systex | 3726b90d0946e2dd84c34c0e05161e458614f4dc49feae5a01cde0226dca2317

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 14:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_3196de8d153607f453d0bd04ae54a47d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Size 376KB
Sample260801-rfva3s1vcs
SHA256 3726b90d0946e2dd84c34c0e05161e458614f4dc49feae5a01cde0226dca2317
MD5 3196de8d153607f453d0bd04ae54a47d
SHA1 43d7aa536640738dc8d82f9b4647b17f693d2ecb
SHA512 fe3ffe6e86381c1fb81e18cb309774f812d1e37b7b56aca2e03a812753f9f2279c29c6c058b3be79128b29d031d577391247148d879ed8531e24d5e3d0072579
SSDEEP 3072:AViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:AViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1FE847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
3180	gbzwrojhtrojgbzt.exe
6712	gbzwrojhtrojgbzt.sys
4732	CreateProcess.exe
5972	ztrljdbwuo.exe
4584	CreateProcess.exe
6512	CreateProcess.exe
4568	i_ztrljdbwuo.exe
4856	geywtolgey.sys
7080	CreateProcess.exe
4264	bytjdbytql.exe
4280	CreateProcess.exe
6128	CreateProcess.exe
6004	i_bytjdbytql.exe
3276	igaywqoiga.sys
2180	CreateProcess.exe
2532	gdyvqnliga.exe
3096	CreateProcess.exe
4332	CreateProcess.exe
5536	i_gdyvqnliga.exe
2864	vpnifaysqk.sys
3840	CreateProcess.exe
2188	vqnigaytnk.exe
2520	CreateProcess.exe
2688	CreateProcess.exe
4304	i_vqnigaytnk.exe
6488	fcaysqkica.sys
2396	CreateProcess.exe
4140	axspkicavs.exe
6640	CreateProcess.exe
3960	CreateProcess.exe
5068	i_axspkicavs.exe
600	khfzxspkif.sys
620	CreateProcess.exe
6212	zxrmkecwup.exe
6288	CreateProcess.exe
1108	CreateProcess.exe
2876	i_zxrmkecwup.exe
6072	fzxrpmkecz.sys
5592	CreateProcess.exe
6068	hczxrpjecz.exe
876	CreateProcess.exe
3932	CreateProcess.exe
6380	i_hczxrpjecz.exe
3216	cztrmjecwu.sys
5216	CreateProcess.exe
4816	zwurmkezwr.exe
4176	CreateProcess.exe
3892	CreateProcess.exe
7024	i_zwurmkezwr.exe
2452	omjdbwtroj.sys
6956	CreateProcess.exe
2432	mgeywrojhb.exe
4632	CreateProcess.exe
5536	CreateProcess.exe
3616	i_mgeywrojhb.exe
5584	mgeywqojgb.sys
1504	CreateProcess.exe
464	ywqolgbywq.exe
6000	CreateProcess.exe
3720	CreateProcess.exe
3596	i_ywqolgbywq.exe
4064	tqoigbywqo.sys
5152	CreateProcess.exe
3420	nljdbvtnlj.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_358061122\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_1470470829\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_1470470829\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_108807067\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_108807067\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5968_358061122\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbzwrojhtrojgbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztrljdbwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztrljdbwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vqnigaytnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhfdxsqnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vqnigaytnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwurmkezwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgeywrojhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigbywqoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ytrljdbvto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgeywrojhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywqolgbywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigbywqoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ytrljdbvto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bytjdbytql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axspkicavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxrpkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czurmkezxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdyvqnliga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nljdbvtnlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hczxrpnhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bytjdbytql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdyvqnliga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqolgbywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhfdxsqnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czurmkezxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axspkicavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrmkecwup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxrmkecwup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hczxrpjecz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nljdbvtnlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdyvqlidav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxrpkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hczxrpnhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_3196de8d153607f453d0bd04ae54a47d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hczxrpjecz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwurmkezwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdyvqlidav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhbztrom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhbztrom.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2656	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3900	ipconfig.exe
1012	ipconfig.exe
6604	ipconfig.exe
7052	ipconfig.exe
4632	ipconfig.exe
5596	ipconfig.exe
2300	ipconfig.exe
3816	ipconfig.exe
5704	ipconfig.exe
5380	ipconfig.exe
7068	ipconfig.exe
2120	ipconfig.exe
5184	ipconfig.exe
6176	ipconfig.exe
1628	ipconfig.exe
2592	ipconfig.exe
3376	ipconfig.exe
4276	ipconfig.exe
2036	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134300669271690934"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{82C0FAB2-444F-42AF-A871-E2BFDA260B44}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4088	2026-08-01_3196de8d153607f453d0bd04ae54a47d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4088	2026-08-01_3196de8d153607f453d0bd04ae54a47d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4088	2026-08-01_3196de8d153607f453d0bd04ae54a47d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4088	2026-08-01_3196de8d153607f453d0bd04ae54a47d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4088	2026-08-01_3196de8d153607f453d0bd04ae54a47d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4088	2026-08-01_3196de8d153607f453d0bd04ae54a47d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4088	2026-08-01_3196de8d153607f453d0bd04ae54a47d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4088	2026-08-01_3196de8d153607f453d0bd04ae54a47d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4088	2026-08-01_3196de8d153607f453d0bd04ae54a47d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4088	2026-08-01_3196de8d153607f453d0bd04ae54a47d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4088	2026-08-01_3196de8d153607f453d0bd04ae54a47d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4088	2026-08-01_3196de8d153607f453d0bd04ae54a47d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4088	2026-08-01_3196de8d153607f453d0bd04ae54a47d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4088	2026-08-01_3196de8d153607f453d0bd04ae54a47d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4088	2026-08-01_3196de8d153607f453d0bd04ae54a47d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4088	2026-08-01_3196de8d153607f453d0bd04ae54a47d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4088	2026-08-01_3196de8d153607f453d0bd04ae54a47d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4088	2026-08-01_3196de8d153607f453d0bd04ae54a47d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4088	2026-08-01_3196de8d153607f453d0bd04ae54a47d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4088	2026-08-01_3196de8d153607f453d0bd04ae54a47d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4088	2026-08-01_3196de8d153607f453d0bd04ae54a47d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4088	2026-08-01_3196de8d153607f453d0bd04ae54a47d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4088	2026-08-01_3196de8d153607f453d0bd04ae54a47d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4088	2026-08-01_3196de8d153607f453d0bd04ae54a47d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4088	2026-08-01_3196de8d153607f453d0bd04ae54a47d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4088	2026-08-01_3196de8d153607f453d0bd04ae54a47d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4088	2026-08-01_3196de8d153607f453d0bd04ae54a47d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4088	2026-08-01_3196de8d153607f453d0bd04ae54a47d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4088	2026-08-01_3196de8d153607f453d0bd04ae54a47d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4088	2026-08-01_3196de8d153607f453d0bd04ae54a47d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4088	2026-08-01_3196de8d153607f453d0bd04ae54a47d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4088	2026-08-01_3196de8d153607f453d0bd04ae54a47d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4088	2026-08-01_3196de8d153607f453d0bd04ae54a47d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4088	2026-08-01_3196de8d153607f453d0bd04ae54a47d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4088	2026-08-01_3196de8d153607f453d0bd04ae54a47d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4088	2026-08-01_3196de8d153607f453d0bd04ae54a47d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4088	2026-08-01_3196de8d153607f453d0bd04ae54a47d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4088	2026-08-01_3196de8d153607f453d0bd04ae54a47d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4088	2026-08-01_3196de8d153607f453d0bd04ae54a47d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4088	2026-08-01_3196de8d153607f453d0bd04ae54a47d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4088	2026-08-01_3196de8d153607f453d0bd04ae54a47d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4088	2026-08-01_3196de8d153607f453d0bd04ae54a47d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3180	gbzwrojhtrojgbzt.exe
4088	2026-08-01_3196de8d153607f453d0bd04ae54a47d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4088	2026-08-01_3196de8d153607f453d0bd04ae54a47d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3180	gbzwrojhtrojgbzt.exe
3180	gbzwrojhtrojgbzt.exe
4088	2026-08-01_3196de8d153607f453d0bd04ae54a47d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3180	gbzwrojhtrojgbzt.exe
4088	2026-08-01_3196de8d153607f453d0bd04ae54a47d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3180	gbzwrojhtrojgbzt.exe
4088	2026-08-01_3196de8d153607f453d0bd04ae54a47d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4088	2026-08-01_3196de8d153607f453d0bd04ae54a47d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4088	2026-08-01_3196de8d153607f453d0bd04ae54a47d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4088	2026-08-01_3196de8d153607f453d0bd04ae54a47d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4088	2026-08-01_3196de8d153607f453d0bd04ae54a47d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4088	2026-08-01_3196de8d153607f453d0bd04ae54a47d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4088	2026-08-01_3196de8d153607f453d0bd04ae54a47d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4088	2026-08-01_3196de8d153607f453d0bd04ae54a47d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4088	2026-08-01_3196de8d153607f453d0bd04ae54a47d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4088	2026-08-01_3196de8d153607f453d0bd04ae54a47d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3180	gbzwrojhtrojgbzt.exe
3180	gbzwrojhtrojgbzt.exe
3180	gbzwrojhtrojgbzt.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5968	msedge.exe
5968	msedge.exe
5968	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	4568	i_ztrljdbwuo.exe
Token: SeDebugPrivilege	6004	i_bytjdbytql.exe
Token: SeDebugPrivilege	5536	i_gdyvqnliga.exe
Token: SeDebugPrivilege	4304	i_vqnigaytnk.exe
Token: SeDebugPrivilege	5068	i_axspkicavs.exe
Token: SeDebugPrivilege	2876	i_zxrmkecwup.exe
Token: SeDebugPrivilege	6380	i_hczxrpjecz.exe
Token: SeDebugPrivilege	7024	i_zwurmkezwr.exe
Token: SeDebugPrivilege	3616	i_mgeywrojhb.exe
Token: SeDebugPrivilege	3596	i_ywqolgbywq.exe
Token: SeDebugPrivilege	6900	i_nljdbvtnlj.exe
Token: SeDebugPrivilege	4892	i_fdyvqlidav.exe
Token: SeDebugPrivilege	5448	i_pnhfdxsqnh.exe
Token: SeDebugPrivilege	7004	i_fzxrpkhcau.exe
Token: SeDebugPrivilege	4860	i_hczxrpnhfz.exe
Token: SeDebugPrivilege	2792	i_czurmkezxr.exe
Token: SeDebugPrivilege	5992	i_rpjhbztrom.exe
Token: SeDebugPrivilege	6320	i_qoigbywqoj.exe
Token: SeDebugPrivilege	5704	i_ytrljdbvto.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5968	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4088 wrote to memory of 3180	4088	2026-08-01_3196de8d153607f453d0bd04ae54a47d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 4088 wrote to memory of 2908	4088	2026-08-01_3196de8d153607f453d0bd04ae54a47d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	91
PID 2908 wrote to memory of 5968	2908	iexplore.exe	92
PID 5968 wrote to memory of 4764	5968	msedge.exe	93
PID 5968 wrote to memory of 6916	5968	msedge.exe	95
PID 5968 wrote to memory of 2656	5968	msedge.exe	94
PID 5968 wrote to memory of 6916	5968	msedge.exe	95
PID 5968 wrote to memory of 6916	5968	msedge.exe	95
PID 5968 wrote to memory of 6596	5968	msedge.exe	96
PID 5968 wrote to memory of 6596	5968	msedge.exe	96
PID 5968 wrote to memory of 4804	5968	msedge.exe	98
PID 5968 wrote to memory of 6780	5968	msedge.exe	99
PID 5968 wrote to memory of 4804	5968	msedge.exe	98
PID 5968 wrote to memory of 4804	5968	msedge.exe	98
PID 5968 wrote to memory of 6780	5968	msedge.exe	99
PID 5968 wrote to memory of 6780	5968	msedge.exe	99
PID 5968 wrote to memory of 6848	5968	msedge.exe	103
PID 5968 wrote to memory of 7036	5968	msedge.exe	102
PID 5968 wrote to memory of 6848	5968	msedge.exe	103
PID 5968 wrote to memory of 7036	5968	msedge.exe	102
PID 3180 wrote to memory of 4732	3180	gbzwrojhtrojgbzt.exe	104
PID 5968 wrote to memory of 236	5968	msedge.exe	107
PID 5972 wrote to memory of 4584	5972	ztrljdbwuo.exe	109
PID 3180 wrote to memory of 6512	3180	gbzwrojhtrojgbzt.exe	114
PID 3180 wrote to memory of 7080	3180	gbzwrojhtrojgbzt.exe	118
PID 4264 wrote to memory of 4280	4264	bytjdbytql.exe	120
PID 3180 wrote to memory of 6128	3180	gbzwrojhtrojgbzt.exe	123
PID 3180 wrote to memory of 2180	3180	gbzwrojhtrojgbzt.exe	127
PID 2532 wrote to memory of 3096	2532	gdyvqnliga.exe	129
PID 3180 wrote to memory of 4332	3180	gbzwrojhtrojgbzt.exe	132
PID 3180 wrote to memory of 3840	3180	gbzwrojhtrojgbzt.exe	137
PID 2188 wrote to memory of 2520	2188	vqnigaytnk.exe	139
PID 3180 wrote to memory of 2688	3180	gbzwrojhtrojgbzt.exe	142
PID 5968 wrote to memory of 4064	5968	msedge.exe	144
PID 5968 wrote to memory of 2732	5968	msedge.exe	145
PID 5968 wrote to memory of 5260	5968	msedge.exe	146
PID 3180 wrote to memory of 2396	3180	gbzwrojhtrojgbzt.exe	149
PID 4140 wrote to memory of 6640	4140	axspkicavs.exe	151
PID 3180 wrote to memory of 3960	3180	gbzwrojhtrojgbzt.exe	154
PID 3180 wrote to memory of 620	3180	gbzwrojhtrojgbzt.exe	158
PID 6212 wrote to memory of 6288	6212	zxrmkecwup.exe	160
PID 3180 wrote to memory of 1108	3180	gbzwrojhtrojgbzt.exe	163
PID 3180 wrote to memory of 5592	3180	gbzwrojhtrojgbzt.exe	167
PID 6068 wrote to memory of 876	6068	hczxrpjecz.exe	169
PID 3180 wrote to memory of 3932	3180	gbzwrojhtrojgbzt.exe	172
PID 3180 wrote to memory of 5216	3180	gbzwrojhtrojgbzt.exe	176
PID 4816 wrote to memory of 4176	4816	zwurmkezwr.exe	178
PID 3180 wrote to memory of 3892	3180	gbzwrojhtrojgbzt.exe	181
PID 5968 wrote to memory of 6976	5968	msedge.exe	183
PID 5968 wrote to memory of 6976	5968	msedge.exe	183
PID 3180 wrote to memory of 6956	3180	gbzwrojhtrojgbzt.exe	188
PID 2432 wrote to memory of 4632	2432	mgeywrojhb.exe	190
PID 3180 wrote to memory of 5536	3180	gbzwrojhtrojgbzt.exe	193
PID 3180 wrote to memory of 1504	3180	gbzwrojhtrojgbzt.exe	197
PID 464 wrote to memory of 6000	464	ywqolgbywq.exe	199
PID 5968 wrote to memory of 4424	5968	msedge.exe	202
PID 5968 wrote to memory of 4424	5968	msedge.exe	202
PID 3180 wrote to memory of 3720	3180	gbzwrojhtrojgbzt.exe	203
PID 3180 wrote to memory of 5152	3180	gbzwrojhtrojgbzt.exe	207
PID 3420 wrote to memory of 4592	3420	nljdbvtnlj.exe	209
PID 3180 wrote to memory of 1968	3180	gbzwrojhtrojgbzt.exe	212
PID 3180 wrote to memory of 5864	3180	gbzwrojhtrojgbzt.exe	216
PID 6712 wrote to memory of 1100	6712	fdyvqlidav.exe	218
PID 3180 wrote to memory of 976	3180	gbzwrojhtrojgbzt.exe	221

C:\Users\Admin\AppData\Local\Temp\2026-08-01_3196de8d153607f453d0bd04ae54a47d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_3196de8d153607f453d0bd04ae54a47d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4088
- C:\Temp\gbzwrojhtrojgbzt.exe
  C:\Temp\gbzwrojhtrojgbzt.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3180
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ztrljdbwuo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4732
  - - C:\Temp\ztrljdbwuo.exe
      C:\Temp\ztrljdbwuo.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5972
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4584
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5704
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ztrljdbwuo.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6512
  - - C:\Temp\i_ztrljdbwuo.exe
      C:\Temp\i_ztrljdbwuo.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4568
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bytjdbytql.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:7080
  - - C:\Temp\bytjdbytql.exe
      C:\Temp\bytjdbytql.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4264
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4280
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5380
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bytjdbytql.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6128
  - - C:\Temp\i_bytjdbytql.exe
      C:\Temp\i_bytjdbytql.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6004
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gdyvqnliga.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2180
  - - C:\Temp\gdyvqnliga.exe
      C:\Temp\gdyvqnliga.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2532
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3096
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4632
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gdyvqnliga.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4332
  - - C:\Temp\i_gdyvqnliga.exe
      C:\Temp\i_gdyvqnliga.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5536
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vqnigaytnk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3840
  - - C:\Temp\vqnigaytnk.exe
      C:\Temp\vqnigaytnk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2188
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2520
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1628
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vqnigaytnk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2688
  - - C:\Temp\i_vqnigaytnk.exe
      C:\Temp\i_vqnigaytnk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4304
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\axspkicavs.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2396
  - - C:\Temp\axspkicavs.exe
      C:\Temp\axspkicavs.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4140
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6640
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1012
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_axspkicavs.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3960
  - - C:\Temp\i_axspkicavs.exe
      C:\Temp\i_axspkicavs.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5068
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zxrmkecwup.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:620
  - - C:\Temp\zxrmkecwup.exe
      C:\Temp\zxrmkecwup.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6212
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6288
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5596
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zxrmkecwup.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1108
  - - C:\Temp\i_zxrmkecwup.exe
      C:\Temp\i_zxrmkecwup.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2876
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hczxrpjecz.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5592
  - - C:\Temp\hczxrpjecz.exe
      C:\Temp\hczxrpjecz.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6068
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:876
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2592
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hczxrpjecz.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3932
  - - C:\Temp\i_hczxrpjecz.exe
      C:\Temp\i_hczxrpjecz.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6380
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zwurmkezwr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5216
  - - C:\Temp\zwurmkezwr.exe
      C:\Temp\zwurmkezwr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4816
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4176
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:7068
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zwurmkezwr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3892
  - - C:\Temp\i_zwurmkezwr.exe
      C:\Temp\i_zwurmkezwr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:7024
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mgeywrojhb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6956
  - - C:\Temp\mgeywrojhb.exe
      C:\Temp\mgeywrojhb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2432
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4632
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3376
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mgeywrojhb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5536
  - - C:\Temp\i_mgeywrojhb.exe
      C:\Temp\i_mgeywrojhb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3616
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ywqolgbywq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1504
  - - C:\Temp\ywqolgbywq.exe
      C:\Temp\ywqolgbywq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:464
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6000
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2120
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ywqolgbywq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3720
  - - C:\Temp\i_ywqolgbywq.exe
      C:\Temp\i_ywqolgbywq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3596
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nljdbvtnlj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5152
  - - C:\Temp\nljdbvtnlj.exe
      C:\Temp\nljdbvtnlj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3420
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4592
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6604
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nljdbvtnlj.exe ups_ins
    3⤵
    PID:1968
  - - C:\Temp\i_nljdbvtnlj.exe
      C:\Temp\i_nljdbvtnlj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6900
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fdyvqlidav.exe ups_run
    3⤵
    PID:5864
  - - C:\Temp\fdyvqlidav.exe
      C:\Temp\fdyvqlidav.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6712
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1100
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4276
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fdyvqlidav.exe ups_ins
    3⤵
    PID:976
  - - C:\Temp\i_fdyvqlidav.exe
      C:\Temp\i_fdyvqlidav.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4892
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pnhfdxsqnh.exe ups_run
    3⤵
    PID:5360
  - - C:\Temp\pnhfdxsqnh.exe
      C:\Temp\pnhfdxsqnh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6732
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4536
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2300
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pnhfdxsqnh.exe ups_ins
    3⤵
    PID:4468
  - - C:\Temp\i_pnhfdxsqnh.exe
      C:\Temp\i_pnhfdxsqnh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5448
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fzxrpkhcau.exe ups_run
    3⤵
    PID:6400
  - - C:\Temp\fzxrpkhcau.exe
      C:\Temp\fzxrpkhcau.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4752
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5800
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2036
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fzxrpkhcau.exe ups_ins
    3⤵
    PID:4092
  - - C:\Temp\i_fzxrpkhcau.exe
      C:\Temp\i_fzxrpkhcau.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:7004
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hczxrpnhfz.exe ups_run
    3⤵
    PID:2784
  - - C:\Temp\hczxrpnhfz.exe
      C:\Temp\hczxrpnhfz.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2780
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4196
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3900
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hczxrpnhfz.exe ups_ins
    3⤵
    PID:4192
  - - C:\Temp\i_hczxrpnhfz.exe
      C:\Temp\i_hczxrpnhfz.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4860
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\czurmkezxr.exe ups_run
    3⤵
    PID:4588
  - - C:\Temp\czurmkezxr.exe
      C:\Temp\czurmkezxr.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6508
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2852
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3816
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_czurmkezxr.exe ups_ins
    3⤵
    PID:2788
  - - C:\Temp\i_czurmkezxr.exe
      C:\Temp\i_czurmkezxr.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2792
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rpjhbztrom.exe ups_run
    3⤵
    PID:4616
  - - C:\Temp\rpjhbztrom.exe
      C:\Temp\rpjhbztrom.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1292
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4064
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5184
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rpjhbztrom.exe ups_ins
    3⤵
    PID:4548
  - - C:\Temp\i_rpjhbztrom.exe
      C:\Temp\i_rpjhbztrom.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5992
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qoigbywqoj.exe ups_run
    3⤵
    PID:3808
  - - C:\Temp\qoigbywqoj.exe
      C:\Temp\qoigbywqoj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3792
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4492
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6176
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qoigbywqoj.exe ups_ins
    3⤵
    PID:4180
  - - C:\Temp\i_qoigbywqoj.exe
      C:\Temp\i_qoigbywqoj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6320
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ytrljdbvto.exe ups_run
    3⤵
    PID:6388
  - - C:\Temp\ytrljdbvto.exe
      C:\Temp\ytrljdbvto.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5404
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1472
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:7052
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ytrljdbvto.exe ups_ins
    3⤵
    PID:4796
  - - C:\Temp\i_ytrljdbvto.exe
      C:\Temp\i_ytrljdbvto.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5704
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x304,0x7ffe2057c188,0x7ffe2057c194,0x7ffe2057c1a0
      4⤵
      PID:4764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2060,i,17172433711246141728,10583869646351211817,524288 --field-trial-handle=2440,i,17297986987600063946,3000235561595964966,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:11
      4⤵
      System Time Discovery
      PID:2656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1732,i,5240086743853651298,11188489828599826288,262144 --field-trial-handle=2440,i,17297986987600063946,3000235561595964966,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:2
      4⤵
      PID:6916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2464,i,12051575843968044638,6961171234221210398,524288 --field-trial-handle=2440,i,17297986987600063946,3000235561595964966,262144 --variations-seed-version --mojo-platform-channel-handle=2684 /prefetch:13
      4⤵
      PID:6596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,3653312388110379099,3609305848460688855,2097152 --field-trial-handle=2440,i,17297986987600063946,3000235561595964966,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
      4⤵
      PID:4804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,17818836148798529590,2792250456202698013,2097152 --field-trial-handle=2440,i,17297986987600063946,3000235561595964966,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
      4⤵
      PID:6780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,17687975413596999628,10661002501685184400,524288 --field-trial-handle=2440,i,17297986987600063946,3000235561595964966,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:14
      4⤵
      PID:7036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4656,i,14718660950446185305,5964979105057017392,524288 --field-trial-handle=2440,i,17297986987600063946,3000235561595964966,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:14
      4⤵
      PID:6848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,15799674999513958509,330896602887686193,524288 --field-trial-handle=2440,i,17297986987600063946,3000235561595964966,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:14
      4⤵
      PID:2672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,15799674999513958509,330896602887686193,524288 --field-trial-handle=2440,i,17297986987600063946,3000235561595964966,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:14
      4⤵
      PID:236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4988,i,4071378473944641665,15214405594076780998,524288 --field-trial-handle=2440,i,17297986987600063946,3000235561595964966,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
      4⤵
      PID:4064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,8895868209161744250,17623460995548037792,524288 --field-trial-handle=2440,i,17297986987600063946,3000235561595964966,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:14
      4⤵
      PID:2732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,1113770063092470880,7797041679504548162,524288 --field-trial-handle=2440,i,17297986987600063946,3000235561595964966,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:14
      4⤵
      PID:5260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,18103575498653424337,15562309549853038737,524288 --field-trial-handle=2440,i,17297986987600063946,3000235561595964966,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:14
      4⤵
      PID:6976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,10076286725537719440,16927695408028021367,524288 --field-trial-handle=2440,i,17297986987600063946,3000235561595964966,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:14
      4⤵
      PID:4424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,15136139833332463977,7306805174016057367,524288 --field-trial-handle=2440,i,17297986987600063946,3000235561595964966,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:14
      4⤵
      PID:2224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5652,i,10957220568761950382,10525525203634857866,524288 --field-trial-handle=2440,i,17297986987600063946,3000235561595964966,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:14
      4⤵
      PID:6088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2392,i,13130303289736832858,10566793692324287003,262144 --field-trial-handle=2440,i,17297986987600063946,3000235561595964966,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:10
      4⤵
      PID:3356

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:904

C:\Temp\gbzwrojhtrojgbzt.sys
C:\Temp\gbzwrojhtrojgbzt.sys
1⤵
- Executes dropped EXE
PID:6712

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:876

C:\Temp\geywtolgey.sys
C:\Temp\geywtolgey.sys
1⤵
- Executes dropped EXE
PID:4856

C:\Temp\igaywqoiga.sys
C:\Temp\igaywqoiga.sys
1⤵
- Executes dropped EXE
PID:3276

C:\Temp\vpnifaysqk.sys
C:\Temp\vpnifaysqk.sys
1⤵
- Executes dropped EXE
PID:2864

C:\Temp\fcaysqkica.sys
C:\Temp\fcaysqkica.sys
1⤵
- Executes dropped EXE
PID:6488

C:\Temp\khfzxspkif.sys
C:\Temp\khfzxspkif.sys
1⤵
- Executes dropped EXE
PID:600

C:\Temp\fzxrpmkecz.sys
C:\Temp\fzxrpmkecz.sys
1⤵
- Executes dropped EXE
PID:6072

C:\Temp\cztrmjecwu.sys
C:\Temp\cztrmjecwu.sys
1⤵
- Executes dropped EXE
PID:3216

C:\Temp\omjdbwtroj.sys
C:\Temp\omjdbwtroj.sys
1⤵
- Executes dropped EXE
PID:2452

C:\Temp\mgeywqojgb.sys
C:\Temp\mgeywqojgb.sys
1⤵
- Executes dropped EXE
PID:5584

C:\Temp\tqoigbywqo.sys
C:\Temp\tqoigbywqo.sys
1⤵
- Executes dropped EXE
PID:4064

C:\Temp\fdxvqnigay.sys
C:\Temp\fdxvqnigay.sys
1⤵
PID:1012

C:\Temp\vpnkfdxvpn.sys
C:\Temp\vpnkfdxvpn.sys
1⤵
PID:1472

C:\Temp\xspnifaxsq.sys
C:\Temp\xspnifaxsq.sys
1⤵
PID:5668

C:\Temp\cxusmkhfzx.sys
C:\Temp\cxusmkhfzx.sys
1⤵
PID:5392

C:\Temp\ezxrpjhbzu.sys
C:\Temp\ezxrpjhbzu.sys
1⤵
PID:5688

C:\Temp\uomgezwuom.sys
C:\Temp\uomgezwuom.sys
1⤵
PID:4424

C:\Temp\ywurljebwu.sys
C:\Temp\ywurljebwu.sys
1⤵
PID:1280

C:\Temp\wqoigebztq.sys
C:\Temp\wqoigebztq.sys
1⤵
PID:1864

C:\Temp\vtqligaysq.sys
C:\Temp\vtqligaysq.sys
1⤵
PID:6244

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

axspkicavs.exe

Path C:\Temp\axspkicavs.exe
Size 376KB
SHA256 1c11078bc78787b81c6ec2f3e9f4ddf8c964091b28120d3ca0e77f545bf87a09
MD5 1f5f7a0d61f27472b4d8968a3aff9280
SHA1 e574af6665826b2bde3e55b6f7773604cee342c9
SHA512 3b8dc4d965509e612513289f842ff978c897ccee82c22ceb131753c2f1dbc7cf892836ccc001462236cc7b80123f4e8020abf715fcc40856667bbb486d53ae39
SSDEEP 3072:WViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:WViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T13C847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bytjdbytql.exe

Path C:\Temp\bytjdbytql.exe
Size 376KB
SHA256 a87731a1cd33dcaf8673726cb1fb4fdabdfe05023f15ef784047e5bcb747bb06
MD5 fd7c88baed43770ad6b4cb5b4e6a6ef7
SHA1 2c81b1e2b58298a6e524946dfeb95f3177f56abd
SHA512 a2f99ea360daecddd96eefa49316ec6c1a7ef429525abcdd93f970202c0e7605f9d248d8a45565a85ca0d15d2a20a58a9ab526f2cde152fd82c659e401bef0e1
SSDEEP 3072:AViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:AViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T16B847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fcaysqkica.sys

Path C:\Temp\fcaysqkica.sys
Size 293KB
SHA256 bfab38fb7d1772676034aa287cef521f79e6496f9ab2adfa424a0d31004c100f
MD5 ab1aef4791947aab6bad43313ca65c40
SHA1 62c7cf395bdac5f5d0a9b5e850a46f92b0ca4187
SHA512 6c8c0126c6cc1237748ae2527f945a1465d0f6b76c868324177a52de8081b24023d87d90a29b604d1a9f642c2a96fe5b2b4cc3485f51953709ce9ae8bdab5fb2
SSDEEP 3072:DtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:DIJjiJcbI03GBc3ucY5DCSj
TLSH
T1C7545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fzxrpmkecz.sys

Path C:\Temp\fzxrpmkecz.sys
Size 293KB
SHA256 f79cbfa2a99ab73b732dcb2fb88b7fdd9205355015aac4e1e8d55bdcc4f07bcc
MD5 6bf8808ecc9291230ceec465a10e888c
SHA1 324195542bf7c9f4cb0ad4ca3df6b0e0f6459e50
SHA512 0b7d253c47e225073f846f4fc6bfe419dd41a3cb6ed26e0e824b9fea3940ce6f02da6320c9b481bb56239aa0b1ff72502aace1fdcdfd8dd6245136958196b81f
SSDEEP 3072:+tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:+IJjiJcbI03GBc3ucY5DCSj
TLSH
T123545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbzwrojhtrojgbzt.exe

Path C:\Temp\gbzwrojhtrojgbzt.exe
Size 376KB
SHA256 54c01f68309a9a7f5f2787b41f8111d37723cadb64f42fa875b6bb89d67a2c3f
MD5 67d92e63428368e398aa4849376e646d
SHA1 42e6b695290b9be01e4b01db5aa10f626e378288
SHA512 69151ea5065358cf0de8a8b23f261cdeb0c723c8bd716c09c81036dcdb077685a945749f929da9b54029bc3ddd7b99670194728e22a94498c8efd12aa7297ab1
SSDEEP 3072:gViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:gViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T160847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbzwrojhtrojgbzt.sys

Path C:\Temp\gbzwrojhtrojgbzt.sys
Size 293KB
SHA256 fa3f9239d6ff942f41f45038daf99343abd34ea2b6754180a4f43961e808a813
MD5 ba65c66ab3cf6da782660e050f6696f1
SHA1 4584a49613cf150d56c9e4484ff5e1ed01d83964
SHA512 8bed96ffbe96f6bef1fcd295fae3d81425f4b38c8d8647e84760743eda1dcba4a59052feba1666d5a7967f8f934b8b95fd40ef9d2708f7ba6f4101acbee25dc9
SSDEEP 3072:itKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:iIJjiJcbI03GBc3ucY5DCSj
TLSH
T17C545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gdyvqnliga.exe

Path C:\Temp\gdyvqnliga.exe
Size 376KB
SHA256 917a0cb324c60be8e9de7ed2f076981177dbe3f80b08c1cb7131962dc77aaa35
MD5 bf1d43b7a0309489aa3c2cb8e453e475
SHA1 7f275ff7eba6ad451dce63f228857978ac61f221
SHA512 8c056c847b53b99271b38397d8770cf12c8993a060bfed3e6e7d04ba86eedeb43139f92f1ff8ac71a9cb555095aa24b49bdb68d50fe755c72f9213a1ffefe5df
SSDEEP 3072:hViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:hViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T183847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geywtolgey.sys

Path C:\Temp\geywtolgey.sys
Size 293KB
SHA256 bf2cb85e8beef5d584e43bc4c6e5e8c6fa16c07d9286af00c50c5194b279338e
MD5 26a4a9d4fa5ef31a2c6f59b0e4cca204
SHA1 1a4c3d9013c501ead6b682d6d1b08231b4e72a55
SHA512 2e8b5be7e06b5633996cb8ba8d282e24da4e1912dabcefeb5b5d8f8e0d540eae718bf37ec539dffb80c8e32b97b6fe330386ce25e89689d2cc1eaff058057d9c
SSDEEP 3072:9tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:9IJjiJcbI03GBc3ucY5DCSj
TLSH
T1D4545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hczxrpjecz.exe

Path C:\Temp\hczxrpjecz.exe
Size 376KB
SHA256 0b47b39bf9ab598e10ad0068e04a3c5758fe0bc4fbdc035c0a74417bc746405c
MD5 de0c97a7295787116627e8d1d442d827
SHA1 2173bc5e738c0c3f42268037795e52091ed78cca
SHA512 d1fc73be38475bdbedb35643c4e232bdbe1bfff0f3a8374ee1d88e0d73d6884043790fcb9a8f7316476ad50e9bfa8a0af140103f260e955ca2c426503a494450
SSDEEP 3072:lViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:lViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T100847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_axspkicavs.exe

Path C:\Temp\i_axspkicavs.exe
Size 376KB
SHA256 8a87e967d2eea5d223f8d6e1393ba55a5322bfe999f47f135b94c6ac54fbcef6
MD5 ff85b445f1c0d07001e256f343454c9c
SHA1 da794e9605604e62e31673044974dfb1fd999605
SHA512 8a73530e9a435991b5dc85a21dde854b1d1a571251cbed6f8e5cb3308603301c05e930eb6fd0e7797c0277254c5a0ae197ea145faabf9f817a532676497b0f7b
SSDEEP 3072:bViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:bViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T115847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bytjdbytql.exe

Path C:\Temp\i_bytjdbytql.exe
Size 376KB
SHA256 8db348b58998ca97868514a5aced297c5973f1225fc84a377dd5ac629bd0dccc
MD5 6c8e11add7b906c8fb42e787207ec189
SHA1 b1bff60543d0a01bac063f3cf713d732912f57cb
SHA512 05f278d4e2c6f1d771f7de883d68cb5d450ad94ee223ce6965760f841a77cf889fd1f67efc1896d6016adfe5862d08aefe3006a26071e660776af7f7759d0953
SSDEEP 3072:7ViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:7ViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T130847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gdyvqnliga.exe

Path C:\Temp\i_gdyvqnliga.exe
Size 376KB
SHA256 6e16ab6347af90e811f2cb98062de38f926a88401b5ea566bfc6bb8ffab68207
MD5 abbc0d5f5ccf4caa2d9719f1e71f220f
SHA1 f48db39a797a25b68e5dc2c8275dc742be757827
SHA512 80027e4651b069d4a70069d8502c404fb5f05b823e75a306513cfbfa72f6ee91deb57f512f65b77c19b2d77e28e88387132373b079bcd412e36edc461a56cd10
SSDEEP 3072:OViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:OViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F6847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vqnigaytnk.exe

Path C:\Temp\i_vqnigaytnk.exe
Size 376KB
SHA256 58a9ff32179dffc472f1a2d865270f4992d90ae4a40e48f8b38c5b3108050cc8
MD5 1b9809b076fec9f04c0a9ed7c096f5e2
SHA1 05ce6c06cef73127f1611dcc1cad964e17f12a00
SHA512 fb0c7d664484445b56765e3746c9250edb54702a93ad85477de8b0a0f2b29948807b0e07dc62512b2357d0e04d8f10b976b4018c281364605e14da8caac5a2b2
SSDEEP 3072:vViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:vViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1EF847C04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ztrljdbwuo.exe

Path C:\Temp\i_ztrljdbwuo.exe
Size 376KB
SHA256 2ba72cd5cdc39d882b35105b37ffb06c597e5ea7ca784b4936204551aa00d6ee
MD5 d0fad5847596caf49a3836a1618811d8
SHA1 c1c5dc0901ff61749ccc7a50db705182f424db8f
SHA512 61945614cf238282dd65ac24df996c4140a8df92a337391d902a80c287f51f67e24a9e339464f35fce20ecd7a3ca7bae973adde52742b30799889dc4e7db2d19
SSDEEP 3072:ZViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:ZViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T110847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zxrmkecwup.exe

Path C:\Temp\i_zxrmkecwup.exe
Size 376KB
SHA256 1acb9d1e4c2d6d0d14acec147bb687a6b1de816b538a4a56ff6b61edf714ee6b
MD5 3bb0dfe0f1d4dfad49d94fe108547347
SHA1 889c22d115a08067ace9b140079f8c0eabb43ef9
SHA512 65919609657cd9acb53494eab086ef02db6a19280dba408837a4bd56f7eec59a1e472aa9b55f68923124a9521261b9f511688708ca10f0f0719209bd5e1dd00b
SSDEEP 3072:bViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:bViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T11C847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igaywqoiga.sys

Path C:\Temp\igaywqoiga.sys
Size 293KB
SHA256 47ee6494dcc48660889e9ca982f140ab703ec987e244e8c0b41deca6a3bb4b2d
MD5 aac43f0ef7aac9bf39ea753daf0ff219
SHA1 080fdd0e75f037ebb864a231d288af64a110c76d
SHA512 e7327c6d25828a97c50adce5300b923823b1ed5e4377e860aa9ea95838712577967f30e4c303a6ad4d55ae4d1880523f52746ebf13f1ed85378432f7c4833cc9
SSDEEP 3072:FtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:FIJjiJcbI03GBc3ucY5DCSj
TLSH
T1B7545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

khfzxspkif.sys

Path C:\Temp\khfzxspkif.sys
Size 293KB
SHA256 825ad259aa25bcd580e4c5171bd87e775dec7fbc055ccb885f9ebf2d58635faa
MD5 89dc681732f6fcd66fb276c892222746
SHA1 ae03cda0b0c808c98b2cf4f1cf09693f24c2d81e
SHA512 03d86228ada7dc18c9448cf0ea29268de3059a0a557a043e4947373336f26b50eecb760930bc7b47a71a13568050603b6e7754a8379d9153665d25718d834ac4
SSDEEP 3072:6tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:6IJjiJcbI03GBc3ucY5DCSj
TLSH
T1E3545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vpnifaysqk.sys

Path C:\Temp\vpnifaysqk.sys
Size 293KB
SHA256 6d3e3b19e461e9eb7cef8de360770a10d3fda54fef120f94d0beb25e8d71734b
MD5 b971200bed561ca71217a8930d69e4df
SHA1 dc8442a41b1e51a90d0d4f1724002ad2f4339d0c
SHA512 03b6d69d64d1f1e625d1b013c1a8fe26d5d753b6169e4bbdd7664374eac1ef9abe8d2ae7f750f18c63ebb50830a09b5825d72b106aef50f5bf5750e1feac1a79
SSDEEP 3072:4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:4IJjiJcbI03GBc3ucY5DCSj
TLSH
T1AD545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vqnigaytnk.exe

Path C:\Temp\vqnigaytnk.exe
Size 376KB
SHA256 e1f8f224d1374eb29909eb1b0c6061f219c63daa4b4958fa67a3af8ce0834a45
MD5 4a4731372b060772763ba4f2151cc1a0
SHA1 577b8b4f3318da8788a2bd01e5a02b0b5137a918
SHA512 593f4a298e30db77bbde5f739bff125746a687de56c5e3652c9bdbffcca96978b8ad56aa2cc67f36f5dab98e445cea59d4d8e6e9f69abb20cbea18aa6d27e03a
SSDEEP 3072:CViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:CViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T146847C04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ztrljdbwuo.exe

Path C:\Temp\ztrljdbwuo.exe
Size 376KB
SHA256 7b631fabad3c90154104be895b65c58fffb7a8811fc55dbbc5d5e87b0e2f8730
MD5 428d2f06c3c9a7a44039ee38e8091bfd
SHA1 979ba57a7592614ead32f710b9d9fd8601018f71
SHA512 297cd777788810c6e1626b9ce54e5de138ec7a109773257f3f81af50ad6a65d2193922c2bf0ed9ea772c83545a6030d119b24d02efb7ca2533cc09e7b407bbf9
SSDEEP 3072:MViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:MViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B1847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxrmkecwup.exe

Path C:\Temp\zxrmkecwup.exe
Size 376KB
SHA256 5e413339f266b42c79d085722f5cd3d03dcab239bf89907133027a05a8548fb9
MD5 60117050276346b3b135e9489ecbc397
SHA1 fac2c7948609b615810bd3bd669e83bea49685b2
SHA512 01b00274d447d52bacd7276a97072459f3586730a970698dacd53ee00219351eb91de58926a8108a6fa525adb137d80a00b81a35091a4a780a2dedcbbda0ef0c
SSDEEP 3072:UViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:UViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T16D847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e9e31f5fb014f6a7439a4e224bdae6d3d8b22db7c287d9c004b0184cc18e6bf8
MD5 00fe8112e1beaff1b09c3e772b0b70e6
SHA1 1d234f4d61d2fe0153bb63a7a246d37e6fc0aabe
SHA512 aaafc34862d38399e66858477aa9d3d624e9e071371fe2961aac0159845c41dbe1ed0ae62f8b9c52f327e4e4a97abdaf614ae741bcfd2627ec55b1d4f6fb6d74
TLSH
T1EAD08071B7286847D9551931D432CB017A57546365BAD1025160410C6C7BDB553CA155
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 7d6b2ec79e617568285b2be672e41d3161bc219ea516d198dc5b2966d803bb57
MD5 ad4bcb9d17149a41ca75360f47d6be2c
SHA1 34d35a630b7f4aa18cbaaa77aea29f7ad08a1761
SHA512 844986e577adca7915c842a037c507745c56ef6837b27ae9f5b0cf680d8df0d26ca1a1487481356d196bfc296d25d4a92302866ae8c05e2371f6d12c6a02d241
TLSH
T187F02DA5C921BC3759FC1B1C70644B47E794135B3B41985F3B3C921C4FB463B4A4A81C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a9858d03e57c44ca6f9031c4880aad1bd0a2f97019fb7e39df8de4c893d8da14
MD5 0f96fed85defe3f4dc97665ec06ca704
SHA1 b6a2f5b541e0f508fbcbdfa25d2a25a3524efa7c
SHA512 a0cb0c5d020c39b2413054222e24691942b4aa8b4b3c52ef822fbdc0d61fa598ed070f1cee97896b6bd5365ae0c56ae4894ec4098583df2f055131e714864e35
TLSH
T190519FF783E4856DC91196F0AA187E2BCE1D0914432C7D5AC9E4AE1BA3E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 ef5e1a9f9abd6571b73dfbd5066831e52c99faf997602eba405528da61c646bd
MD5 d328d574ce75442a0119107a4efc3269
SHA1 d1d47705191a5378202339bc4b5420235a8eedd8
SHA512 4540791d7f21dde064d1c3514540ea1f87d61d20010530cee8ce5d1ae5ec399885f148bf16e88b5c379100183fd23e34fe58acac7d868e375dcf3e7cd74f7988
SSDEEP 384:sxRCl87/fus65XbN/RIgrk/5V/WvisGQTj1:sWa7/fKXRWT/5pWvisGQ9
TLSH
T10272D815AA249D7B8CDBD209FA557F93D3F81163A1905E44AAFC9B0C04E67ED2113C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 7039735b89809220d7960cc5c146ae18799aaaf40b460e3b67b63cfc85ef98b9
MD5 223fab5259e4e43b3c60740d70f1fd94
SHA1 114996924044d9a9a530b79c58d652f883c7889c
SHA512 903be3ccf4286427a8873e7a24155bb9d05a310b142cf080de392b0a536972698247d938cd3953af95e8bd9ae4143ec1b27631ac9ee9283bfb6a8a900f8015e2
SSDEEP 384:sxRClqN7/fus05XDN/RIgrk/5V/Wv2sGQTWv:sW0N7/f4XJWT/5pWv2sGQ0
TLSH
T15F72D816AA249D7B9CDBD209FA957F93D3F8117391905E44AAFC9B0C04E67ED210382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 5f1392bdd089d357c049f2575994e3a01d4c40c33e69c65064565d6cf28a9680
MD5 50fd56fc775f2f2ce2cbb84563880b5e
SHA1 ed2d1981d74af4e7a415e42b8c15eb70be16ada7
SHA512 ca69572500c3692dcc570f702711efd78902d63e98fe43651b3a84d4fbd78e08c43cfae69df81f45f26ae33ec5ecf1c82e2c92c5e55e4a091b099a308f9b9d52
SSDEEP 768:Ob4YZx7pLuL7yTWg1NfwB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhobbDwzrok4O:Ob4YZnE7yTWg1NfwBu1jaKobHwArO
TLSH
T19FE2EC3B280CCB7E4F804ADDEC29BD9B6DA801CF56D8895447FA850C03C6BEB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 4f9bc5b3f76e88864df3c3ee03c36bb2aafaafa4cf95b7bd931265373aaffa6a
MD5 c0ed2b75a1e855f5c83ce5577507e435
SHA1 7d134cc077cbd170004c6fe99a41979982301a23
SHA512 7690f6d6a8ce9202435bb051f1fb295104e7dd5bcd041c599299ce4137c79d65970dee6a6916d3f8d5e3452cfe561c0983e3062787664533d7fecafd15a4db9f
SSDEEP 768:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9VZ6k:yv+RpPYDDRPbIhJ9VZ6k
TLSH
T102B25051713F4280387EB50C81B8D86F86C2B4637119E52F7B9802A65F6BE039DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 d9081a1cd1d1eb9f947744edfc0a081b9e09595edb96b3452f9ac40c6844fc88
MD5 145a0a7c058d4e144201cd8bafb4d67f
SHA1 fcd4044c2a45ebe800ee5df861d6e6953eda883d
SHA512 4e2c5e04ab2ea616c9652aea2ec3cedf49d2e325788b404ea21825859835b01f220a3af0c5f21b7dd633bad7946a7e7c40aa60bec19a30ac689ac973699166c9
SSDEEP 384:nfiFiZcIV8NLN8TUNTUlIRcPvuT8qlEqfbYGO5GMeCZrym4nTKwBODNZOCH30c8F:qFQVQNwgCuvwGO5deCxv4newBKZOI30h
TLSH
T192E2C2F198D789B3E89E4B87673D6D469AFCD163B4884994B7C85D0CCC821BFC70A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 fd09320027f03b2d0d1ebc4d78117b13ce6827b5f504cb17985e38fc6eb5e4f6
MD5 e156b231cb648d6d67df34d14572611e
SHA1 0882793b773cbf56b6c825faf20ee448326cc1e7
SHA512 87393b1600ab7b5295c7b815029c1601362610cfc4b54a5e3a0e4657b15aa71405552446e0ac3408f0dc5c75947182efe44333df02d89c15e95184e571892a1c
SSDEEP 384:nkiF1tNn/s3n9Sn8NgN8TUNTUlIRiPvuTu2REqfbYGO5GMeIL8OObjI9G6w7cd83:/F1j+9SXNwgUuzUGO5deW829MH
TLSH
T1D7C25B36E855CEB7EDE64FD9B74A7A1AEEE05263849C59C8EAC85E0C00C71ED0707C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 ec71395fdfa6330836779c6a7a3ba7560c4de927950fa0a3d4f3f8675f7631a8
MD5 4b386254f0eabafaf1ab8f83bb1692a5
SHA1 15f80f69e6ec7414ac434926efb473d81367415d
SHA512 aeb4381ac57df9c6351cec01e9754bb3ae62fbbef03d4a5385e0f650540232d3fbb85c1b77b64688bc4ff25c5eaf0f9466f488ae3e8850d32f16c21d73888126
SSDEEP 384:nSiFiZcIN8NLN8TUNTUlIRcPvuTKElEqfbYGO5GMeCZrp+4nTKwBODNZOCH30c8F:ZFQNQNwgCuPwGO5deCxI4newBKZOI30h
TLSH
T1F1D26B32DC64CDB7ECEA8FC9B60A7647DEE45163D49899D8EAC95E0C00871DE170BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 b2247292810546ed15a961c18ecb62df1afe1cd45c5dabf8c07a847d71377985
MD5 e221214efd5875439d85bf1d6df0c950
SHA1 58a38c0178b29c1662891e6c7a080439a9cf09f8
SHA512 4bbb62b2037d1d877d61e0004218d55de620045ec2f2bc58ca7b8a6ffea1174c860ee0e0ad3fc8ea3618a834c356f279af01cd81f5aed90e73c51aac5df504f5
SSDEEP 384:nmiFiZcI/8NLN8TUNTUlIRcPvuT8ElEqfbYGO5GMeCZrp+4nTKwBODNZOCH30c8F:NFQ/QNwgCuBwGO5deCxI4newBKZOI30h
TLSH
T197D26B32DC64CDB7ECEA8FC9B60A7647DEE45163D49899D8EAC95E0C00871DE170BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 7abd80a0a7c39ce3629e555f8c69b2efe0b507e9366bb18c473d069750c913d1
MD5 eb0a515ed1ed6bcdcb402e3c4e7ebbf8
SHA1 c1cf530122254b0e7f7be455b5f507dc74d090f7
SHA512 92917b6754dc18420552b889d1010c3945df2fb7d7d56c95e355029b2f5e83fb1b8fc312041734d94fc4365df2e1e6edabe22e7961447f5a3eacdde545a4417e
TLSH
T1B0413EE04C381AC1D4BD0A7E748B38ECC1E8C726F8A034396868EA485A7E25D358483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 0b81069370281c9d9a3d635ce203ad9c2285abf1a114f28e55f00cb7284bda1b
MD5 ccb63e32e0a499ad16963b8ba801dd6f
SHA1 ee17f2295c5625cafc269189278ec491934186aa
SHA512 0f1119f1113865c2a7b3e65819962d9dbc392fc96a0c2207766dbcc42778ac845967c920988ae3545a0d01fcef079381ebfd2f8989136d0bf0b3874fd1e7a153
TLSH
T1E0412EE05C381AC1D4BD0EBF748B39FC85E8C726F49034796898E958597A65D258483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 3d788a59a605ed17c95f085f708aadbdf3662050312a9957d1725de4ed769a31
MD5 7c787dcd8d1442a60633e89535fb1d95
SHA1 afb2516a430e532e24662779c7d22da32506bfa8
SHA512 1937b5f8c0a84b4f4cb597c25ce4e54a783c7a1497deddfee07130a9a99c71a5f5c0b3d9add69c95b1dedfc6058aba8f036a3649042a9b80b4e6a62bca913577
TLSH
T155412DE04C381AC1D4BD0E7FB44B39FC84E8D726F890347D6858EA985A7A65D358483F
MD5 SHA1 SHA512 TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 1e3b396fed332f0586d08d4067cff8cb5c3f9d8da640088053fdc185df74c0f1
MD5 19012cf5d15d5da1b318ef5380ed23bb
SHA1 d8cc98d45d998c06072eeb655c440215e44b385d
SHA512 7c582184a28f1d3215bedf13f6e7bbe795d16138c91c75633986456e3306224dc7d4949ac0d349efc58ca80872ae363d2a7f37b301b9a21dcd7ad23be2a00997
TLSH
T10C71008357A8D9B2C5DA5FF102835604F2BB22780B2330600B91554AAA30A7A24B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/600-236-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1012-327-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1280-402-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1472-332-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1864-414-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2452-282-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2864-209-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2864-224-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3216-278-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3276-189-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4064-310-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4424-379-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4856-154-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5392-363-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5584-286-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5668-343-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5688-367-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6072-272-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6244-418-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6488-222-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6712-61-0x0000000000010000-0x00000000000AB000-memory.dmp

Download