systex | 5de1138f41d69b293bf555025865bb7454bf0f22c421361107d71a1125a71698

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 22:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_513300e155644abb501772ad382f90e0_amadey_darkgate_elex_smoke-loader_stop.exe
Size 384KB
Sample260813-2qctwszerb
SHA256 5de1138f41d69b293bf555025865bb7454bf0f22c421361107d71a1125a71698
MD5 513300e155644abb501772ad382f90e0
SHA1 ec98fbbc51d2a1d2d6140ed2db3a3b081488d4a4
SHA512 553c65de9ffa49819cc89e03508b687b30319c00c3f8fd27672afa9966bcce5790a92f5e870ba8d92ec60b14f853d08dcba7f8597b0a406f5d96915c809b82a8
SSDEEP 3072:H9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:dctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F2846A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
4492	czusmkecwupmhfzx.exe
5052	czusmkecwupmhfzx.sys
888	CreateProcess.exe
3112	eczuomhecw.exe
4868	CreateProcess.exe
1356	CreateProcess.exe
1572	i_eczuomhecw.exe
1808	pjhbzurmje.sys
1732	CreateProcess.exe
4540	geywuomgec.exe
3260	CreateProcess.exe
2460	CreateProcess.exe
3440	i_geywuomgec.exe
5476	trljdbztqo.sys
1220	CreateProcess.exe
2124	qolgeywqoj.exe
5036	CreateProcess.exe
5408	CreateProcess.exe
4160	i_qolgeywqoj.exe
4324	wtrljdbwlg.sys
5332	CreateProcess.exe
5360	qljdbvtolg.exe
3820	CreateProcess.exe
5324	CreateProcess.exe
4760	i_qljdbvtolg.exe
4676	oigdyvqoig.sys
3140	CreateProcess.exe
3848	igaysqlyvq.exe
1996	CreateProcess.exe
5612	CreateProcess.exe
3084	i_igaysqlyvq.exe
4320	axvtnlfdxv.sys
2672	CreateProcess.exe
1744	caxvqnifav.exe
4168	CreateProcess.exe
5648	CreateProcess.exe
3320	i_caxvqnifav.exe
4964	xspkifaxsq.sys
2796	CreateProcess.exe
4104	xvpnhfdxus.exe
3528	CreateProcess.exe
5024	CreateProcess.exe
1980	i_xvpnhfdxus.exe
2504	hfzxvpnkic.sys
2324	CreateProcess.exe
5196	fcausmkecw.exe
5824	CreateProcess.exe
3328	CreateProcess.exe
2652	i_fcausmkecw.exe
5516	kecxupmhfz.sys
2196	CreateProcess.exe
4848	czxrpmkecw.exe
2100	CreateProcess.exe
848	CreateProcess.exe
5528	i_czxrpmkecw.exe
5972	czurmjhbzt.sys
4284	CreateProcess.exe
3576	zwurmkebzt.exe
2632	CreateProcess.exe
5860	CreateProcess.exe
2720	i_zwurmkebzt.exe
4548	trojgbztro.sys
4476	CreateProcess.exe
1016	urmjebwtom.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2928_1349666645\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2928_1424778575\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2928_1424778575\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2928_1424778575\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2928_1424778575\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2928_1349666645\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2928_1625195312\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2928_1625195312\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2928_1762989076\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urmjebwtom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlidbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcxvsmkfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xukecxuomh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdbytrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_513300e155644abb501772ad382f90e0_amadey_darkgate_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igaysqlyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnhfdxus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqkifausn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czusmkecwupmhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnhfdxus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdbytrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnlidbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xukecxuomh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urpjhbzurp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eczuomhecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qolgeywqoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qljdbvtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fcausmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwurmkebzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqkifausn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljebztro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljebztro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	caxvqnifav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcausmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fcxvsmkfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urpjhbzurp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwurmkebzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urmjebwtom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eczuomhecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywuomgec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qljdbvtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_caxvqnifav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czxrpmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywuomgec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qolgeywqoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igaysqlyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czxrpmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbnlfdysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbnlfdysq.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
412	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2664	ipconfig.exe
5688	ipconfig.exe
4460	ipconfig.exe
5632	ipconfig.exe
6116	ipconfig.exe
1452	ipconfig.exe
5284	ipconfig.exe
960	ipconfig.exe
1400	ipconfig.exe
2036	ipconfig.exe
2984	ipconfig.exe
4460	ipconfig.exe
1744	ipconfig.exe
1772	ipconfig.exe
4792	ipconfig.exe
2472	ipconfig.exe
4408	ipconfig.exe
4092	ipconfig.exe
5700	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134311348202334230"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2246396966-3025826688-3847171515-1000\{75CBC633-099C-41E9-8646-173ED881E2BF}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1416	2026-08-13_513300e155644abb501772ad382f90e0_amadey_darkgate_elex_smoke-loader_stop.exe
1416	2026-08-13_513300e155644abb501772ad382f90e0_amadey_darkgate_elex_smoke-loader_stop.exe
1416	2026-08-13_513300e155644abb501772ad382f90e0_amadey_darkgate_elex_smoke-loader_stop.exe
1416	2026-08-13_513300e155644abb501772ad382f90e0_amadey_darkgate_elex_smoke-loader_stop.exe
1416	2026-08-13_513300e155644abb501772ad382f90e0_amadey_darkgate_elex_smoke-loader_stop.exe
1416	2026-08-13_513300e155644abb501772ad382f90e0_amadey_darkgate_elex_smoke-loader_stop.exe
1416	2026-08-13_513300e155644abb501772ad382f90e0_amadey_darkgate_elex_smoke-loader_stop.exe
1416	2026-08-13_513300e155644abb501772ad382f90e0_amadey_darkgate_elex_smoke-loader_stop.exe
1416	2026-08-13_513300e155644abb501772ad382f90e0_amadey_darkgate_elex_smoke-loader_stop.exe
1416	2026-08-13_513300e155644abb501772ad382f90e0_amadey_darkgate_elex_smoke-loader_stop.exe
1416	2026-08-13_513300e155644abb501772ad382f90e0_amadey_darkgate_elex_smoke-loader_stop.exe
1416	2026-08-13_513300e155644abb501772ad382f90e0_amadey_darkgate_elex_smoke-loader_stop.exe
1416	2026-08-13_513300e155644abb501772ad382f90e0_amadey_darkgate_elex_smoke-loader_stop.exe
1416	2026-08-13_513300e155644abb501772ad382f90e0_amadey_darkgate_elex_smoke-loader_stop.exe
1416	2026-08-13_513300e155644abb501772ad382f90e0_amadey_darkgate_elex_smoke-loader_stop.exe
1416	2026-08-13_513300e155644abb501772ad382f90e0_amadey_darkgate_elex_smoke-loader_stop.exe
1416	2026-08-13_513300e155644abb501772ad382f90e0_amadey_darkgate_elex_smoke-loader_stop.exe
1416	2026-08-13_513300e155644abb501772ad382f90e0_amadey_darkgate_elex_smoke-loader_stop.exe
1416	2026-08-13_513300e155644abb501772ad382f90e0_amadey_darkgate_elex_smoke-loader_stop.exe
1416	2026-08-13_513300e155644abb501772ad382f90e0_amadey_darkgate_elex_smoke-loader_stop.exe
1416	2026-08-13_513300e155644abb501772ad382f90e0_amadey_darkgate_elex_smoke-loader_stop.exe
1416	2026-08-13_513300e155644abb501772ad382f90e0_amadey_darkgate_elex_smoke-loader_stop.exe
1416	2026-08-13_513300e155644abb501772ad382f90e0_amadey_darkgate_elex_smoke-loader_stop.exe
1416	2026-08-13_513300e155644abb501772ad382f90e0_amadey_darkgate_elex_smoke-loader_stop.exe
1416	2026-08-13_513300e155644abb501772ad382f90e0_amadey_darkgate_elex_smoke-loader_stop.exe
1416	2026-08-13_513300e155644abb501772ad382f90e0_amadey_darkgate_elex_smoke-loader_stop.exe
1416	2026-08-13_513300e155644abb501772ad382f90e0_amadey_darkgate_elex_smoke-loader_stop.exe
1416	2026-08-13_513300e155644abb501772ad382f90e0_amadey_darkgate_elex_smoke-loader_stop.exe
1416	2026-08-13_513300e155644abb501772ad382f90e0_amadey_darkgate_elex_smoke-loader_stop.exe
1416	2026-08-13_513300e155644abb501772ad382f90e0_amadey_darkgate_elex_smoke-loader_stop.exe
1416	2026-08-13_513300e155644abb501772ad382f90e0_amadey_darkgate_elex_smoke-loader_stop.exe
1416	2026-08-13_513300e155644abb501772ad382f90e0_amadey_darkgate_elex_smoke-loader_stop.exe
1416	2026-08-13_513300e155644abb501772ad382f90e0_amadey_darkgate_elex_smoke-loader_stop.exe
1416	2026-08-13_513300e155644abb501772ad382f90e0_amadey_darkgate_elex_smoke-loader_stop.exe
1416	2026-08-13_513300e155644abb501772ad382f90e0_amadey_darkgate_elex_smoke-loader_stop.exe
1416	2026-08-13_513300e155644abb501772ad382f90e0_amadey_darkgate_elex_smoke-loader_stop.exe
1416	2026-08-13_513300e155644abb501772ad382f90e0_amadey_darkgate_elex_smoke-loader_stop.exe
1416	2026-08-13_513300e155644abb501772ad382f90e0_amadey_darkgate_elex_smoke-loader_stop.exe
1416	2026-08-13_513300e155644abb501772ad382f90e0_amadey_darkgate_elex_smoke-loader_stop.exe
1416	2026-08-13_513300e155644abb501772ad382f90e0_amadey_darkgate_elex_smoke-loader_stop.exe
1416	2026-08-13_513300e155644abb501772ad382f90e0_amadey_darkgate_elex_smoke-loader_stop.exe
1416	2026-08-13_513300e155644abb501772ad382f90e0_amadey_darkgate_elex_smoke-loader_stop.exe
1416	2026-08-13_513300e155644abb501772ad382f90e0_amadey_darkgate_elex_smoke-loader_stop.exe
1416	2026-08-13_513300e155644abb501772ad382f90e0_amadey_darkgate_elex_smoke-loader_stop.exe
1416	2026-08-13_513300e155644abb501772ad382f90e0_amadey_darkgate_elex_smoke-loader_stop.exe
1416	2026-08-13_513300e155644abb501772ad382f90e0_amadey_darkgate_elex_smoke-loader_stop.exe
1416	2026-08-13_513300e155644abb501772ad382f90e0_amadey_darkgate_elex_smoke-loader_stop.exe
1416	2026-08-13_513300e155644abb501772ad382f90e0_amadey_darkgate_elex_smoke-loader_stop.exe
1416	2026-08-13_513300e155644abb501772ad382f90e0_amadey_darkgate_elex_smoke-loader_stop.exe
1416	2026-08-13_513300e155644abb501772ad382f90e0_amadey_darkgate_elex_smoke-loader_stop.exe
1416	2026-08-13_513300e155644abb501772ad382f90e0_amadey_darkgate_elex_smoke-loader_stop.exe
1416	2026-08-13_513300e155644abb501772ad382f90e0_amadey_darkgate_elex_smoke-loader_stop.exe
1416	2026-08-13_513300e155644abb501772ad382f90e0_amadey_darkgate_elex_smoke-loader_stop.exe
1416	2026-08-13_513300e155644abb501772ad382f90e0_amadey_darkgate_elex_smoke-loader_stop.exe
1416	2026-08-13_513300e155644abb501772ad382f90e0_amadey_darkgate_elex_smoke-loader_stop.exe
1416	2026-08-13_513300e155644abb501772ad382f90e0_amadey_darkgate_elex_smoke-loader_stop.exe
4492	czusmkecwupmhfzx.exe
4492	czusmkecwupmhfzx.exe
4492	czusmkecwupmhfzx.exe
4492	czusmkecwupmhfzx.exe
4492	czusmkecwupmhfzx.exe
4492	czusmkecwupmhfzx.exe
4492	czusmkecwupmhfzx.exe
4492	czusmkecwupmhfzx.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe
2928	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	1572	i_eczuomhecw.exe
Token: SeDebugPrivilege	3440	i_geywuomgec.exe
Token: SeDebugPrivilege	4160	i_qolgeywqoj.exe
Token: SeDebugPrivilege	4760	i_qljdbvtolg.exe
Token: SeDebugPrivilege	3084	i_igaysqlyvq.exe
Token: SeDebugPrivilege	3320	i_caxvqnifav.exe
Token: SeDebugPrivilege	1980	i_xvpnhfdxus.exe
Token: SeDebugPrivilege	2652	i_fcausmkecw.exe
Token: SeDebugPrivilege	5528	i_czxrpmkecw.exe
Token: SeDebugPrivilege	2720	i_zwurmkebzt.exe
Token: SeDebugPrivilege	2700	i_urmjebwtom.exe
Token: SeDebugPrivilege	252	i_gdbytrljdb.exe
Token: SeDebugPrivilege	5384	i_jdbnlfdysq.exe
Token: SeDebugPrivilege	3100	i_vtnlidbvtn.exe
Token: SeDebugPrivilege	1604	i_ysqkifausn.exe
Token: SeDebugPrivilege	2496	i_fcxvsmkfcx.exe
Token: SeDebugPrivilege	3016	i_xukecxuomh.exe
Token: SeDebugPrivilege	2984	i_urpjhbzurp.exe
Token: SeDebugPrivilege	2388	i_trljebztro.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2928	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 4492	1416	2026-08-13_513300e155644abb501772ad382f90e0_amadey_darkgate_elex_smoke-loader_stop.exe	89
PID 1416 wrote to memory of 5456	1416	2026-08-13_513300e155644abb501772ad382f90e0_amadey_darkgate_elex_smoke-loader_stop.exe	90
PID 5456 wrote to memory of 2928	5456	iexplore.exe	91
PID 2928 wrote to memory of 2168	2928	msedge.exe	92
PID 2928 wrote to memory of 2648	2928	msedge.exe	93
PID 2928 wrote to memory of 412	2928	msedge.exe	94
PID 2928 wrote to memory of 2648	2928	msedge.exe	93
PID 2928 wrote to memory of 2648	2928	msedge.exe	93
PID 2928 wrote to memory of 1160	2928	msedge.exe	96
PID 2928 wrote to memory of 1160	2928	msedge.exe	96
PID 2928 wrote to memory of 4232	2928	msedge.exe	97
PID 2928 wrote to memory of 4232	2928	msedge.exe	97
PID 2928 wrote to memory of 4232	2928	msedge.exe	97
PID 2928 wrote to memory of 716	2928	msedge.exe	98
PID 2928 wrote to memory of 716	2928	msedge.exe	98
PID 2928 wrote to memory of 716	2928	msedge.exe	98
PID 2928 wrote to memory of 3364	2928	msedge.exe	99
PID 2928 wrote to memory of 1268	2928	msedge.exe	100
PID 2928 wrote to memory of 3364	2928	msedge.exe	99
PID 2928 wrote to memory of 3364	2928	msedge.exe	99
PID 2928 wrote to memory of 1268	2928	msedge.exe	100
PID 2928 wrote to memory of 1268	2928	msedge.exe	100
PID 2928 wrote to memory of 2632	2928	msedge.exe	101
PID 2928 wrote to memory of 2632	2928	msedge.exe	101
PID 2928 wrote to memory of 3452	2928	msedge.exe	106
PID 2928 wrote to memory of 3452	2928	msedge.exe	106
PID 2928 wrote to memory of 2060	2928	msedge.exe	105
PID 2928 wrote to memory of 2060	2928	msedge.exe	105
PID 2928 wrote to memory of 3220	2928	msedge.exe	108
PID 4492 wrote to memory of 888	4492	czusmkecwupmhfzx.exe	109
PID 3112 wrote to memory of 4868	3112	eczuomhecw.exe	114
PID 2928 wrote to memory of 5624	2928	msedge.exe	117
PID 2928 wrote to memory of 5624	2928	msedge.exe	117
PID 2928 wrote to memory of 4132	2928	msedge.exe	118
PID 2928 wrote to memory of 4132	2928	msedge.exe	118
PID 4492 wrote to memory of 1356	4492	czusmkecwupmhfzx.exe	119
PID 4492 wrote to memory of 1732	4492	czusmkecwupmhfzx.exe	123
PID 4540 wrote to memory of 3260	4540	geywuomgec.exe	125
PID 4492 wrote to memory of 2460	4492	czusmkecwupmhfzx.exe	128
PID 4492 wrote to memory of 1220	4492	czusmkecwupmhfzx.exe	132
PID 2124 wrote to memory of 5036	2124	qolgeywqoj.exe	134
PID 4492 wrote to memory of 5408	4492	czusmkecwupmhfzx.exe	137
PID 4492 wrote to memory of 5332	4492	czusmkecwupmhfzx.exe	142
PID 5360 wrote to memory of 3820	5360	qljdbvtolg.exe	144
PID 4492 wrote to memory of 5324	4492	czusmkecwupmhfzx.exe	147
PID 2928 wrote to memory of 2472	2928	msedge.exe	149
PID 2928 wrote to memory of 2388	2928	msedge.exe	150
PID 2928 wrote to memory of 2868	2928	msedge.exe	151
PID 4492 wrote to memory of 3140	4492	czusmkecwupmhfzx.exe	154
PID 3848 wrote to memory of 1996	3848	igaysqlyvq.exe	156
PID 4492 wrote to memory of 5612	4492	czusmkecwupmhfzx.exe	159
PID 4492 wrote to memory of 2672	4492	czusmkecwupmhfzx.exe	163
PID 1744 wrote to memory of 4168	1744	caxvqnifav.exe	165
PID 4492 wrote to memory of 5648	4492	czusmkecwupmhfzx.exe	168
PID 4492 wrote to memory of 2796	4492	czusmkecwupmhfzx.exe	172
PID 4104 wrote to memory of 3528	4104	xvpnhfdxus.exe	174
PID 4492 wrote to memory of 5024	4492	czusmkecwupmhfzx.exe	177
PID 4492 wrote to memory of 2324	4492	czusmkecwupmhfzx.exe	181
PID 5196 wrote to memory of 5824	5196	fcausmkecw.exe	183
PID 4492 wrote to memory of 3328	4492	czusmkecwupmhfzx.exe	186
PID 2928 wrote to memory of 3120	2928	msedge.exe	188
PID 2928 wrote to memory of 3120	2928	msedge.exe	188
PID 4492 wrote to memory of 2196	4492	czusmkecwupmhfzx.exe	194
PID 4848 wrote to memory of 2100	4848	czxrpmkecw.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-08-13_513300e155644abb501772ad382f90e0_amadey_darkgate_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_513300e155644abb501772ad382f90e0_amadey_darkgate_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Temp\czusmkecwupmhfzx.exe
  C:\Temp\czusmkecwupmhfzx.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4492
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\eczuomhecw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:888
  - - C:\Temp\eczuomhecw.exe
      C:\Temp\eczuomhecw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3112
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4868
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1744
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_eczuomhecw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1356
  - - C:\Temp\i_eczuomhecw.exe
      C:\Temp\i_eczuomhecw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1572
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\geywuomgec.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1732
  - - C:\Temp\geywuomgec.exe
      C:\Temp\geywuomgec.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4540
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3260
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2036
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_geywuomgec.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2460
  - - C:\Temp\i_geywuomgec.exe
      C:\Temp\i_geywuomgec.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3440
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qolgeywqoj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1220
  - - C:\Temp\qolgeywqoj.exe
      C:\Temp\qolgeywqoj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2124
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5036
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1452
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qolgeywqoj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5408
  - - C:\Temp\i_qolgeywqoj.exe
      C:\Temp\i_qolgeywqoj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4160
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qljdbvtolg.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5332
  - - C:\Temp\qljdbvtolg.exe
      C:\Temp\qljdbvtolg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5360
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3820
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1772
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qljdbvtolg.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5324
  - - C:\Temp\i_qljdbvtolg.exe
      C:\Temp\i_qljdbvtolg.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4760
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\igaysqlyvq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3140
  - - C:\Temp\igaysqlyvq.exe
      C:\Temp\igaysqlyvq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3848
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1996
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4792
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_igaysqlyvq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5612
  - - C:\Temp\i_igaysqlyvq.exe
      C:\Temp\i_igaysqlyvq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3084
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\caxvqnifav.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2672
  - - C:\Temp\caxvqnifav.exe
      C:\Temp\caxvqnifav.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1744
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4168
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2664
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_caxvqnifav.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5648
  - - C:\Temp\i_caxvqnifav.exe
      C:\Temp\i_caxvqnifav.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3320
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvpnhfdxus.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2796
  - - C:\Temp\xvpnhfdxus.exe
      C:\Temp\xvpnhfdxus.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4104
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3528
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5688
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xvpnhfdxus.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5024
  - - C:\Temp\i_xvpnhfdxus.exe
      C:\Temp\i_xvpnhfdxus.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1980
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fcausmkecw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2324
  - - C:\Temp\fcausmkecw.exe
      C:\Temp\fcausmkecw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5196
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5824
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2472
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fcausmkecw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3328
  - - C:\Temp\i_fcausmkecw.exe
      C:\Temp\i_fcausmkecw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2652
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\czxrpmkecw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2196
  - - C:\Temp\czxrpmkecw.exe
      C:\Temp\czxrpmkecw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4848
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2100
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5284
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_czxrpmkecw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:848
  - - C:\Temp\i_czxrpmkecw.exe
      C:\Temp\i_czxrpmkecw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5528
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zwurmkebzt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4284
  - - C:\Temp\zwurmkebzt.exe
      C:\Temp\zwurmkebzt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3576
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2632
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4408
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zwurmkebzt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5860
  - - C:\Temp\i_zwurmkebzt.exe
      C:\Temp\i_zwurmkebzt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2720
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\urmjebwtom.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4476
  - - C:\Temp\urmjebwtom.exe
      C:\Temp\urmjebwtom.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1016
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:356
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4460
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_urmjebwtom.exe ups_ins
    3⤵
    PID:2708
  - - C:\Temp\i_urmjebwtom.exe
      C:\Temp\i_urmjebwtom.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2700
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gdbytrljdb.exe ups_run
    3⤵
    PID:5916
  - - C:\Temp\gdbytrljdb.exe
      C:\Temp\gdbytrljdb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:932
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2052
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2984
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gdbytrljdb.exe ups_ins
    3⤵
    PID:2836
  - - C:\Temp\i_gdbytrljdb.exe
      C:\Temp\i_gdbytrljdb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:252
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jdbnlfdysq.exe ups_run
    3⤵
    PID:4252
  - - C:\Temp\jdbnlfdysq.exe
      C:\Temp\jdbnlfdysq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4836
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2960
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5632
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jdbnlfdysq.exe ups_ins
    3⤵
    PID:4224
  - - C:\Temp\i_jdbnlfdysq.exe
      C:\Temp\i_jdbnlfdysq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5384
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtnlidbvtn.exe ups_run
    3⤵
    PID:948
  - - C:\Temp\vtnlidbvtn.exe
      C:\Temp\vtnlidbvtn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2160
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4756
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:960
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtnlidbvtn.exe ups_ins
    3⤵
    PID:5476
  - - C:\Temp\i_vtnlidbvtn.exe
      C:\Temp\i_vtnlidbvtn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3100
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ysqkifausn.exe ups_run
    3⤵
    PID:2112
  - - C:\Temp\ysqkifausn.exe
      C:\Temp\ysqkifausn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4888
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4420
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4092
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ysqkifausn.exe ups_ins
    3⤵
    PID:1708
  - - C:\Temp\i_ysqkifausn.exe
      C:\Temp\i_ysqkifausn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1604
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fcxvsmkfcx.exe ups_run
    3⤵
    PID:5500
  - - C:\Temp\fcxvsmkfcx.exe
      C:\Temp\fcxvsmkfcx.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:560
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:636
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5700
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fcxvsmkfcx.exe ups_ins
    3⤵
    PID:4796
  - - C:\Temp\i_fcxvsmkfcx.exe
      C:\Temp\i_fcxvsmkfcx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2496
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xukecxuomh.exe ups_run
    3⤵
    PID:6080
  - - C:\Temp\xukecxuomh.exe
      C:\Temp\xukecxuomh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3476
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5660
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4460
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xukecxuomh.exe ups_ins
    3⤵
    PID:4468
  - - C:\Temp\i_xukecxuomh.exe
      C:\Temp\i_xukecxuomh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3016
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\urpjhbzurp.exe ups_run
    3⤵
    PID:3240
  - - C:\Temp\urpjhbzurp.exe
      C:\Temp\urpjhbzurp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4996
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2688
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1400
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_urpjhbzurp.exe ups_ins
    3⤵
    PID:4356
  - - C:\Temp\i_urpjhbzurp.exe
      C:\Temp\i_urpjhbzurp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2984
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\trljebztro.exe ups_run
    3⤵
    PID:4964
  - - C:\Temp\trljebztro.exe
      C:\Temp\trljebztro.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5084
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1604
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6116
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_trljebztro.exe ups_ins
    3⤵
    PID:6140
  - - C:\Temp\i_trljebztro.exe
      C:\Temp\i_trljebztro.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2388
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffcd35ac188,0x7ffcd35ac194,0x7ffcd35ac1a0
      4⤵
      PID:2168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,14698777821914894110,3736438197118521811,262144 --field-trial-handle=2284,i,4192264339056307311,8838820977659924358,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
      4⤵
      PID:2648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,4175319108874253434,1185558098892661497,524288 --field-trial-handle=2284,i,4192264339056307311,8838820977659924358,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:11
      4⤵
      System Time Discovery
      PID:412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2544,i,7528298773745541244,4450508542718633373,524288 --field-trial-handle=2284,i,4192264339056307311,8838820977659924358,262144 --variations-seed-version --mojo-platform-channel-handle=3152 /prefetch:13
      4⤵
      PID:1160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3592,i,17442296701574662013,1444790336412441748,2097152 --field-trial-handle=2284,i,4192264339056307311,8838820977659924358,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
      4⤵
      PID:4232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3596,i,7029929056540207068,708013417216058921,2097152 --field-trial-handle=2284,i,4192264339056307311,8838820977659924358,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
      4⤵
      PID:716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4280,i,17431199925513994372,17533511191129657842,2097152 --field-trial-handle=2284,i,4192264339056307311,8838820977659924358,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:1
      4⤵
      PID:3364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,8191773259018671615,17375429351167345288,2097152 --field-trial-handle=2284,i,4192264339056307311,8838820977659924358,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:9
      4⤵
      PID:1268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3740,i,1101659986123804946,16287069068311021082,524288 --field-trial-handle=2284,i,4192264339056307311,8838820977659924358,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:14
      4⤵
      PID:2632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3760,i,4969676300016331742,15968760696627040148,524288 --field-trial-handle=2284,i,4192264339056307311,8838820977659924358,262144 --variations-seed-version --mojo-platform-channel-handle=1640 /prefetch:14
      4⤵
      PID:2060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,6716985420177551394,3612104988691954625,524288 --field-trial-handle=2284,i,4192264339056307311,8838820977659924358,262144 --variations-seed-version --mojo-platform-channel-handle=3808 /prefetch:14
      4⤵
      PID:3452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,7340967180822998819,4964490528662865352,524288 --field-trial-handle=2284,i,4192264339056307311,8838820977659924358,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:14
      4⤵
      PID:4352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,7340967180822998819,4964490528662865352,524288 --field-trial-handle=2284,i,4192264339056307311,8838820977659924358,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:14
      4⤵
      PID:3220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,17052737081701738145,11122620570989737783,524288 --field-trial-handle=2284,i,4192264339056307311,8838820977659924358,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:14
      4⤵
      PID:5624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6416,i,18004447468676337976,13924443736881216908,524288 --field-trial-handle=2284,i,4192264339056307311,8838820977659924358,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:14
      4⤵
      PID:4132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,5482123302142102734,6930190728715540263,524288 --field-trial-handle=2284,i,4192264339056307311,8838820977659924358,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:14
      4⤵
      PID:2472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,16221554704213775625,4997637705844834061,524288 --field-trial-handle=2284,i,4192264339056307311,8838820977659924358,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:14
      4⤵
      PID:2388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,8791970610079670590,1922979760228156766,524288 --field-trial-handle=2284,i,4192264339056307311,8838820977659924358,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:14
      4⤵
      PID:2868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,8304172797543522757,9242342349520519102,524288 --field-trial-handle=2284,i,4192264339056307311,8838820977659924358,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:14
      4⤵
      PID:3120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,5423494469838115585,18104856219617848981,524288 --field-trial-handle=2284,i,4192264339056307311,8838820977659924358,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:14
      4⤵
      PID:2852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5548,i,7825634065930282011,7228654106935261096,524288 --field-trial-handle=2284,i,4192264339056307311,8838820977659924358,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
      4⤵
      PID:1176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,13142920796511190876,4596172543762387820,524288 --field-trial-handle=2284,i,4192264339056307311,8838820977659924358,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:14
      4⤵
      PID:1176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5480,i,8648606599526823696,1129516316663870029,262144 --field-trial-handle=2284,i,4192264339056307311,8838820977659924358,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:10
      4⤵
      PID:3756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,6436638661891461833,16642039678481344814,524288 --field-trial-handle=2284,i,4192264339056307311,8838820977659924358,262144 --variations-seed-version --mojo-platform-channel-handle=3888 /prefetch:14
      4⤵
      PID:248

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1212

C:\Temp\czusmkecwupmhfzx.sys
C:\Temp\czusmkecwupmhfzx.sys
1⤵
- Executes dropped EXE
PID:5052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5756

C:\Temp\pjhbzurmje.sys
C:\Temp\pjhbzurmje.sys
1⤵
- Executes dropped EXE
PID:1808

C:\Temp\trljdbztqo.sys
C:\Temp\trljdbztqo.sys
1⤵
- Executes dropped EXE
PID:5476

C:\Temp\wtrljdbwlg.sys
C:\Temp\wtrljdbwlg.sys
1⤵
- Executes dropped EXE
PID:4324

C:\Temp\oigdyvqoig.sys
C:\Temp\oigdyvqoig.sys
1⤵
- Executes dropped EXE
PID:4676

C:\Temp\axvtnlfdxv.sys
C:\Temp\axvtnlfdxv.sys
1⤵
- Executes dropped EXE
PID:4320

C:\Temp\xspkifaxsq.sys
C:\Temp\xspkifaxsq.sys
1⤵
- Executes dropped EXE
PID:4964

C:\Temp\hfzxvpnkic.sys
C:\Temp\hfzxvpnkic.sys
1⤵
- Executes dropped EXE
PID:2504

C:\Temp\kecxupmhfz.sys
C:\Temp\kecxupmhfz.sys
1⤵
- Executes dropped EXE
PID:5516

C:\Temp\czurmjhbzt.sys
C:\Temp\czurmjhbzt.sys
1⤵
- Executes dropped EXE
PID:5972

C:\Temp\trojgbztro.sys
C:\Temp\trojgbztro.sys
1⤵
- Executes dropped EXE
PID:4548

C:\Temp\ywqomjebzt.sys
C:\Temp\ywqomjebzt.sys
1⤵
PID:960

C:\Temp\oigaytqlig.sys
C:\Temp\oigaytqlig.sys
1⤵
PID:3588

C:\Temp\xvqnifdyvq.sys
C:\Temp\xvqnifdyvq.sys
1⤵
PID:2036

C:\Temp\vsnlfcavsn.sys
C:\Temp\vsnlfcavsn.sys
1⤵
PID:5064

C:\Temp\pkicsmkecx.sys
C:\Temp\pkicsmkecx.sys
1⤵
PID:1084

C:\Temp\cxusmkfcxu.sys
C:\Temp\cxusmkfcxu.sys
1⤵
PID:1080

C:\Temp\pmjebzxuom.sys
C:\Temp\pmjebzxuom.sys
1⤵
PID:5448

C:\Temp\trljhbzwro.sys
C:\Temp\trljhbzwro.sys
1⤵
PID:3588

C:\Temp\zwurljgeyo.sys
C:\Temp\zwurljgeyo.sys
1⤵
PID:2360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

axvtnlfdxv.sys

Path C:\Temp\axvtnlfdxv.sys
Size 293KB
SHA256 8bae1facee8ae9efcb818e3f6f7fd7f3cb67d10272bd1f5b467a96bf41b86e7c
MD5 ff21e64b378b5914dbc8170d8157eff9
SHA1 9540ba11dfcb0037cc22855dbfbc58e8b7d92303
SHA512 2ca4d5eb0e8fca48d3c4cc28abf3582ff0ae261353b0749d8d0c43a53c0d4d3215811def4fadaa33b5306f16863ee0b98b5f671189c9f97628e7fe095a9299c1
SSDEEP 3072:gtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:gIJjiJcbI03GBc3ucY5DCSj
TLSH
T18B545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

caxvqnifav.exe

Path C:\Temp\caxvqnifav.exe
Size 384KB
SHA256 5fed0b25bd8e60c591363b65261c5ba390903a1f46d8080b70225afba633425a
MD5 a8dc44042f71a3cda8e2a0ca3b1bb3cb
SHA1 a8ef70269c0b8a7784d9b207c77a9f4c787bd4c7
SHA512 ea5b447089cf87b1180dcaf56d4029ce0737310e3004620e5a0666e5d1abdbe723afcff8822e6db4675e86c4364288037e319849f01034784d6a8720e5936015
SSDEEP 3072:L9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:5ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T12F847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

czusmkecwupmhfzx.exe

Path C:\Temp\czusmkecwupmhfzx.exe
Size 384KB
SHA256 cb31ee67ace0eb458b4cca5eaa300f1e184212d820a0e79869dcadc4f60fb6b5
MD5 a6e54cb3c81bb7073ee880536cc426a0
SHA1 13372428e9073e5f2bae4302381f05c0796d2628
SHA512 8ebf5840140deb9cd4cc4a568a4382fcbb866aa6de8677e4c9f24b4ec661c3f166779a0cbbffae48fcc0e5bb81dae90cb1d751bc53c7f57662ba59b223533245
SSDEEP 3072:t9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:/ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E7846A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

czusmkecwupmhfzx.sys

Path C:\Temp\czusmkecwupmhfzx.sys
Size 293KB
SHA256 dcda6f5bef365a2ae9ae4324890791ae04d8bf49bc0db416f0bd56fa9643c9e1
MD5 5912d84537dcccfc1ff39438dfa86fe1
SHA1 60b5036161a0ded7ececb047214b37a54ef7d962
SHA512 660fd3bc96e08a4cfa8c362e54e6abf51c501a0fb1143bcbde7fa13acd2ebf8e98dac3230799e862b0132ad488f3546bbace026491d0ee6118ca6878e400f761
SSDEEP 3072:htKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:hIJjiJcbI03GBc3ucY5DCSj
TLSH
T164545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eczuomhecw.exe

Path C:\Temp\eczuomhecw.exe
Size 384KB
SHA256 039b5d83a0bacd79bc10589db8e9f0bd4f3408e943767c2944cba3f33fa68fa2
MD5 be5604cdb0ff7cb13f7f165f3bfa561d
SHA1 033916da2b934e0a0673576bf0c96d06599bb86f
SHA512 a4dc93f5916eb2e9290d916ef59047faca0d46469f006a51acefb8dfc85390f5ff9f54e4aea76fc14a0e385ff3c4e89f82aaf70c31f092d9682837ddf4a6d2cc
SSDEEP 3072:59ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:TctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A9847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geywuomgec.exe

Path C:\Temp\geywuomgec.exe
Size 384KB
SHA256 1d8a53f9e43cbdf02ddf471ef7facb548b9616b7b1cf7a8c39a83ee83d27372b
MD5 d1f60a113e1a4f67ae835865968726c3
SHA1 ab1870723aa0287bfe57062f867664ebccfd51ec
SHA512 517a4e3818f575cbb28b2de9af18e02e005f9c84f16b038643d65c797dcb4788a6a8183c2336fc8c8ffa474a46269aaae160223dfab02bd9899fa38c57526a32
SSDEEP 3072:Z9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:zctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E3847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_eczuomhecw.exe

Path C:\Temp\i_eczuomhecw.exe
Size 384KB
SHA256 b3df1253de8c6e39c3d287bb0368edcd2a8d87c3bf8208c6c23a04701435a4b7
MD5 6a99ff910e327e29332516dedaa47887
SHA1 7e0b94754e499f8d881bed728e0e71f15b873871
SHA512 9ef1db58d9731e11ad0c81bebc01de7aeda0fb362b455622a5cbabdde8526f06048f76875b4c1bdc60ec52b67f55fc4bc790962da9c5dde44ba83897613f917c
SSDEEP 3072:49ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:6ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T15A847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_geywuomgec.exe

Path C:\Temp\i_geywuomgec.exe
Size 384KB
SHA256 06a7e9243dcf0bf000559c6e0fbac0dfd337ebbebb87f6d70fe6797f22548031
MD5 590c4564c336c3fa6b70e5da27110711
SHA1 5311524a220c52f8d11d6b7f7863b0fb2cbca480
SHA512 ea13e801d8781cd3e04003e0c1b8ae27f1e075707216e71c9c9fe7f2e534c4ad22f9842deda9497bb8c767ecfac8d571557cfa408ac64c5c3f82dff1c3c58159
SSDEEP 3072:59ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:TctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T129847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_igaysqlyvq.exe

Path C:\Temp\i_igaysqlyvq.exe
Size 384KB
SHA256 a485eb8b8e04c0dc525ddddf95aa9fb331fc0cdb19f9a330da10e5142b17c779
MD5 f698ebccc67b5769d1084edd7823a17f
SHA1 c0955e6f896ba01ede5388c5c11b8444f17a2e62
SHA512 a8e0b2b9322b06669964fa36317bc69e565a8dd606665b9854d7209190d9d6d63cfc765cb68b74b5c2779d9cd77572d6cae3bb30ba613aa74c2446dfc1ab1b64
SSDEEP 3072:39ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:NctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T15A847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qljdbvtolg.exe

Path C:\Temp\i_qljdbvtolg.exe
Size 384KB
SHA256 bf61921368b1567007678c92ec23cb03e581d8de6fdec20d080586728b3202f0
MD5 af3c48322e49613a2d8a5a7787a709a8
SHA1 82ca3cb72736fbc6f8452a302089a5a3cf876e51
SHA512 9f2cb388f50b94db21cead5ec89bc5b9caef3d9e676034bdda67e413d8278144640b5778ec92c7a05d9551bfe9814f95e40434f6b74c675b76f0034fc77b118a
SSDEEP 3072:K9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:wctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B9847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qolgeywqoj.exe

Path C:\Temp\i_qolgeywqoj.exe
Size 384KB
SHA256 e762148ae3a28af6a0c8f8d315ee66c9fa8a3d526657cececc5945c9ea7b08e3
MD5 676754f75ffad872079009673fa882e0
SHA1 85dd315da0655c94bdbe5e81494ee65161e8e5f1
SHA512 086110e43b46218f2facb1596b973fecc8c3be0949d398498be7f67ccd8e78955305bf5d8982a9c8a52b0babee9893533c9805a7029954cdf263e805125aa2e5
SSDEEP 3072:w9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:CctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T13A847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igaysqlyvq.exe

Path C:\Temp\igaysqlyvq.exe
Size 384KB
SHA256 e4f4aa53ec39845c2e221bb497a67b47da04b6e66147c1fbee03e4ab602f7b87
MD5 e3e038d188ef2ded9eac607433760dc5
SHA1 9b50027147366dd1860b5c9a649535ca69111e64
SHA512 f5292e85a724355d01403690bc9aa728af484f11731841d737dd60ad90dcc3d535769b2133d6cbe7138ab8b3fba1e2e1a9cdbee17e19c4533e7c0ba1654d6494
SSDEEP 3072:Q9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:ictFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T171846B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oigdyvqoig.sys

Path C:\Temp\oigdyvqoig.sys
Size 293KB
SHA256 6e5f18e1cbd692dcb0692a2692abea8140bc7db7c5dc7f834c0b2a0313d9ec07
MD5 d2bc06e663dcee78ba8f5f88c5b2cb81
SHA1 13c74e42692efc4d159f785276e1cb4a4189f5e4
SHA512 3856a8e93be449af892039a759ca38fa7b47d1eec66adfb3cfc2a66ac7ac0850f211ee9cbdb8b54a0a5405642efab858eb7620567ec5b786fe2661829258c20c
SSDEEP 3072:ytKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:yIJjiJcbI03GBc3ucY5DCSj
TLSH
T12F545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pjhbzurmje.sys

Path C:\Temp\pjhbzurmje.sys
Size 293KB
SHA256 3a0592a6c86cabde9bc0cb9a3eebc0f4cbc53288792535e8e0f7b1b599a8c8c5
MD5 1fa2ba82dacedce2f74cdbf6927ff6e2
SHA1 c6db1608185e84f2bf41b3d2a72ed5028974fe1f
SHA512 339e204961290d59917c7390958e5f07cd81777069e94fdf4ee2febdb114b9f669f0afbb40197fe22be1019705c1b6be5ded98e7995191fb5c365e8879c4a2b3
SSDEEP 3072:rtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:rIJjiJcbI03GBc3ucY5DCSj
TLSH
T18E545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qljdbvtolg.exe

Path C:\Temp\qljdbvtolg.exe
Size 384KB
SHA256 54c7b9aa5fcf3a24b738305bc74ad2215a8f903563df9bebbb54e5a31c724516
MD5 2866d1d13b883deff867f07d5a6128df
SHA1 0b65cca07aa3a0983927cbc58e0ca854386ddad0
SHA512 398a7da908adb02a5113d0803db25dcb2c184445a9f8ea2361accb6b40944d7882f53001908864ab66d9254655802d4e75501c8d88ab69230e62bda04aa7bddd
SSDEEP 3072:s9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:2ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1DF847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qolgeywqoj.exe

Path C:\Temp\qolgeywqoj.exe
Size 384KB
SHA256 0175590c5b53338f38cb65aa6413932502cdc7739c3614f5d3b256d0210852ca
MD5 6e443de93da78f555209575d53aa1b75
SHA1 df8aa0167e0463fcc38060188505a5cdde9b0627
SHA512 546daf82bb647f1ec404f6d5ce5d68ace00730be52adc84fae89279937a9fe539c67919d1f12da75d39a5bf8261eb2c6cd58432d272f7d201cfb8ab9d943b63b
SSDEEP 3072:29ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:kctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T18C847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trljdbztqo.sys

Path C:\Temp\trljdbztqo.sys
Size 293KB
SHA256 1c63ff7fc3a1d8ae385a074e095cd5eb1828576f61533bd7da075bcbecbbb8f2
MD5 5fa8581f2019c4b00f966bdb67fe1ef4
SHA1 c7b559cfbbfa6b6ab2bfc256220628ea081890e4
SHA512 1e8c554917e56c6b71cc9f36def6392de358c2820113ee7c6222b3d48731ddd121405d20e26b024e284f82e9d32c15bae10a1d5182330b0cbc8e5a28cb63f0d0
SSDEEP 3072:wtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:wIJjiJcbI03GBc3ucY5DCSj
TLSH
T16A545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wtrljdbwlg.sys

Path C:\Temp\wtrljdbwlg.sys
Size 293KB
SHA256 9b0f1ac37a2beeed15d229f1156e86e3a8dfaa72055fa8959d4acebe1abc140d
MD5 3f7505c88ffc965e88380e854ccd99b0
SHA1 6f407f30ed194c2bf8de23a6063786ee5ec9a64d
SHA512 312b1aa344321f77c314639aba31c33b6ae69b6936a22b023b11d2055686c41d071423653fb0254b8aebaecd3db4ec83800da3330d2f95cf84454466a2b73690
SSDEEP 3072:GtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:GIJjiJcbI03GBc3ucY5DCSj
TLSH
T13E545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 2c619caf85b6078c7f3d9de900b75c5a1c2828896e2220f212ed8d4a328a9936
MD5 5d6001da4da9283690d5ae15908333c2
SHA1 7ead9e73cd720f1350378876703610a1d0a45b23
SHA512 a7226359d10a4cf68e6d558803268b86f242b86fbf68455448c99772c7697633b05a6fd0e96cb79ce49a59281cf3274691867f9bb6b0cfb6b6a157b6073acb3e
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7H:fwUQC5VwBIiElEd2K57P7H
TLSH
T117B3A931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 168dc438fa355b9b84e416f9d4caca14da218ad190d72da09fe489277625815d
MD5 39064a84dfec9bbd8c4b789b6d7a7c62
SHA1 5d817a4df5ed7bd1eac0c4bc0464a76007ad0c46
SHA512 3a4f32a1ad3eb6c391e6d11f4f6ba07c4d21cc935ddd8fd93306857b9e0cfda06c39786a872cae88f394320921a63296ad4df0e61334710db192febec2f48618
TLSH
T1B5D0C034763961C2C92725B2CC3163007320007030B587425171840C8E3489667CF3C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 08a3eccff4cd9b05162ffe0d083662ea8cd60457899147f42dbbf95a0a97d97e
MD5 394c25b8b347a39d61b9cf28babb5c77
SHA1 c7334bcf8642ac580d30cf31659724fe1ab323c9
SHA512 8e5c09dada01bf020bbf53884d65940c521dc62e17d9ce99fe6c571edde4b95c7c7716f2eda97b70568b2cbac8823e7afed5a9bac7be39d1acc6fc95c23a4b1c
TLSH
T1F6D0C038762962C2C92725B2CC3063007330007030B587425071440C8E3489667CF3C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 67fa1d1fa7cdc17e7b298a7ce4eb87d8636c8858e140d2f76882d8ba1454cc07
MD5 469c222aee445db996a3a770e5b31b4a
SHA1 fe81e10d5969e4fa24a3ee8ff51fed92c7dc4736
SHA512 2b70006935dbcadce97b166f1502a930610623fe385a56cca3b8748da92f2238f4f5ea568f8316cf23c720d8c1815d508456badec6b511938368ecda95ec06f4
TLSH
T106312A90336408F7C7909DF215F84AD7313CA7BC06076E11D984A33F88B3724BC12029
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 f4a8f75dc876786e1249a04c199fdd50c126d11626c2776785ea16c6a0ef2948
MD5 1c12a7d9662996d3b6b342ddb4e8f27e
SHA1 900b8deccc13136d208548fbece256e97b43d770
SHA512 3687656677aea0e8da80a01cbd988ade87036e88084dd3334e3cd448127b37e58044c95b9adfaabb6c35243f5b2535da6696ad1a35ae5c20f484412487d1056b
TLSH
T168419CF383F4856E8A1196F0AA146F2FCF2D0515432C7D5AC9E4AE2793E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 05b2bc777433592b7e2905ef799aa3dd14ed39379d566815c209d3a8161626fc
MD5 dd87e7e217e3abfe9cfcfb070019c35b
SHA1 e429c6903a347881c2dbfe7f89c57c6b632a3798
SHA512 f07edf77b2bc283b74b867e4def4592ff1264dff477b559aca31a21c4a81c49c6696fa74128ccbab226111b3420137485e84682ac6f9e5f34f0e751bf30ea99e
SSDEEP 192:sxRRrR/yM/jK1Ml8wCP//fOs1AVzZ1vZf5WV8zoA8p9N/g6+WNC7Q/YZ78qpiaGe:sxRRrt8P//fOseV91BfgVt3/59/ZXo
TLSH
T16462D915AA24597BCCDBD20DFA557F93D7F81472A1900E48AEFC8A1C04E7ADD221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 7ea34375e1b064751b25b95121363bbd3b065dc2ddaf93d3d4bffd5bc180fb3f
MD5 0adc8f5824b8784823da9a5299b2169d
SHA1 130aefeab3787a8787fb53f92c46a9ca4817da86
SHA512 f898779ec0bc57e44b38772c2973892e79fbbd140310a716bffe66a1b6a0bdd2bf0d89c1235a8d87e7aa4b1226da6aab14c38f21c21ccbcdb44dad7d24df51c0
SSDEEP 192:sxRArR/yM/jK1Ml8UQLCP//fOs/AkzZ1vZf5WV8zoA8prN/g6+WNC7Q/YZ78knm/:sxRArtq+P//fOs4k91BfgVtp/59/PXv
TLSH
T10162C715AA245A778CDBE20DFA517F93D7F91472A1900E48AEFCCA1C04E7ADD221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 32eb95463821a1435d80d528f47f6f201bc539c03a842901034fbec2ebfd3b43
MD5 de92bc769072a9987378fde94b31f742
SHA1 b79cd15987b147caaa24c23e832e35f00386ba9d
SHA512 7b05b38d216dcab501111e9573ef0b2d40c97ca212e4877101afb634b19c101fa3dcfcfc61c04578fec37da99db59178c00a08de9c229cd26e6db22ef8aa0c57
SSDEEP 192:sxRArR/yM/jK1Ml8wCP//fOs/AVzZ1vZf5WV8zoA8p9N/g6+WNC7Q/YZ78qpiaGn:sxRArt8P//fOs4V91BfgVt3/59/ZXh
TLSH
T11062D815AA345A7B8CDBD20DFA517F93D7F91472A1900E48AEFC8A1C04E7ADD221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 e6548999274ef2c3e9aee00c6e4612e81bfdaa4509f601404482f96461a23b1e
MD5 c855cd64fca06380405ec41442aa8558
SHA1 803d175562a85b7b9abbf16086d869536133e24c
SHA512 8b0ee3d363d88c9792e7e0c3293444e82cba598fcc6b6a9866d9aeda79264c3dddecd5aeeea434b8f457270a2890e3b3e3217c8866799cb5c5713e10082f5610
SSDEEP 768:kfISuS7pLuL7CvWgd5fWb8F1+UoAYDCx9Tuqh0VfUC9xbog/OVeZtSV29roHh0dK:kfISuqE7CvWgd5fWbu1ja5ZtU22Hh0dK
TLSH
T13BE2DC3B680CCB7F4F8049DCEC297E9AADA801CF96D8C99447EA850C03C66EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 7e9c14e7709142e547715656f9111a42be155b7912ed4d77203126a7e253419f
MD5 f831a3f93338b4c3faecaaf3fcf847aa
SHA1 a2077cc9090fab4853fcb785b86c32c928f4c572
SHA512 cd196d936a631c0c413fad6931a6ac76ce215dfca58e9ed5c034cae08150c0066bfe0244679ed435de0d220b169e904084b511980665f3228cb553b609ee77af
SSDEEP 24:KSi5EiBikimPijSiAisiv1ikiDDimI4iIivKXiIhPiiiv1Ri+i/SriR5iEJicikU:Kc2IfKbiIzytPIVKckoY+I3Kv6EDy1z
TLSH
T18391E4D9B47B86013CBF250890B5C917CAC570B37459A42B7FA941A24FABE434EFC8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 003cea8ac75c55da4474f169539a384b19c6847e8d1410d58319e991800c773c
MD5 f8a7490dc3dced5213bc5d932f71357e
SHA1 d16f02e44f889df8d474748cb660c89206ea8982
SHA512 a729425af080758642317dad606012118b13230c1073cf6531be3eb0e62bfbc22c295c9bfc0aa66663c9e79e95d8135dcef3550f9fe7d71fd22b85fdb3031dfd
SSDEEP 768:vF32MYBdzLLHLdAam6aQMGdjWca4Ghf932b:vF32MYnmaME6p3Y
TLSH
T19A0307F098E79933D89E5387633D6E46ADBCD16374884984BBD85E0CCD8217FD70A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 bf2b9ddd6f3ea443fd61b6cf3f6ee162d0b6b8aab802ce783abeae9a7962f9be
MD5 a81862a71fbfc287e76c77e6f3de6ba0
SHA1 bae286ef9453183d3714c6b86fc4051a56d22132
SHA512 07e47db4083cd010670bb173151b5eab43a93ef97cbfed9d99b385e275168b25165d373a14e15b4c1bceaeb85aeb9fc78e92cdd6f3740499793c0b1f52a9a30c
SSDEEP 768:J532MY7pq9LLHLh6Aam6aQMGdjWca4Ghf932b:J532MYOUmaME6p3Y
TLSH
T194E29F305C65D9339CABA295F71A2787BEF0517398D84E84D9ECAB0D069358E370BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 610329e6503f9dfb093deffa70ad08c14ed1db411bbf827988ff143fcf670a18
MD5 2620ebc75ee1ed5a578ddc737d44292b
SHA1 f548349dbd6dff81b47e471a7feb7d3fd7d2d2b0
SHA512 c732d186d17e9f0817cdbddf966322017491d977979facf88b0a2d9b809b4aa01f8594418f1c686e23627b65fa5ba938eedb94f8bbb1acad6167e87f8ee99ad2
SSDEEP 768:/rv+4UNbdq39Jq9LLsAAam6aQMGdjWca4GhfBBPeU/:/bsbc31KmaME6pZH
TLSH
T184F2BE31A86C9573DDB7AA99F21B6787BFF021A384D40A80D9D96B0D439748E3307D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 85b5234de5f4ea8600a49a382da49fb45fe5f51d2d7ca2ec376fe342e8536232
MD5 77cd1a0486806a47f600e168b9c64688
SHA1 2260fcb82d8ed7ac3edb689d9bbd6e07a814d709
SHA512 d0c5db077e3eae4e1d847649c3edf6df4862ac89063b111d8122897927a20cfe26be88dde980f0e8ef51c27ab103ef10a4bf0b952d8b3e43ff5b56cf0131dd4a
SSDEEP 768:krv+4UNbd+30Mcbpq9LLHLh6Aam6aQMGdjWca4Ghf93/n:kbsb430McuUmaME6p3f
TLSH
T14CF2AF31686CD9739CB7A595F25B7687BFB021B388C40E84D9E96B0D069708E370BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 1133ecb9c43a3a495d30394f9b137616c430574ada300829b99150a2d24a479f
MD5 6257405cf876ebf1593ab5a3afcc76f6
SHA1 379c07c3267901dc03c97d368c4e3e45d91fc710
SHA512 661614fc3a651f740ace9d5bd97e33a9d67d2930be0cbb309f8cc6971f353242077701b523034b24b514360ef14a5bf3cd9af6074d014848a00ba4d28bc8bfdd
SSDEEP 768:Mrv+4UNbdq3J3q9LLHLh0Aam6aQMGdjWca4Ghfw3PeU/:Mbsbc3SWmaME6pkH
TLSH
T124F2BF31A86CD9339CB76699F25B6687BEF021B388C40E84D9D96B0D439748E370BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 1d56ea56fa5316a776e5bfacfc07bceddf4e89faf367c5d79ecc2e0bc1c3c5dd
MD5 c48bdbb3ed7b3eefa5bb23da316b923b
SHA1 ac271c5bf199ab6ba1164312d0c083fd8dcd0a77
SHA512 c1e7688a02b3b2017ab206c1fdce36da158b2a8c49cfc94a088840eb6fab3ef4b82ea890eb2b9e7fbf4501a3c282147d8e05cd802f5693ffd9a22c679dc8671b
SSDEEP 768:Qrv+4UNbd+3S2MY7pq9LLHLh6Aam6aQMGdjWca4Ghf935o:Qbsb43S2MYOUmaME6p3m
TLSH
T11C03AE316868D9739CB7A695F21B7687BEB021A388C40E84D9E95B0D069709E370BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VariationsRuntimeSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsRuntimeSeedV1
Size 484B
SHA256 9fd2b7fae87c2d863b486a425834283f19b1444749c84650d5a48c9eadb12e2b
MD5 e9289cc1f579fdfa9d46acfae9b38330
SHA1 7eac8e241d8c35d873280d6b9dbc1cca7a9b2231
SHA512 b1f37da50e387c8408a960ef5276a51336510286c1db7eaea4cde65af4efc343f8ac1d9de65df1fd0818513823a485733e5c155da615344bc044f46021ecf586
TLSH
T134F0543C33D821A4F08C46B23596ED8B88BF313247DC2631CA50F550315387701B5095
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

63a10774-8659-428f-ac7c-c4cd510f97df.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\63a10774-8659-428f-ac7c-c4cd510f97df.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2928_883979599\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 f3b2caacd44a1c72e0ae11466f6ba8c2745d8433b9acf81b49b0de7f56f1ca98
MD5 c2857e3c65ab20cd778a09307d0a01cb
SHA1 fc7aa335bf06392dce27ec0bdd9ccde2080fd73a
SHA512 efccc95dd3523c126466621651fa647ba2e70d443c67ff9192a78775bbece19b78c9766a0995590396124df5b7ebe4212b46f3758417e22529979a6e6f2358bc
TLSH
T13B71008356B8CAF2C1DA5BF002835648F2BF2238072330740B555546AB30A7E28B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/960-382-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1080-458-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1084-437-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1808-244-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1808-189-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2036-406-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2360-493-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2504-325-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3588-402-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3588-489-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4320-291-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4324-264-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4548-362-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4676-276-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4676-313-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4964-321-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5052-62-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5064-426-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5448-464-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5476-238-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5516-329-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5972-333-0x0000000000010000-0x00000000000AB000-memory.dmp

Download