188,0x7ffe4c0fc194,0x7ffe4c0fc1a0
      4⤵
      PID:2312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2200,i,15857784252158042889,9356653374437569118,524288 --field-trial-handle=2504,i,9376638215844214708,2324435207004383567,262144 --variations-seed-version --mojo-platform-channel-handle=3184 /prefetch:11
      4⤵
      System Time Discovery
      PID:5664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2008,i,4168366687942572851,11010190069798692724,262144 --field-trial-handle=2504,i,9376638215844214708,2324435207004383567,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:2
      4⤵
      PID:3508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2216,i,1508128514903885194,2220682983576441379,524288 --field-trial-handle=2504,i,9376638215844214708,2324435207004383567,262144 --variations-seed-version --mojo-platform-channel-handle=3284 /prefetch:13
      4⤵
      PID:248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3492,i,12526611808442077913,6397582626687763810,2097152 --field-trial-handle=2504,i,9376638215844214708,2324435207004383567,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
      4⤵
      PID:2920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3500,i,13692151244733125976,5938653187687747168,2097152 --field-trial-handle=2504,i,9376638215844214708,2324435207004383567,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
      4⤵
      PID:236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,1213876150039396932,8187557118397952115,2097152 --field-trial-handle=2504,i,9376638215844214708,2324435207004383567,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:9
      4⤵
      PID:2400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,14576747954577886080,11186368924639875527,2097152 --field-trial-handle=2504,i,9376638215844214708,2324435207004383567,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:1
      4⤵
      PID:4372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,10711312656974714347,8485658598535959060,524288 --field-trial-handle=2504,i,9376638215844214708,2324435207004383567,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:14
      4⤵
      PID:4496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,9510996608186635070,13998350750131512588,524288 --field-trial-handle=2504,i,9376638215844214708,2324435207004383567,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:14
      4⤵
      PID:4708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,4239128233568169463,8541303573883535573,524288 --field-trial-handle=2504,i,9376638215844214708,2324435207004383567,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:14
      4⤵
      PID:4444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,14927312592705345101,7821738888760864661,524288 --field-trial-handle=2504,i,9376638215844214708,2324435207004383567,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:14
      4⤵
      PID:4188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,14927312592705345101,7821738888760864661,524288 --field-trial-handle=2504,i,9376638215844214708,2324435207004383567,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:14
      4⤵
      PID:4980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,11685602017073896559,1733085258172656472,524288 --field-trial-handle=2504,i,9376638215844214708,2324435207004383567,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
      4⤵
      PID:2484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,13718635331496212025,12387733189668738007,524288 --field-trial-handle=2504,i,9376638215844214708,2324435207004383567,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:14
      4⤵
      PID:5992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1300,i,9348730125719178285,4162453030127485539,524288 --field-trial-handle=2504,i,9376638215844214708,2324435207004383567,262144 --variations-seed-version --mojo-platform-channel-handle=1296 /prefetch:14
      4⤵
      PID:3304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1304,i,14308852068589013038,5376076444312679302,524288 --field-trial-handle=2504,i,9376638215844214708,2324435207004383567,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:14
      4⤵
      PID:6056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1308,i,406085317101758091,6718425643481437411,524288 --field-trial-handle=2504,i,9376638215844214708,2324435207004383567,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:14
      4⤵
      PID:4208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6908,i,16402551291386740371,5224717159828511389,524288 --field-trial-handle=2504,i,9376638215844214708,2324435207004383567,262144 --variations-seed-version --mojo-platform-channel-handle=6944 /prefetch:14
      4⤵
      PID:5016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,17947422348103516078,17663085572034459642,524288 --field-trial-handle=2504,i,9376638215844214708,2324435207004383567,262144 --variations-seed-version --mojo-platform-channel-handle=6860 /prefetch:14
      4⤵
      PID:5696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6808,i,7854732202526934104,17747048702956032368,262144 --field-trial-handle=2504,i,9376638215844214708,2324435207004383567,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:10
      4⤵
      PID:2548

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2284

C:\Temp\qljdbvtnlgdywqoi.sys
C:\Temp\qljdbvtnlgdywqoi.sys
1⤵
- Executes dropped EXE
PID:3528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1268

C:\Temp\nifdxvqnli.sys
C:\Temp\nifdxvqnli.sys
1⤵
- Executes dropped EXE
PID:2892

C:\Temp\nkfdausmkh.sys
C:\Temp\nkfdausmkh.sys
1⤵
- Executes dropped EXE
PID:1548

C:\Temp\xspkhfdxvp.sys
C:\Temp\xspkhfdxvp.sys
1⤵
- Executes dropped EXE
PID:2388

C:\Temp\rpmkecwupm.sys
C:\Temp\rpmkecwupm.sys
1⤵
- Executes dropped EXE
PID:3428

C:\Temp\zxrpjhbzur.sys
C:\Temp\zxrpjhbzur.sys
1⤵
- Executes dropped EXE
PID:5892

C:\Temp\romjebwtom.sys
C:\Temp\romjebwtom.sys
1⤵
- Executes dropped EXE
PID:6104

C:\Temp\bwtomgeywr.sys
C:\Temp\bwtomgeywr.sys
1⤵
- Executes dropped EXE
PID:4760

C:\Temp\olgdyvtqoi.sys
C:\Temp\olgdyvtqoi.sys
1⤵
- Executes dropped EXE
PID:4768

C:\Temp\fdyvqoigay.sys
C:\Temp\fdyvqoigay.sys
1⤵
- Executes dropped EXE
PID:2540

C:\Temp\spnhfdavsq.sys
C:\Temp\spnhfdavsq.sys
1⤵
- Executes dropped EXE
PID:4800

C:\Temp\xspkicaxsq.sys
C:\Temp\xspkicaxsq.sys
1⤵
PID:5592

C:\Temp\usmkhfzxsp.sys
C:\Temp\usmkhfzxsp.sys
1⤵
PID:2076

C:\Temp\urpjhfzxrp.sys
C:\Temp\urpjhfzxrp.sys
1⤵
PID:1860

C:\Temp\uomgezwrom.sys
C:\Temp\uomgezwrom.sys
1⤵
PID:1336

C:\Temp\mjhezwrojg.sys
C:\Temp\mjhezwrojg.sys
1⤵
PID:4792

C:\Temp\gbytrljdbv.sys
C:\Temp\gbytrljdbv.sys
1⤵
PID:5100

C:\Temp\tnlfdbysqo.sys
C:\Temp\tnlfdbysqo.sys
1⤵
PID:4760

C:\Temp\qnifdysqni.sys
C:\Temp\qnifdysqni.sys
1⤵
PID:2868

C:\Temp\pnkifaxsqn.sys
C:\Temp\pnkifaxsqn.sys
1⤵
PID:4792

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hfdxusmkfc.exe

Path C:\Temp\hfdxusmkfc.exe
Size 365KB
SHA256 2ba59ec9d5550a16bfa007fd5db21c7939f9bef0ee4692defd410ebe447090d2
MD5 c4572ae27cfda5539e9c8e09e5a1d73a
SHA1 32572dc2af95892b708115f64c5c447537ef03a1
SHA512 8680096e612ca570b6c4c4dae98887193a97a7a40201deea975f16a57cb0c8de1a40e9766e559938c9e00be7252ea4e9fdd0d6627236015ccf4f3829063ee96d
SSDEEP 3072:cuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:cuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T18E847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hfdxusmkfc.exe

Path C:\Temp\i_hfdxusmkfc.exe
Size 365KB
SHA256 1b538abd2980745de3a5c9696d02d24fc83d78442b4cf8cfd0a586bf0f9dc59b
MD5 567ea78b52ad2c2c2688ad01e659ad80
SHA1 b31cf995b20281c1a7cb30c53f7d97e983545c00
SHA512 ca48a36b39ee5d3c187c5267334b37ad99992d7e00acb8e006d15d57fa97d22d608d3871856344df772ccf293022ca08ef56bac097cd206a51ba17c07a16c477
SSDEEP 3072:muxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:muxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T179847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ifaysqkiav.exe

Path C:\Temp\i_ifaysqkiav.exe
Size 365KB
SHA256 59d6211942ac71f28535c9172f4b1179a8b6caa4c4b8f68bc18d7b866279c21a
MD5 72b87d40db961c1b470d4b1f2b978bff
SHA1 ca9d973e2e10a536ef45b0907791f0f199615345
SHA512 e6ee742daea7537066b0d7bfd120991d342d8f4c2eb48d0dd652705366088ea4e11b209326b412875b2d1cc1daf9f4e9837935f274620d1d246ff9a98d7c57b1
SSDEEP 3072:muxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:muxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T18F847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mkecwupmhu.exe

Path C:\Temp\i_mkecwupmhu.exe
Size 365KB
SHA256 fe704419c92682703b672b295c86a6361d8d0ba92394ef6d45020e9027c7c0c5
MD5 51ad7071b4d64501c2e748c4360e2a51
SHA1 604f38e279cf1ccb7a544f954a29844530e7fa10
SHA512 0c07b151634690592be73b2d32051758532cc03f6a029a1f3acf67d32078cb64bf1045e3c6a0030098b0bbaf16b2c3c669a3f9716c758c1ef4c75280cafa3503
SSDEEP 3072:muxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:muxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T12F847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_spkhfcwusp.exe

Path C:\Temp\i_spkhfcwusp.exe
Size 365KB
SHA256 c7385a576890a7e77fddf35420329353e16fe896ca223e8926d45a85c34dbc1e
MD5 e22ba46757b1dff84bc581308b1063c0
SHA1 fd24fe297b8afb1f195afac2bae0e666171e531f
SHA512 d791f3ed5d399a78e33fd611e33e6ebb96140550c14212df07c5b29440f2b91ba4b34888b41fb3bbbdd7d0b7dc1e7d9a5618c6ac919a91eca1265813f835b9cf
SSDEEP 3072:xuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:xuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T19B847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tnljdbvtnl.exe

Path C:\Temp\i_tnljdbvtnl.exe
Size 365KB
SHA256 eebcb76dacbd5926e8bb8bf72bf5f4e4e035e234a7c6e55c92297080b309c67a
MD5 0340a74e13655490dc1646664df38532
SHA1 d2231d1a46256aaca1af91ea4ff154223c9e4876
SHA512 0c0b2b49bf672cc1e167b72b0cc5958c90b97a5afcdafca65d0df72cc27e61a2032434f699e91b595eeabcb90acbd88b2fd6622daad66dd5dacf890fc2fd9136
SSDEEP 3072:/uxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:/uxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B3847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_trmjebzwuo.exe

Path C:\Temp\i_trmjebzwuo.exe
Size 365KB
SHA256 e9d873b208840ad8271863e834745d1dc3548db2b3f6a528aeab74031e292723
MD5 a385d01b1e52f8d35ffa7dc5735ad760
SHA1 bb41ed26289123c4b695765d188e87552bddf9cb
SHA512 427156974f8235b09a7b682f26ba55d78e0d44fee8d4c8f6977e143a6dd86ced7004137a303a6a3c925c1d0865f83d6658d650336d8a586ebbb1b332fa0a433f
SSDEEP 3072:HuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:HuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1BF847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ifaysqkiav.exe

Path C:\Temp\ifaysqkiav.exe
Size 365KB
SHA256 ac4b83fbfbca9fc339c1beb946969064dc358d2396355a1ae056eafc684ceb16
MD5 f94e3ae069b0d0ee655e21dccb073482
SHA1 4e08b1152ac33304f818b442f47cbbd2ed2b85d8
SHA512 6ea099a13f2c467043d4c4f63767bbcd5c12350d5f703b1ac82c9afed18b80248fc3ed0495da3d9634e34086df8af428f20ac791540c00fd8fe9a83959e8e779
SSDEEP 3072:fuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:fuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T156847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkecwupmhu.exe

Path C:\Temp\mkecwupmhu.exe
Size 365KB
SHA256 049a5544c046126d614a947f24432c20ebd56eaf9d57bec70dc41715abda5efb
MD5 35b1049165b6383d3b5706a40ce5f41b
SHA1 884b9ff9cbb112ab09a90465f2372396b656b4c7
SHA512 26d356b8621db66b2116bf356b63ddf334ac918d8436de2be975d924f40a27ab7dc933149daba0cc6c8d66b6fec152d7ff86911bfb3a2db2fca6af5e5aa06663
SSDEEP 3072:tuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:tuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T15A847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nifdxvqnli.sys

Path C:\Temp\nifdxvqnli.sys
Size 293KB
SHA256 e0a1927b5930652d5b9a30303757d6b7c397a793055bca3305ad461e0efb9b30
MD5 3618f301b273fb4e4133812539282147
SHA1 c61869f325550921e9016acfdd5e2982ababff9e
SHA512 c8d5bf90ea72e924935ab6affaa1b9802323c0f0bff686874e1fc339c1df03c466c4d0fb7743dc8711af6fde11a1b126d97fd196038f3adc5ce040ab6df5b403
SSDEEP 3072:ftKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:fIJjiJcbI03GBc3ucY5DCSj
TLSH
T1EA545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nkfdausmkh.sys

Path C:\Temp\nkfdausmkh.sys
Size 293KB
SHA256 1d405e8e7e36c9e12c5a5fa9d271b11df2c5aaa4942a224d3bf69883ce4b4bf7
MD5 cce92c3e042e7f96545f26fedb17b0f0
SHA1 f1b4c9dfe76b83c8e266c7b2ba402770b2ca6bc4
SHA512 7b82e8aa862e7753080451e96871042456be98746073677850f4d2e4e2da4efb9a878a338058e2ab0e95dcffcaa4d0d7a4e256a20e1b5c4a66cbeb2c1f94939f
SSDEEP 3072:LtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:LIJjiJcbI03GBc3ucY5DCSj
TLSH
T18D545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qljdbvtnlgdywqoi.exe

Path C:\Temp\qljdbvtnlgdywqoi.exe
Size 365KB
SHA256 6660209dad17abd9e711d433540992f4e7e660c91043c660844e2c20fcab62d1
MD5 0386aa9412e1979d2f86d9deb723bacf
SHA1 16416965140781fd1f2e8942fd929c7d3d75881c
SHA512 dbdd00a35ae57f85b8e73c498f5309ec41fec6eed4e06b3e4a2b36b3e0bbe837a75d0b59e6e091174b053ef335f69c39abf96eca58b5e4cdbe4c6dc4579ee494
SSDEEP 3072:CuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:CuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T10C847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qljdbvtnlgdywqoi.sys

Path C:\Temp\qljdbvtnlgdywqoi.sys
Size 293KB
SHA256 54e86268b4d32e461b87f059e8e96eaff74a372b8f3d2c80018ce27c7b92d5d7
MD5 0fbc85d9abb089db9661a17b2456b75b
SHA1 7d7e365244434892d9aca99679216e579514d3a1
SHA512 cc50f6929b803cf6a487e4b40ecaf95fa4da5dabb5461449cf4cda4ee764a7d5cede52febab5c46ace5c3ae716ee668ba7d53daa18ac8d1e22b02c5cb6371d40
SSDEEP 3072:OtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:OIJjiJcbI03GBc3ucY5DCSj
TLSH
T1AB545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

romjebwtom.sys

Path C:\Temp\romjebwtom.sys
Size 293KB
SHA256 bad918742b5bf3e8f580d752fbc8ca6a516b15dc2ab84c24d411b5eb9a331a57
MD5 227550e88cebcd7196e536e0441a9cd8
SHA1 5410dfd42b1262086a2fbaf974a85b1eaed2903f
SHA512 81ca64a670dd2b6a84747b2e9e54574d36b0a6b74da3ad832927464b8457c8b1d8c7027e44affea8f9c8a6fbb7ae4d41aae0365ebc1fc7f6fd02382f0fd525d2
SSDEEP 3072:JtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:JIJjiJcbI03GBc3ucY5DCSj
TLSH
T112545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpmkecwupm.sys

Path C:\Temp\rpmkecwupm.sys
Size 293KB
SHA256 aa815e922465912de8ab7d63e510e9d85bc8372a88577d3427533745859a980e
MD5 8660454252f343a4df4b1e32f9814bea
SHA1 7ac836cf64870c821c41941e6cd69ffe66e34f72
SHA512 89b8e03ab9e036a32534de49cf64d23247dc6e58fc23437ebe923997fa5eeb2fa355aa30ce82823a32b986477a572c1015bc9bda463ab3a6c309a7935643f866
SSDEEP 3072:5tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:5IJjiJcbI03GBc3ucY5DCSj
TLSH
T18A545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spkhfcwusp.exe

Path C:\Temp\spkhfcwusp.exe
Size 365KB
SHA256 f182e87f0e679a726280e8546bbc28cde2a2bb7786b7a40863161a6a20e15543
MD5 99af191651d5ff6f21a7d439a0366787
SHA1 9c7f7206629a18226441576b86bc5873c3217858
SHA512 d415fbd3290e2d84d1f9d5da02861a4467d5da3a43b816d713c8c484db1aa4ebc17de4c21a1c109a4be2280a77a00ce815b8fbfcf84c0ccc0b8379e8dfd44371
SSDEEP 3072:kuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:kuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T13F847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnljdbvtnl.exe

Path C:\Temp\tnljdbvtnl.exe
Size 365KB
SHA256 563bc27df828b604281974343a07aa24b51a250849d6663e95aa72459cd64f72
MD5 931e7e32d0e7b8e71cfdb31a99e74e51
SHA1 99d919de754a266154e658531d3e9c0357e57f78
SHA512 603cb01896a98e5428b1ff1dfb89532af65e3f049650e67d35b15648b598dd2716dcf3c20564cb1ec845763c34f68e25c1f0a2899792e8f7f1bd373626664339
SSDEEP 3072:muxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:muxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1CD847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trljdbwtoj.exe

Path C:\Temp\trljdbwtoj.exe
Size 365KB
SHA256 084183b91639546abc529cd624980c0191ae5f8ff4739b11787ca9894097bffc
MD5 0aecfb54dc6907b340137487db76627a
SHA1 b13f29bb0de08e6bf95b01832fb6524e8d77d56b
SHA512 972e4acdf9cdd7c1c41b13d05207593d8a8261497e8821109926fbd448005a1eb69fb5c0d8916c952a76bb88110a2ed2d673c2ea1c605ad5c7190e632b92c971
SSDEEP 3072:CuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:CuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B0847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trmjebzwuo.exe

Path C:\Temp\trmjebzwuo.exe
Size 365KB
SHA256 384ec99cb2843cbc4cad7bd6dd411362f8c0302ec51b1eae24bea4dfa4597aae
MD5 3efaadbc15b4abdd2272e916a0402c14
SHA1 ae95a408407697319b8e790f6516d3a80788cbf3
SHA512 36e441e86a3c614d7bd0c0637d7314cdf734913f142bdad3996d36a09810bf56c4c1bef71bf120529e24b00cb52d7afb8adca5b07a0d0c734eccfddf142cc8d4
SSDEEP 3072:iuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:iuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F2847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xspkhfdxvp.sys

Path C:\Temp\xspkhfdxvp.sys
Size 293KB
SHA256 535759ee6824a57a10374b1d356f02d37fae0ceb3a8c35ffc03d6c55a0c1e8d9
MD5 7bc2fdc7d71c89ccbf3d6247d660b157
SHA1 8a75e3e25c3383ef321eb13d399992c3241dd629
SHA512 51d691d9344776f83157cb5dffb450d79f59d68687ae3d8f098156d3c1d5b69413d5f23cbf3dcd07a9df58b17e3b953c0462cbbe0363e2e8f49a9fe8c197172f
SSDEEP 3072:gtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:gIJjiJcbI03GBc3ucY5DCSj
TLSH
T1EC545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxrpjhbzur.sys

Path C:\Temp\zxrpjhbzur.sys
Size 293KB
SHA256 aef912d2e7396ca0e6e67b953856ba2385d138c379b6e047bac0270acd651c04
MD5 d01f0cec4aa719a2aff08db97f89e4a2
SHA1 425a41c5bd4027e05bd41bf1bb03cf5c344b17ec
SHA512 c2a612ca47d3e7c3f42d8bf6571ed329875f981744731b077b2eef4367a61da961098b6547a1e25ee465a194cc9fd4f67fafc92c303f5e0b55e4ba9b6d421ed9
SSDEEP 3072:LtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:LIJjiJcbI03GBc3ucY5DCSj
TLSH
T1A2545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0c08919c-f333-4149-a292-e59e09707f44.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0c08919c-f333-4149-a292-e59e09707f44.tmp
Size 35KB
SHA256 28c6be29eacb66121b45d88511aefae10cd70796dc7cead1140b814cd7bb6175
MD5 21b25dd8dd37b9573124dee920889709
SHA1 b592c13df9eb9cda092225d68ac11d37b53145fd
SHA512 924fdc1cf0d495661cbfe926763f752186b16fb96ab36a943c1beb8fa77078ea4647bc3905f75e10703967cf2937e50e4723270819e6e8df9c629f47a0bf6f43
SSDEEP 384:n3OZcIG38NPlAB35omnthJDZNfNoXOVSUURXvFAiXSFBETRzcoXfK86sfxEZxxsL:cG3Bp5lDZIO0Z/3Nzc4ReyIsP+nb9M9
TLSH
T12FF2AE31EC39CD63ACEAA246B65A36A27EF5513BC1C81E88D5DD9F0C49036AD071BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 9b906bd3ca56d77bcb82edde765624d13d485dad7f94064ac0281dffb8fcdfc0
MD5 436bfa96c7705459a57218516d901d83
SHA1 8b6e2dabfc827028024556a88f8adebe5ebf5515
SHA512 c50b709c39f63ce737d8f2d6f9f7f4deb9d7deb05474fe31cfdf610322ae94e42dcef457e557ebddff7abafbea4b8c7f584896851185ea43a24e9f9ec64f4e59
TLSH
T1C6512B1DA33614D6E3240772BDD394883FF5CC9A08075E1AA0409EB868C2F17AED2AD3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59eb02.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59eb02.TMP
Size 2KB
SHA256 dea597857df95393ed35b3fa89a4d0848843230f698140b488214e6828522664
MD5 0a66cf44f331e19239f02869941c1b85
SHA1 338de09722ac7cf1261432ce60e2fa3df7f488bf
SHA512 b2ef275c1a7b1cb8d56536caceae5c676b32080dd318d2b40f55116ef5ae80890055c9d4d067b42f15553f44914e06c4ae327bfc36b64035150b9fc0b80e8966
TLSH
T193512E1DA37514D6E3640772BDE394883FF5CC9A08075E1BA4419EB868C2F17ADD2AD3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 bd205d8d5ece136b24746980eb273e390fbf057f61b47059f625e74c1c0975b4
MD5 0dc19b0418cfc9a41d72d041e5588d2e
SHA1 b4a7ed3bc5d9ffc0391a3d83eda9b97d14dbd719
SHA512 1e97a6b7eefc8aad5dbfa104125acd9be2a1474d431f941d5bf1d7a1eba5f969c8fc32c6efd69f148420b93ead991547e274472a87d2a2ece366afea2c1e4996
TLSH
T1CF41DFF3C3E8D66D890186F4AA146E1BCE2C0914432C7C6BC8E4AF2B93F2471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 e354ee46c30f0a5f2cfc3c085b1c1bee1831e7c6fffebb0088e7468cdf7496c3
MD5 008ca6dea8591f9134a70609cbf4f519
SHA1 ec60208c46e0e8223f305564d11d72d2dbacb575
SHA512 3c0b8e02dff8cb276c298a68bca8df5eb9b0976f1c77379a22d79c0a666423686870c2f66e11708766e365f5fd1ffa2562a82a617f6d5ec28450e7df567c6ad1
SSDEEP 192:sxRlR/C//fpsTNTprQ5NzoA8p94S/g6+WNCIg/Ynys8vGL1QIgVvJ:sxRlU//fpsTtBWS/5y/bRbf
TLSH
T19142B81A6D28AC3B8CCBD21ABB557F53D2F91032A1D55E48E6FC8B1C04E66DD620780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 1aab8fb4ea967ca2c335620cf31cd34a5e761116bfa1ef3eee51cc647d562979
MD5 ae7f7d3446186857f29696172b1b64ec
SHA1 f59643c0af29ffe2b3be113453caac5ff61ee95d
SHA512 c8c536d53d567a7ab21681ef69e949994fe2d96d4162b969dc539e6be17daf202f85c503b6674f5727542b6c363270b77b35d7fa346e251e30e7d9fb9a5f84e9
SSDEEP 192:sxRmR/C//fpsINiprQ5NzoA8p94S/g6+WNCIg/YnyF8vGL1QIgDuMvJ:sxRmU//fpsIEBWS/5y/bqbD
TLSH
T10842A81AAD28AD3B9CCBD219BB557F53D2F95032A1D51E48E6FC8B1C04E67CD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 06f1fc226fafd7a3f2ea9daf1da218779e6d73370c96460d1e9e0a0aa3c13948
MD5 9ce19ee386d2f92fbe56030ff4281088
SHA1 3c94ebd4b78939564abc9677650e602180f18f73
SHA512 bb2698ad8713b5654815bf0dce22ebfc4c50065f0106cd08d9799b7c683b596b02f307d6a8311c54bc86eaffa7927b3dda4c6cf731d7722da011be753557e668
SSDEEP 192:sxRmR/C//fpsINTprQ5NzoA8p94S/g6+WNCIg/Ynys8vGL1QIgDuWvJ:sxRmU//fpsItBWS/5y/bRbV
TLSH
T15C42B91AAD28AD3B8CCBD21ABB557F53D2F91032A1D55E48E6FC8B1C04E67CD520780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 c9b1ed3de00785260024e8291840f3df3aa203b1e7b369231e0bc0e9df9f9750
MD5 2bce1816929ecd25213d997676a6f914
SHA1 cc55bbbbe4f81f34aa9fa255461471ff4c3c1fda
SHA512 06076979ebb37f5a6b3e81dcaea71c7c252f8ae40f2b783493e21c50137590f857db2ff0ed8587efc3b8ee32b58912f6268384f6554281fb2a22e2d00e180c0b
SSDEEP 768:wb8d2g7pLuL7r6Wgouf6M8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEu46frohxS5p:wb8d2sE7r6Wgouf6Mu1jaXV6MCX
TLSH
T14CC2DA7B740DCB7E4F800ADDE819BE9F6DA802CB5AD8CD4047FE951C02C6BEA51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 43d1aa9bdfb38ad89c5f62d691c5ecf5c49beb65e4c51018f860385b49540324
MD5 de2fb40353818d5b19c1916cd8a1ba58
SHA1 d32f6a57a6da3c049aee1f0043263c327e828ad5
SHA512 86ccf5b00f1e2c57e9c17d14ecf0bcf2b1677be54d37746b5ff88ede115986a665500e2cd0a6d4e9b983914bdff0f8f2c96a399510882ce50e3523d0531878bc
SSDEEP 96:KRoZs4q26gWeDzgggK41gCgcwgziItHU1gkeCGEWCPvgsEK4hgmEcEkver1mK2Q5:CoZs4q26neDsgU1gC/wgziItHU1gkeCR
TLSH
T147913654303F02C4383D661C85A4995EE6C27872B56DB8AB3FE855A25F27E034DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a83b8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a83b8.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 c70acc865a231cc7ac5624ccadbded877be35c313b22b2c90743b0b852ae2183
MD5 759f57127e163235f626d8aab32f2908
SHA1 527c52fe052f6970ce63bfcb9935cdb22cbd2f05
SHA512 4db31c7c5dcd8d4dd7bdd4839339ceacc6b4a7fd7f8f81e45812fc8c35e32ddc65362143c11926b36511e0afc82f2c07176b222af52d208d4d383e542e03845a
SSDEEP 384:n36ZcIG38NPOAB35omnthJDZNfNoXOVSUURXvFAiXSFBETRzcoXfK86sfxEZxxsL:oG3cp5lDZIO0Z/3Nzc4ReyIsP+nb9M9
TLSH
T147F2AE31EC39CD63ACEAA746B64A36A27EF5513BC1C81E88D5DD9F0C49036AD071B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 cf04496e8ae9e5456d8cb113522a94d110ee753471a7b5d855690a2b18c6f213
MD5 654999f535c760ff265ae90bcf7794e2
SHA1 7015eca040e6bf990b00ee98c772ea8a3a065b7f
SHA512 5657fc4a59cf90384e4b646c08a1ecaa6cf23c2ffee78bc33cd66f07076ce6f384c6b924deb44a5bc8daa69bf811557b210a244e3fd2ffc76df089a8ae193fe6
SSDEEP 768:6rv+4UNbds38kDZIO0ZaNzc4ReyIsXzeVH1S5D:6bsbS3Rtc44bsDEH1Y
TLSH
T1DC03CF32E8788937ACF66786B54B76533EF8512782D81B90C5DE6F0C4A4B1DD131B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 e8d840eb806a46a07ad685049c68d7dbbead9615249077de05455c566745161e
MD5 593bffb261c0de789ee9a59318ee80f8
SHA1 b4b9774b7f755db1b98316ee0aaaa32bef4d790b
SHA512 58d025afe2d92904a5389dd166fcb20db24ea2e742172e839a1e5d3df6ca82c21c37f8b7d8ff599cb592421645edc2345bd23cb87c8c56ab977c4bc7871116e3
SSDEEP 384:nWHZcIG38NPQAB35oPnthJDZNfNoXOVSUURXvFAiXSFXETRzcoXfK86sfxEZxxsL:cG3yp6lDZIO0Z/xNzc4ReyIsP+nb9M9
TLSH
T118F2AE31EC39CD639CEAA242B64A36A27EF5513BC1C81E88D5DD9F0C49036AD071BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 0a0ca1c912df9b78bea9c2fc6ebc097e7f7f19a34d07304d2a1ae247d93346f8
MD5 232a496b36820274a35f623995908a13
SHA1 445e033637cedec1fe95a5ba9de2a5ca546c3d45
SHA512 9cd191f74678890293f89d8d2878ecee13d52cd610e8e1717b34d49c261317dd88162ea514402ae49b5cdf24449bdaee1b37ce96f8ec766d2397f028faf0c4b9
SSDEEP 768:gFHr3ewg1pUMZQ5O0Z/8uNzc4ReyIsP+nb9M9:wr3CVutc44bsmnb+9
TLSH
T1F91306F698E78976E8AE5743A33D2D52ADFDD167B1885984B7C85E0CCC421BFC30A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

940f6363-84a5-414c-8d32-d1dd72122ce7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\940f6363-84a5-414c-8d32-d1dd72122ce7.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json~RFe59bfcc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe59bfcc.TMP
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 79c0c3f81d36764399eda47bed020d1dc6174aaa327971950157f8cb723d879b
MD5 9a4b196398a055879d3ce8e87652a913
SHA1 42cad049e845435dc278783760205b1c24386c04
SHA512 870261250983bfcfb41c75f69453d95529572cf54c8f10c724f3396fd2214ad3c415334e274c6209eca848429eb967b2bc5220064fc630a697b38a81a06a2c61
TLSH
T16C71238356BDD9B2C6DE5FF103835644F6FB22380B6330200B955586AB30B7A58B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1336-392-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1548-207-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1860-388-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2076-383-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2388-243-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2540-325-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2868-409-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2892-168-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3264-296-0x00000000004A0000-0x0000000000500000-memory.dmp

Download

memory/3428-255-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3528-72-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4760-306-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4760-405-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4768-321-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4792-396-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4792-413-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4800-350-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5100-400-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5592-370-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5592-385-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5892-302-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5892-283-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6104-295-0x0000000000010000-0x00000000000AB000-memory.dmp

Download