systex | 765a141f40a5d34ad60ede498cc12bf56484492ab37b9e0a483c22a987f5beb5

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 18:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_2282788dcceeb8da295a3c3f7cb354e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Size 376KB
Sample260813-w8a55avyhs
SHA256 765a141f40a5d34ad60ede498cc12bf56484492ab37b9e0a483c22a987f5beb5
MD5 2282788dcceeb8da295a3c3f7cb354e8
SHA1 e4275ea506b6341824879ed1e3644f3f8984eeea
SHA512 fcac7edbfcff6f54af187584f6dc2365b85ca49a238727bbc3a5c6670f59428283afe6c6f63060a5ac0c49b2ceedffc85aae5d608a985fd80a057446077e2bba
SSDEEP 3072:wFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:wFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T100847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
3312	kfcxvpnhfausmkfc.exe
3476	kfcxvpnhfausmkfc.sys
2036	CreateProcess.exe
5832	nhfcxvpnhf.exe
1172	CreateProcess.exe
2492	CreateProcess.exe
3360	i_nhfcxvpnhf.exe
5756	rpkhczurmk.sys
1900	CreateProcess.exe
2828	hecwupmecw.exe
2532	CreateProcess.exe
1044	CreateProcess.exe
3008	i_hecwupmecw.exe
1488	kebztrpmhe.sys
3824	CreateProcess.exe
4088	ecwurmjhbw.exe
1200	CreateProcess.exe
2608	CreateProcess.exe
3728	i_ecwurmjhbw.exe
1188	hbzwromjhb.sys
2164	CreateProcess.exe
1704	zwqomgeywt.exe
2448	CreateProcess.exe
5532	CreateProcess.exe
2632	i_zwqomgeywt.exe
4084	gebwqoigby.sys
2792	CreateProcess.exe
2888	ebwtqligey.exe
1364	CreateProcess.exe
5352	CreateProcess.exe
5560	i_ebwtqligey.exe
3572	igaytqlidb.sys
5424	CreateProcess.exe
5528	dbvtnigayt.exe
5108	CreateProcess.exe
4904	CreateProcess.exe
5244	i_dbvtnigayt.exe
6132	ysqkigayvp.sys
3444	CreateProcess.exe
5384	xvtnlfdayv.exe
2932	CreateProcess.exe
2576	CreateProcess.exe
1592	i_xvtnlfdayv.exe
4968	qkicayspni.sys
4628	CreateProcess.exe
5596	hfaxspkicx.exe
2152	CreateProcess.exe
1180	CreateProcess.exe
4244	i_hfaxspkicx.exe
4896	nhfzxspkic.sys
2268	CreateProcess.exe
3948	fcauspnhfd.exe
4752	CreateProcess.exe
2452	CreateProcess.exe
4796	i_fcauspnhfd.exe
4564	smkecxupmh.sys
1688	CreateProcess.exe
4760	pmhfzxrpkh.exe
2008	CreateProcess.exe
5020	CreateProcess.exe
5264	i_pmhfzxrpkh.exe
3552	jhezxrpjhe.sys
5008	CreateProcess.exe
4180	kebztromhe.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4260_1318106815\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywqojgbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfcxvpnhfausmkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfcxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hecwupmecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvtnigayt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwqomgeywt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kebztromhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjgbztrlje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvqnigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snkicavsqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfzxspkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hecwupmecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmhfzxrpkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmhfzxrpkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomhbzxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_2282788dcceeb8da295a3c3f7cb354e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvtnigayt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfaxspkicx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fcauspnhfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywqojgbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfzxspkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xupmkecxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvtnlfdayv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqljdbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snkicavsqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwurmjhbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwqomgeywt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebwtqligey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcauspnhfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kebztromhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjgbztrlje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxvqnigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xupmkecxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfcxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvtnlfdayv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfaxspkicx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqljdbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomhbzxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwurmjhbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebwtqligey.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
892	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1952	ipconfig.exe
4668	ipconfig.exe
1984	ipconfig.exe
4192	ipconfig.exe
3500	ipconfig.exe
3404	ipconfig.exe
2248	ipconfig.exe
3352	ipconfig.exe
5104	ipconfig.exe
5580	ipconfig.exe
1580	ipconfig.exe
3132	ipconfig.exe
4216	ipconfig.exe
2836	ipconfig.exe
4812	ipconfig.exe
3424	ipconfig.exe
2588	ipconfig.exe
3256	ipconfig.exe
5756	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134311197493471980"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{8E6F801E-BB2A-436E-92B1-DAF05E079384}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4364	2026-08-13_2282788dcceeb8da295a3c3f7cb354e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4364	2026-08-13_2282788dcceeb8da295a3c3f7cb354e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4364	2026-08-13_2282788dcceeb8da295a3c3f7cb354e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4364	2026-08-13_2282788dcceeb8da295a3c3f7cb354e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4364	2026-08-13_2282788dcceeb8da295a3c3f7cb354e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4364	2026-08-13_2282788dcceeb8da295a3c3f7cb354e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4364	2026-08-13_2282788dcceeb8da295a3c3f7cb354e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4364	2026-08-13_2282788dcceeb8da295a3c3f7cb354e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4364	2026-08-13_2282788dcceeb8da295a3c3f7cb354e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4364	2026-08-13_2282788dcceeb8da295a3c3f7cb354e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4364	2026-08-13_2282788dcceeb8da295a3c3f7cb354e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4364	2026-08-13_2282788dcceeb8da295a3c3f7cb354e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4364	2026-08-13_2282788dcceeb8da295a3c3f7cb354e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4364	2026-08-13_2282788dcceeb8da295a3c3f7cb354e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4364	2026-08-13_2282788dcceeb8da295a3c3f7cb354e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4364	2026-08-13_2282788dcceeb8da295a3c3f7cb354e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4364	2026-08-13_2282788dcceeb8da295a3c3f7cb354e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4364	2026-08-13_2282788dcceeb8da295a3c3f7cb354e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4364	2026-08-13_2282788dcceeb8da295a3c3f7cb354e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4364	2026-08-13_2282788dcceeb8da295a3c3f7cb354e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4364	2026-08-13_2282788dcceeb8da295a3c3f7cb354e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4364	2026-08-13_2282788dcceeb8da295a3c3f7cb354e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4364	2026-08-13_2282788dcceeb8da295a3c3f7cb354e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4364	2026-08-13_2282788dcceeb8da295a3c3f7cb354e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4364	2026-08-13_2282788dcceeb8da295a3c3f7cb354e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4364	2026-08-13_2282788dcceeb8da295a3c3f7cb354e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4364	2026-08-13_2282788dcceeb8da295a3c3f7cb354e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4364	2026-08-13_2282788dcceeb8da295a3c3f7cb354e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4364	2026-08-13_2282788dcceeb8da295a3c3f7cb354e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4364	2026-08-13_2282788dcceeb8da295a3c3f7cb354e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4364	2026-08-13_2282788dcceeb8da295a3c3f7cb354e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4364	2026-08-13_2282788dcceeb8da295a3c3f7cb354e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4364	2026-08-13_2282788dcceeb8da295a3c3f7cb354e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4364	2026-08-13_2282788dcceeb8da295a3c3f7cb354e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4364	2026-08-13_2282788dcceeb8da295a3c3f7cb354e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4364	2026-08-13_2282788dcceeb8da295a3c3f7cb354e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4364	2026-08-13_2282788dcceeb8da295a3c3f7cb354e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4364	2026-08-13_2282788dcceeb8da295a3c3f7cb354e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4364	2026-08-13_2282788dcceeb8da295a3c3f7cb354e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4364	2026-08-13_2282788dcceeb8da295a3c3f7cb354e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3312	kfcxvpnhfausmkfc.exe
3312	kfcxvpnhfausmkfc.exe
4364	2026-08-13_2282788dcceeb8da295a3c3f7cb354e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4364	2026-08-13_2282788dcceeb8da295a3c3f7cb354e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3312	kfcxvpnhfausmkfc.exe
3312	kfcxvpnhfausmkfc.exe
4364	2026-08-13_2282788dcceeb8da295a3c3f7cb354e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4364	2026-08-13_2282788dcceeb8da295a3c3f7cb354e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3312	kfcxvpnhfausmkfc.exe
3312	kfcxvpnhfausmkfc.exe
4364	2026-08-13_2282788dcceeb8da295a3c3f7cb354e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3312	kfcxvpnhfausmkfc.exe
4364	2026-08-13_2282788dcceeb8da295a3c3f7cb354e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3312	kfcxvpnhfausmkfc.exe
3312	kfcxvpnhfausmkfc.exe
3312	kfcxvpnhfausmkfc.exe
4364	2026-08-13_2282788dcceeb8da295a3c3f7cb354e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3312	kfcxvpnhfausmkfc.exe
3312	kfcxvpnhfausmkfc.exe
3312	kfcxvpnhfausmkfc.exe
3312	kfcxvpnhfausmkfc.exe
4364	2026-08-13_2282788dcceeb8da295a3c3f7cb354e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4364	2026-08-13_2282788dcceeb8da295a3c3f7cb354e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4364	2026-08-13_2282788dcceeb8da295a3c3f7cb354e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe
4260	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	3360	i_nhfcxvpnhf.exe
Token: SeDebugPrivilege	3008	i_hecwupmecw.exe
Token: SeDebugPrivilege	3728	i_ecwurmjhbw.exe
Token: SeDebugPrivilege	2632	i_zwqomgeywt.exe
Token: SeDebugPrivilege	5560	i_ebwtqligey.exe
Token: SeDebugPrivilege	5244	i_dbvtnigayt.exe
Token: SeDebugPrivilege	1592	i_xvtnlfdayv.exe
Token: SeDebugPrivilege	4244	i_hfaxspkicx.exe
Token: SeDebugPrivilege	4796	i_fcauspnhfd.exe
Token: SeDebugPrivilege	5264	i_pmhfzxrpkh.exe
Token: SeDebugPrivilege	5460	i_kebztromhe.exe
Token: SeDebugPrivilege	5244	i_mjgbztrlje.exe
Token: SeDebugPrivilege	5812	i_eywqojgbzt.exe
Token: SeDebugPrivilege	2188	i_tqljdbvtnl.exe
Token: SeDebugPrivilege	4564	i_fdxvqnigay.exe
Token: SeDebugPrivilege	6056	i_snkicavsqk.exe
Token: SeDebugPrivilege	4196	i_nhfzxspkic.exe
Token: SeDebugPrivilege	3016	i_xupmkecxup.exe
Token: SeDebugPrivilege	3384	i_uomhbzxrpj.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4260	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4364 wrote to memory of 3312	4364	2026-08-13_2282788dcceeb8da295a3c3f7cb354e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 4364 wrote to memory of 3588	4364	2026-08-13_2282788dcceeb8da295a3c3f7cb354e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 3588 wrote to memory of 4260	3588	iexplore.exe	91
PID 4260 wrote to memory of 1428	4260	msedge.exe	92
PID 4260 wrote to memory of 892	4260	msedge.exe	93
PID 4260 wrote to memory of 4664	4260	msedge.exe	95
PID 4260 wrote to memory of 4664	4260	msedge.exe	95
PID 4260 wrote to memory of 4788	4260	msedge.exe	94
PID 4260 wrote to memory of 4788	4260	msedge.exe	94
PID 4260 wrote to memory of 4788	4260	msedge.exe	94
PID 4260 wrote to memory of 256	4260	msedge.exe	97
PID 4260 wrote to memory of 256	4260	msedge.exe	97
PID 4260 wrote to memory of 256	4260	msedge.exe	97
PID 4260 wrote to memory of 244	4260	msedge.exe	98
PID 4260 wrote to memory of 244	4260	msedge.exe	98
PID 4260 wrote to memory of 244	4260	msedge.exe	98
PID 4260 wrote to memory of 4588	4260	msedge.exe	99
PID 4260 wrote to memory of 6060	4260	msedge.exe	100
PID 4260 wrote to memory of 4588	4260	msedge.exe	99
PID 4260 wrote to memory of 4588	4260	msedge.exe	99
PID 4260 wrote to memory of 6060	4260	msedge.exe	100
PID 4260 wrote to memory of 6060	4260	msedge.exe	100
PID 4260 wrote to memory of 5036	4260	msedge.exe	101
PID 4260 wrote to memory of 5036	4260	msedge.exe	101
PID 4260 wrote to memory of 1316	4260	msedge.exe	105
PID 4260 wrote to memory of 5760	4260	msedge.exe	106
PID 4260 wrote to memory of 1316	4260	msedge.exe	105
PID 4260 wrote to memory of 5760	4260	msedge.exe	106
PID 3312 wrote to memory of 2036	3312	kfcxvpnhfausmkfc.exe	107
PID 5832 wrote to memory of 1172	5832	nhfcxvpnhf.exe	110
PID 4260 wrote to memory of 1328	4260	msedge.exe	114
PID 4260 wrote to memory of 4924	4260	msedge.exe	115
PID 4260 wrote to memory of 4924	4260	msedge.exe	115
PID 4260 wrote to memory of 5292	4260	msedge.exe	118
PID 4260 wrote to memory of 5292	4260	msedge.exe	118
PID 3312 wrote to memory of 2492	3312	kfcxvpnhfausmkfc.exe	119
PID 3312 wrote to memory of 1900	3312	kfcxvpnhfausmkfc.exe	123
PID 2828 wrote to memory of 2532	2828	hecwupmecw.exe	125
PID 3312 wrote to memory of 1044	3312	kfcxvpnhfausmkfc.exe	128
PID 3312 wrote to memory of 3824	3312	kfcxvpnhfausmkfc.exe	132
PID 4088 wrote to memory of 1200	4088	ecwurmjhbw.exe	134
PID 3312 wrote to memory of 2608	3312	kfcxvpnhfausmkfc.exe	137
PID 3312 wrote to memory of 2164	3312	kfcxvpnhfausmkfc.exe	142
PID 1704 wrote to memory of 2448	1704	zwqomgeywt.exe	144
PID 3312 wrote to memory of 5532	3312	kfcxvpnhfausmkfc.exe	147
PID 4260 wrote to memory of 3360	4260	msedge.exe	149
PID 4260 wrote to memory of 2152	4260	msedge.exe	150
PID 4260 wrote to memory of 4628	4260	msedge.exe	151
PID 3312 wrote to memory of 2792	3312	kfcxvpnhfausmkfc.exe	154
PID 2888 wrote to memory of 1364	2888	ebwtqligey.exe	156
PID 3312 wrote to memory of 5352	3312	kfcxvpnhfausmkfc.exe	159
PID 3312 wrote to memory of 5424	3312	kfcxvpnhfausmkfc.exe	163
PID 5528 wrote to memory of 5108	5528	dbvtnigayt.exe	165
PID 3312 wrote to memory of 4904	3312	kfcxvpnhfausmkfc.exe	168
PID 3312 wrote to memory of 3444	3312	kfcxvpnhfausmkfc.exe	172
PID 5384 wrote to memory of 2932	5384	xvtnlfdayv.exe	174
PID 3312 wrote to memory of 2576	3312	kfcxvpnhfausmkfc.exe	177
PID 3312 wrote to memory of 4628	3312	kfcxvpnhfausmkfc.exe	181
PID 5596 wrote to memory of 2152	5596	hfaxspkicx.exe	183
PID 3312 wrote to memory of 1180	3312	kfcxvpnhfausmkfc.exe	186
PID 4260 wrote to memory of 856	4260	msedge.exe	188
PID 4260 wrote to memory of 856	4260	msedge.exe	188
PID 3312 wrote to memory of 2268	3312	kfcxvpnhfausmkfc.exe	194
PID 3948 wrote to memory of 4752	3948	fcauspnhfd.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-08-13_2282788dcceeb8da295a3c3f7cb354e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_2282788dcceeb8da295a3c3f7cb354e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4364
- C:\Temp\kfcxvpnhfausmkfc.exe
  C:\Temp\kfcxvpnhfausmkfc.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3312
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nhfcxvpnhf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2036
  - - C:\Temp\nhfcxvpnhf.exe
      C:\Temp\nhfcxvpnhf.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5832
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1172
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2248
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nhfcxvpnhf.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2492
  - - C:\Temp\i_nhfcxvpnhf.exe
      C:\Temp\i_nhfcxvpnhf.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3360
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hecwupmecw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1900
  - - C:\Temp\hecwupmecw.exe
      C:\Temp\hecwupmecw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2828
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2532
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1984
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hecwupmecw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1044
  - - C:\Temp\i_hecwupmecw.exe
      C:\Temp\i_hecwupmecw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3008
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ecwurmjhbw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3824
  - - C:\Temp\ecwurmjhbw.exe
      C:\Temp\ecwurmjhbw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4088
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1200
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3352
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ecwurmjhbw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2608
  - - C:\Temp\i_ecwurmjhbw.exe
      C:\Temp\i_ecwurmjhbw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3728
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zwqomgeywt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2164
  - - C:\Temp\zwqomgeywt.exe
      C:\Temp\zwqomgeywt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1704
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2448
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5104
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zwqomgeywt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5532
  - - C:\Temp\i_zwqomgeywt.exe
      C:\Temp\i_zwqomgeywt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2632
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ebwtqligey.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2792
  - - C:\Temp\ebwtqligey.exe
      C:\Temp\ebwtqligey.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2888
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1364
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3256
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ebwtqligey.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5352
  - - C:\Temp\i_ebwtqligey.exe
      C:\Temp\i_ebwtqligey.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5560
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbvtnigayt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5424
  - - C:\Temp\dbvtnigayt.exe
      C:\Temp\dbvtnigayt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5528
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5108
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5580
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbvtnigayt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4904
  - - C:\Temp\i_dbvtnigayt.exe
      C:\Temp\i_dbvtnigayt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5244
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvtnlfdayv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3444
  - - C:\Temp\xvtnlfdayv.exe
      C:\Temp\xvtnlfdayv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5384
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2932
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4192
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xvtnlfdayv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2576
  - - C:\Temp\i_xvtnlfdayv.exe
      C:\Temp\i_xvtnlfdayv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1592
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hfaxspkicx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4628
  - - C:\Temp\hfaxspkicx.exe
      C:\Temp\hfaxspkicx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5596
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2152
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2836
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hfaxspkicx.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1180
  - - C:\Temp\i_hfaxspkicx.exe
      C:\Temp\i_hfaxspkicx.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4244
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fcauspnhfd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2268
  - - C:\Temp\fcauspnhfd.exe
      C:\Temp\fcauspnhfd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3948
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4752
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1580
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fcauspnhfd.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2452
  - - C:\Temp\i_fcauspnhfd.exe
      C:\Temp\i_fcauspnhfd.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4796
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pmhfzxrpkh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1688
  - - C:\Temp\pmhfzxrpkh.exe
      C:\Temp\pmhfzxrpkh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4760
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2008
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5756
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pmhfzxrpkh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5020
  - - C:\Temp\i_pmhfzxrpkh.exe
      C:\Temp\i_pmhfzxrpkh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5264
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kebztromhe.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5008
  - - C:\Temp\kebztromhe.exe
      C:\Temp\kebztromhe.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4180
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1876
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3132
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kebztromhe.exe ups_ins
    3⤵
    PID:4896
  - - C:\Temp\i_kebztromhe.exe
      C:\Temp\i_kebztromhe.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5460
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mjgbztrlje.exe ups_run
    3⤵
    PID:1512
  - - C:\Temp\mjgbztrlje.exe
      C:\Temp\mjgbztrlje.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:712
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4596
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4812
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mjgbztrlje.exe ups_ins
    3⤵
    PID:1004
  - - C:\Temp\i_mjgbztrlje.exe
      C:\Temp\i_mjgbztrlje.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5244
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\eywqojgbzt.exe ups_run
    3⤵
    PID:1684
  - - C:\Temp\eywqojgbzt.exe
      C:\Temp\eywqojgbzt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5860
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2504
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3500
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_eywqojgbzt.exe ups_ins
    3⤵
    PID:1088
  - - C:\Temp\i_eywqojgbzt.exe
      C:\Temp\i_eywqojgbzt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5812
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tqljdbvtnl.exe ups_run
    3⤵
    PID:1880
  - - C:\Temp\tqljdbvtnl.exe
      C:\Temp\tqljdbvtnl.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3660
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3912
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3404
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tqljdbvtnl.exe ups_ins
    3⤵
    PID:4208
  - - C:\Temp\i_tqljdbvtnl.exe
      C:\Temp\i_tqljdbvtnl.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2188
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fdxvqnigay.exe ups_run
    3⤵
    PID:3596
  - - C:\Temp\fdxvqnigay.exe
      C:\Temp\fdxvqnigay.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2760
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1128
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1952
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fdxvqnigay.exe ups_ins
    3⤵
    PID:5808
  - - C:\Temp\i_fdxvqnigay.exe
      C:\Temp\i_fdxvqnigay.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4564
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\snkicavsqk.exe ups_run
    3⤵
    PID:1988
  - - C:\Temp\snkicavsqk.exe
      C:\Temp\snkicavsqk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4144
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2200
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4216
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_snkicavsqk.exe ups_ins
    3⤵
    PID:5816
  - - C:\Temp\i_snkicavsqk.exe
      C:\Temp\i_snkicavsqk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6056
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nhfzxspkic.exe ups_run
    3⤵
    PID:2560
  - - C:\Temp\nhfzxspkic.exe
      C:\Temp\nhfzxspkic.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:936
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3168
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3424
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nhfzxspkic.exe ups_ins
    3⤵
    PID:428
  - - C:\Temp\i_nhfzxspkic.exe
      C:\Temp\i_nhfzxspkic.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4196
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xupmkecxup.exe ups_run
    3⤵
    PID:5780
  - - C:\Temp\xupmkecxup.exe
      C:\Temp\xupmkecxup.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1504
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4188
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2588
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xupmkecxup.exe ups_ins
    3⤵
    PID:4612
  - - C:\Temp\i_xupmkecxup.exe
      C:\Temp\i_xupmkecxup.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3016
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\uomhbzxrpj.exe ups_run
    3⤵
    PID:1580
  - - C:\Temp\uomhbzxrpj.exe
      C:\Temp\uomhbzxrpj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4576
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2528
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4668
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_uomhbzxrpj.exe ups_ins
    3⤵
    PID:3784
  - - C:\Temp\i_uomhbzxrpj.exe
      C:\Temp\i_uomhbzxrpj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3384
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x314,0x7ffeb824c188,0x7ffeb824c194,0x7ffeb824c1a0
      4⤵
      PID:1428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,4793135527933948825,14829782394822138191,524288 --field-trial-handle=2276,i,4976508666221097226,13249548080722343928,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:11
      4⤵
      System Time Discovery
      PID:892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,4593391122038755811,18074729717881523857,262144 --field-trial-handle=2276,i,4976508666221097226,13249548080722343928,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:2
      4⤵
      PID:4788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2100,i,10455716103417808994,7326609346110484261,524288 --field-trial-handle=2276,i,4976508666221097226,13249548080722343928,262144 --variations-seed-version --mojo-platform-channel-handle=3148 /prefetch:13
      4⤵
      PID:4664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3548,i,11022978168668549877,5157715566717271941,2097152 --field-trial-handle=2276,i,4976508666221097226,13249548080722343928,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
      4⤵
      PID:256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3552,i,17483809338124991435,10329734442730805940,2097152 --field-trial-handle=2276,i,4976508666221097226,13249548080722343928,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
      4⤵
      PID:244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4292,i,6193443282079469221,15134216489536260055,2097152 --field-trial-handle=2276,i,4976508666221097226,13249548080722343928,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:1
      4⤵
      PID:4588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4316,i,9917414749936402579,86378525686613006,2097152 --field-trial-handle=2276,i,4976508666221097226,13249548080722343928,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:9
      4⤵
      PID:6060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3744,i,6882012022594715863,6012432052081488683,524288 --field-trial-handle=2276,i,4976508666221097226,13249548080722343928,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:14
      4⤵
      PID:5036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,2805848207038267145,1385166910859999297,524288 --field-trial-handle=2276,i,4976508666221097226,13249548080722343928,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:14
      4⤵
      PID:1316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,17312448222589791223,18254106700204635595,524288 --field-trial-handle=2276,i,4976508666221097226,13249548080722343928,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:14
      4⤵
      PID:5760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,10007077004597140843,9019421578932113333,524288 --field-trial-handle=2276,i,4976508666221097226,13249548080722343928,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:14
      4⤵
      PID:5904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,10007077004597140843,9019421578932113333,524288 --field-trial-handle=2276,i,4976508666221097226,13249548080722343928,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:14
      4⤵
      PID:1328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,8757334804559030371,3139252835814690057,524288 --field-trial-handle=2276,i,4976508666221097226,13249548080722343928,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:14
      4⤵
      PID:4924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,17853787622580774650,5281385031030136944,524288 --field-trial-handle=2276,i,4976508666221097226,13249548080722343928,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:14
      4⤵
      PID:5292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4332,i,12861065520984711613,1254758965358600753,524288 --field-trial-handle=2276,i,4976508666221097226,13249548080722343928,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:14
      4⤵
      PID:3360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4344,i,9510827388012873963,2056997821191751458,524288 --field-trial-handle=2276,i,4976508666221097226,13249548080722343928,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:14
      4⤵
      PID:2152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4388,i,2640261797055271346,7760886449113933703,524288 --field-trial-handle=2276,i,4976508666221097226,13249548080722343928,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:14
      4⤵
      PID:4628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3740,i,5114448904099360556,8831937537331063902,524288 --field-trial-handle=2276,i,4976508666221097226,13249548080722343928,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:14
      4⤵
      PID:856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=920,i,1372756330540104414,5620340641354749363,524288 --field-trial-handle=2276,i,4976508666221097226,13249548080722343928,262144 --variations-seed-version --mojo-platform-channel-handle=924 /prefetch:14
      4⤵
      PID:2480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6396,i,11731602090947067575,404339782046639074,262144 --field-trial-handle=2276,i,4976508666221097226,13249548080722343928,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:10
      4⤵
      PID:3720

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5620

C:\Temp\kfcxvpnhfausmkfc.sys
C:\Temp\kfcxvpnhfausmkfc.sys
1⤵
- Executes dropped EXE
PID:3476

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3736

C:\Temp\rpkhczurmk.sys
C:\Temp\rpkhczurmk.sys
1⤵
- Executes dropped EXE
PID:5756

C:\Temp\kebztrpmhe.sys
C:\Temp\kebztrpmhe.sys
1⤵
- Executes dropped EXE
PID:1488

C:\Temp\hbzwromjhb.sys
C:\Temp\hbzwromjhb.sys
1⤵
- Executes dropped EXE
PID:1188

C:\Temp\gebwqoigby.sys
C:\Temp\gebwqoigby.sys
1⤵
- Executes dropped EXE
PID:4084

C:\Temp\igaytqlidb.sys
C:\Temp\igaytqlidb.sys
1⤵
- Executes dropped EXE
PID:3572

C:\Temp\ysqkigayvp.sys
C:\Temp\ysqkigayvp.sys
1⤵
- Executes dropped EXE
PID:6132

C:\Temp\qkicayspni.sys
C:\Temp\qkicayspni.sys
1⤵
- Executes dropped EXE
PID:4968

C:\Temp\nhfzxspkic.sys
C:\Temp\nhfzxspkic.sys
1⤵
- Executes dropped EXE
PID:4896

C:\Temp\smkecxupmh.sys
C:\Temp\smkecxupmh.sys
1⤵
- Executes dropped EXE
PID:4564

C:\Temp\jhezxrpjhe.sys
C:\Temp\jhezxrpjhe.sys
1⤵
- Executes dropped EXE
PID:3552

C:\Temp\rmjhezwuom.sys
C:\Temp\rmjhezwuom.sys
1⤵
PID:2716

C:\Temp\mjebwuomge.sys
C:\Temp\mjebwuomge.sys
1⤵
PID:4344

C:\Temp\tnljdbywqo.sys
C:\Temp\tnljdbywqo.sys
1⤵
PID:5464

C:\Temp\ligaysqlid.sys
C:\Temp\ligaysqlid.sys
1⤵
PID:5760

C:\Temp\dyvpnkigay.sys
C:\Temp\dyvpnkigay.sys
1⤵
PID:1256

C:\Temp\snkicausnk.sys
C:\Temp\snkicausnk.sys
1⤵
PID:4680

C:\Temp\cxuspkicau.sys
C:\Temp\cxuspkicau.sys
1⤵
PID:1960

C:\Temp\usmkeczusm.sys
C:\Temp\usmkeczusm.sys
1⤵
PID:4560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dbvtnigayt.exe

Path C:\Temp\dbvtnigayt.exe
Size 376KB
SHA256 3483b73c971255fec7427825bc009a532314772386b528c664873998205b8b6f
MD5 721fa7626cbedc04dcfc6b5e4391017f
SHA1 5967cd43b5f0c71b9ef4fb4c5fab135a69b23584
SHA512 4dbe2bf37f63b7e1682f26a308b51ddb344cb7f2d6b94d81d1a475d8bdf1a936c78996f9dd52302704b67b39fcb5b96492e9085de6c25017e856825ac203ff12
SSDEEP 3072:JBFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLY:XFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T171847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ebwtqligey.exe

Path C:\Temp\ebwtqligey.exe
Size 376KB
SHA256 791e050376e7de4dcbb70aa145218d0996d5025ba5e69b4c8616fe65a5f4573a
MD5 ee405b0f774d39dac775112972b80d0b
SHA1 22cfae4b3679895553bf43db74234090a791ad07
SHA512 19d2ab8ff7fd6e9e6c2f1a1141d5deca7fad124e7568f8b715d7efc65f849f2b5390918dd09bcf6823c96f8da1f03e992fd14d0793d48b69c715be66ab6d6919
SSDEEP 3072:RFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:RFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B1847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecwurmjhbw.exe

Path C:\Temp\ecwurmjhbw.exe
Size 376KB
SHA256 9cdbd4b04f3c42fb361f04764a67136ab549f4b6f227a3e71390cea253daa8ec
MD5 021e64703cd1243d97ae4382f36d8853
SHA1 abb6a22ded54aee0919cb2c0ab22003f2f6a707d
SHA512 bda9d2fb19a4d0b6a1de434d37848a79360bfda55cc750f70fc5095252aa2d94e3e4b52eb6848210f89218589f11ff680d2699274964f7346657625bb3d2d7b9
SSDEEP 3072:aAFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLt:XFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T14E847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gebwqoigby.sys

Path C:\Temp\gebwqoigby.sys
Size 293KB
SHA256 aeb111e72dfe0e13b38480037bc77e8b0191b83cd624e0d5d585d983b568c73e
MD5 6af360338f367a1de3ef062f68252969
SHA1 c3b446e260a20afb04e70ab2787729df09c504ab
SHA512 f2c0d9644fbc6d98f91ad793149f943078c328f62cbec434ea74ef61783add800278ebb4d396033b2b2f7dd7a68bcd9b17219356cbd5f1636adf43b4dca46552
SSDEEP 3072:dtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:dIJjiJcbI03GBc3ucY5DCSj
TLSH
T158545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hbzwromjhb.sys

Path C:\Temp\hbzwromjhb.sys
Size 293KB
SHA256 31053128e03b9baa1b75756f905f0c2a20c29e64d29dcb03067e20ba3f29eebb
MD5 49fe47637f79da8c7ce77b2f56bb04cb
SHA1 4ef5f82c2c5bd924fdb99dbb103b5297f41fe0f2
SHA512 b735d2446c628d80519987f9b00f48a4b38a29c15293306dc18f01d74f82786a0b03472ef2ff80070134e9817060e8049d634a63aca0dd5414c7c34ea34bff5b
SSDEEP 3072:8tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:8IJjiJcbI03GBc3ucY5DCSj
TLSH
T130545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hecwupmecw.exe

Path C:\Temp\hecwupmecw.exe
Size 376KB
SHA256 d383c25d5f84dbdf6c04bb06b4701388ceb970bded209b50607e24e24a29f835
MD5 93a44eecf631bcb0758c2fe33fb1fb78
SHA1 2164af71b0c78d664df480d233a71145ca5f3a3f
SHA512 442001b9e3a246b1d2ed24a1f73356e4dc8757054acc344900a13e0cc13a115c547d75ba0848200dae9ee454bcb3e80cc91a41a7ef238a70992d7024a6f6847c
SSDEEP 3072:VFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:VFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T149847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ebwtqligey.exe

Path C:\Temp\i_ebwtqligey.exe
Size 376KB
SHA256 a8ffac22fd91282fb5cd8c2c9ffb538a7a050aba61225c8950bca3ddd851f1c3
MD5 dfa10e5f0f98cea9dcaf683e1e590e79
SHA1 c7edf8cfdbbcca9ecc2572e9f8a8e0a2e72140d5
SHA512 efde480273f9cb4595c81e27d18eb22f868b43ff2366246d1f1776d6a5e04f65764b50caa3d4cf0b2c78b8c2b3e64ee055233d6e70375844be5ff71af85c53cd
SSDEEP 3072:dFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:dFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T143847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ecwurmjhbw.exe

Path C:\Temp\i_ecwurmjhbw.exe
Size 376KB
SHA256 53927dbc7728e47465d0f6c34086042d48148d27ca27f6ad5fbb0a4281bcc36d
MD5 c199adbb1feb583916ef4c016f917c30
SHA1 0d2223654c88a8019e39976fa1e734398aef32d0
SHA512 005a7de457a6b652d2f0fda1acdc1f91b2a8c84c73f6c3ce95d81ff2e0f96ddf1490dfdb3d603b4d23f8012308b02ddf54a75df95016d601baf580d53c87c8af
SSDEEP 3072:gFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:gFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T10E847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hecwupmecw.exe

Path C:\Temp\i_hecwupmecw.exe
Size 376KB
SHA256 c811fe08c17e34fd92c122abd0a69e7320a3161242f0aba4c5be353df9eb217e
MD5 06ddab0a3b9dbba6ae45a90807809bfb
SHA1 67c68706cb385549489c6901086bb8b34ceec593
SHA512 482b4901a98b1c8c8f07352058f29263646463c0402bf28fe751c89ba0886f6c1b8a6df1dde7447804228d85879453d69afc86f456cfe6bdb29e8c87a0616e2f
SSDEEP 3072:7FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:7FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T151847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nhfcxvpnhf.exe

Path C:\Temp\i_nhfcxvpnhf.exe
Size 376KB
SHA256 af0370034aef2953f2cf368880fccd6f27bd4d15de6717090187632fa489a192
MD5 863bb383825754afca3f23d8c3570621
SHA1 4f1de408b45dac7ad2a2f624e5200ce63f251f44
SHA512 2fbf89652da70a5a356bc962933269613e3ba53a03e5f2cc7fd23e482e31f8bfea268e360be7b03740871d8186feb88cf922230fc523af8b5b389a6bafc8adeb
SSDEEP 3072:8FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:8FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T101847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zwqomgeywt.exe

Path C:\Temp\i_zwqomgeywt.exe
Size 376KB
SHA256 bae45d975dd8e367a8472639080e842a787e84ca2d7dfc24659f84e520a5fbf2
MD5 ce3c1d84fb204c48cb0ff54ed4649c4f
SHA1 efdcc0e2e44e814f836538d8c2c7a743b8fea1b4
SHA512 84063f4f43ce2a2d0f188458c7723daabce98ab796eb6592af2243d7c2f5f066cd114cb9e288a195dd86c089247f35fd7464acb0e81e2b291daa09b3f93d23c2
SSDEEP 3072:nFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:nFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T162847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igaytqlidb.sys

Path C:\Temp\igaytqlidb.sys
Size 293KB
SHA256 552ccafd7012fb914ad114fa9f03c1bc04d0b6efc39f4ba8f48c4a1e5a036628
MD5 7818506308c8b9d643816f6fb4a54bb4
SHA1 8fb707c72b396e7475b32b4e4209570d8413e23c
SHA512 e74cf354668e6ea88f8fcbf6f506d7d07270cab9710d3a41683dd6007aaf9a13842619102fa0996c3b8787374967ef61a98773035fd23fc87fb862b63bf6fa15
SSDEEP 3072:xtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:xIJjiJcbI03GBc3ucY5DCSj
TLSH
T1D5545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kebztrpmhe.sys

Path C:\Temp\kebztrpmhe.sys
Size 293KB
SHA256 90e278599f18c9503ef2facac80c9fe8f211fa37b530e7c6a882aca88fdd9046
MD5 fc1dfcc0d7b825ff47e33a6ee7bbc090
SHA1 2780f3c61a250ad86fa2fada462c5c449fea848e
SHA512 c9055f7b2c8cf0234c47bbec8746f81f2c6738a03cc65919accf86c9bf15ad9993aef1440d1295284235fa6be443537c3cc8754d7ed91ba1a595897d445393e5
SSDEEP 3072:YtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:YIJjiJcbI03GBc3ucY5DCSj
TLSH
T19E545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kfcxvpnhfausmkfc.exe

Path C:\Temp\kfcxvpnhfausmkfc.exe
Size 376KB
SHA256 d069d503645d377986f2d105de486cb3309442d012565650a9abb0818e71ef13
MD5 2b74625973e4e785d8073812ae04ab81
SHA1 7219e66ebf2fc2e68ee2a724d797d1c2ef4647ee
SHA512 69050666d86ec532d78a22ab4b0ac8f51e93ac55fb4b92edb13af3d170c33f49af2784c06e2b0974c157e6b9d93cc33a2ba5b1138f6067ce7fbfc40aafe83bd7
SSDEEP 3072:BFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:BFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T148847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kfcxvpnhfausmkfc.sys

Path C:\Temp\kfcxvpnhfausmkfc.sys
Size 293KB
SHA256 8a3701df5b3cc5263464b489fdd9956de912922689f74d62daadfa14d394cc00
MD5 146277e98d7316e32c58e4f801375ed8
SHA1 412408876e28f7d927be60df005224e3c327334d
SHA512 7b0e6493ce2df0545b956733484df0f3910a25f4faaef28cda019083237e7fc066a176fb2299fad8c81fd7d8c5a8e6746700dc047a9b843e8bbbb6101c4191e6
SSDEEP 3072:HtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:HIJjiJcbI03GBc3ucY5DCSj
TLSH
T13A545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nhfcxvpnhf.exe

Path C:\Temp\nhfcxvpnhf.exe
Size 376KB
SHA256 bfb2e93f482278f26cab2f6219ca79c3aa45207b6a6fe6f2d370710cbb78cb41
MD5 754ef9629ff0b3a6612bf12fc7229916
SHA1 bd2444f01b7a2b10df26d7e592212b0ab5468b3c
SHA512 3a97970c20613d7151881222edc56425dd127f3afc92f342354d3ad7499d06c7db2d3c1bfce0b10df69717bcc130e055a3e3c6d25959791f4e8527575318603a
SSDEEP 3072:MFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:MFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E8847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpkhczurmk.sys

Path C:\Temp\rpkhczurmk.sys
Size 293KB
SHA256 26abb162ca589aa6b166e9cc7b5743538516348f0dce0ed4b46d7b103337a8cb
MD5 ce93f6f373a436a4167026bd7e33f14c
SHA1 84926834d59765953762494bd9d5c0534cc82366
SHA512 b5e39f3ba1f484b8c7885abadf3f7aa4401b3ebd54432ff7500c272db5a74f86720d6e0a91a54b89e771eb85925be2c2ce3bd39e29a5b80b0286ba7b49b1b7f2
SSDEEP 3072:dtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:dIJjiJcbI03GBc3ucY5DCSj
TLSH
T11B545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zwqomgeywt.exe

Path C:\Temp\zwqomgeywt.exe
Size 376KB
SHA256 5fd26e52f2e250e499e434ffc1326b67d4ada4490f1c5620e4fdab6f5c290e76
MD5 c48b9503e24e30f17e425c7fedd5c534
SHA1 9e0de6c0be6f5501763e983dea79311bd6692f32
SHA512 9e2c2248b79e9c504ceb97ea77c00ea01dd75a56cff02e102b442a4ebf48022a494f9bbd0d422269c3037bd8981b44b76f5a4e288690942cdba02d4ed9b79e26
SSDEEP 3072:wFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:wFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1AE847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0bd6ca2228c912f995aff5415073322cd030d7e7e1da1659b598881e0d73fc7d
MD5 4b549f1316b130127a4ab2ca19458d88
SHA1 2f97e8d06ff61f68640c0f7fd7dd603b94108a61
SHA512 4da0ed36e235275a62749a2599c258bb7c0140f5a925ebf741c6120cb9b59d08564757565bdbf706485b5bafa7c3c0c7b69274329ba9712607cdc2552efc4f20
TLSH
T1326172B7A32906DAEB20C53190E5846835F4CA4DC24FBE9EC0ED5DFAA406F0552F281F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe594a0f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe594a0f.TMP
Size 3KB
SHA256 ee85a48752106dfdfcc3808ff06a6d72dae8753e4a3b5f3d4b0129c8d66a35df
MD5 dfa892d73308692f7613727c83fe7b3a
SHA1 313196cacfbc157c7c90589928ba03e5cc54979c
SHA512 cd910405be6767b8c51157f35561e7b0e1e963fb76145131c5e917bae641275d02fa6b72b22b4071926b51075515d4d2db62918ef3bd312c01353c4c0ddab347
TLSH
T1626183B7A32906D9EB20C53190E5846835F4CA4DC24FBE9EC0ED5DFAA406F0552F281F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7539ad22-137f-49bd-b079-da19dbe6c394.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\7539ad22-137f-49bd-b079-da19dbe6c394.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 27ab06357072bbbc113019661936abcedbe9d14f293f6c9e349d4ba57d0a8748
MD5 f2c0c9a17d80c06f8e2018c4e5f7799d
SHA1 c2ebd8eda37485e0a11d0b88463ed78f49f7ee16
SHA512 fda13acddcd957388af98c142dd302e760a978e4220f0c975afe75e59380a7395cb24bed60e23723a9465f71fa156a3b5a65a05bab2c4fc9f2663845f869bf47
TLSH
T108419EF7C3F4856E890196F0AA14AE1FDE2C0915432C7D5AC9E4AE2B93F3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 38e321c12236502e88d51ef4d3e2b36afbeaba2e4307d5005394cc9a503f9b04
MD5 3d0e13f9036ac03aadeb59bcfc13c823
SHA1 74bf7318203519a997b5555b1aebf718e1c6283b
SHA512 c6ed5b9b6ac0b6b2cc1eadf91f9c1c6e7caab8f714aa3f5158f900eedb0b940194db19b8cd406c22314839100d1a907359091eea72556cb7d31cea25d83dd3ef
SSDEEP 192:sxR3RXC5/fgsabi5ZR0d3dzoA8p94/g6+WNCmA/YoFSCYsGOIgVAJ:sxR3g5/fgsabiXR+3QK/5M/TlG
TLSH
T15942B7156D28AD3B8CC7E21DBB25BF53E3F9503260D05E48AAFD961C05E6ADD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 f86fdd8496e4ebcd5abb833b79cdaf55ef4930e8f160fe689586eb279a26f1ad
MD5 91c50ccabb695d71c99c5819173e51fd
SHA1 22a786ebdbd05d4fcb5bcb6634721e6de008e43f
SHA512 1090a5ec55c2442f8d7fcf99a8478181f266c667d7d08f855134403e3401098a40c9c799cc53d7e4f5c51dba80219057a547ce853523c15ac60210559f8c54c4
SSDEEP 192:sxRsRXC5/fgsPbi5ZR0d3dzoA8p94/g6+WNCmA/YoFSCYsGOIgDeAJ:sxRsg5/fgsPbiXR+3QK/5M/TlX
TLSH
T14442B815AD28AD3B8CC7E21DBB15BF53E3F9507260D05E48AAFD961C05E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 a861355bbb4d409b11e9dd60e414f609b8b8e57a46a7c52a4f080a63de725d05
MD5 ce4845b8aa697efb9eaf607ba03fe71a
SHA1 214fb4a75493259e7d8616cce98a7628935cefd6
SHA512 63beb9550fde6839fa379f8deaa19b240e76c86d52b90bb61a145eadb09af48f4bbc78367a5f774632e41797b13ec0a420dfaf6eb6e9be261b528ca23678222e
SSDEEP 192:sxRsRXC5/fgsPbG5ZR0d3dzoA8p94/g6+WNCmA/Yo10CYsGOIgDEAJ:sxRsg5/fgsPbGXR+3QK/5M/plh
TLSH
T1EE42C815AD28AD3B9CC7E21DBB15BF53E3F9507260D05E48AAFD961C01E7ADD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 c42f42fbe7540df234a14ddf6c888d46c75c7821249c8e438b2ef0bf74057b0e
MD5 33643b159361ae9c8e38582a935f356a
SHA1 aaaef6d0edf07ffb5972b62d80d03694cf1040fa
SHA512 73caee86bfc02a8d4e588814e54976399e394580d9005236d27691730952cf497dadc2fceac35a2ae8a6ef208aeac0cd24f69e339de4cd737e89e32dae124075
SSDEEP 768:j26H+o7pLuL7MRWgs2f028F1+UoAYDCx9Tuqh0VfUC9xbog/OVCdBVuwzro9pe0b:j26H+UE7MRWgs2f02u1jatdB4wAgQ
TLSH
T16AD2DA7B740DCABE4F800ADDEC197E9F6D6802CB9698CD8047FE941C02C6BEA51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 56c434e2e0943e6c46a31b61fc00a5194f6ed30b14902bc6232e048963e7a17a
MD5 da0a1cfb8cfcb4c9731be9167b1aa368
SHA1 f439d7646399c66c0c43ad6920b7969efafb478f
SHA512 2843e008e7a14b6db0bb5040022a55ee34be0e46978b74308b3eb987c50b5063edfcc1bde90be3c448bc2a51b29bb171ac176abb20b0039d24485d5ad4beb6ed
SSDEEP 768:pC3ULy4U/TBOWBbatEONXyer1IRCzni9bPi9PTQ:pC3U2XpSIqnMPUQ
TLSH
T10EF2BF70E5A99D234CE6F396B2463343BFF86067D5C45A44EEDA9B1E098361E130B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 41ebb9eff882756e230a86679d387196ba67a91ce395e9c3144609864e041c70
MD5 f6c06eabb0cc93e10f5f11ba8e8e8984
SHA1 f712014eb72b15d9736483281f3b5476f9e6f5d2
SHA512 809fab73893653401713a86dd41d9b6b7e1ff89e44bd1cdb95dc86a7a9562a37c0936ae991c2c0a608cedd42449e0689e4b5937111825c2b74a8ae081e78a26e
SSDEEP 768:+FHT3GwgYLyrXpsOWBbat5ONXyer1IRCzni9bPi9PTQ:yT3X2TzSIqnMPUQ
TLSH
T1531328F194D79937D8AEA787A33D2E46AEBCD063B5844580BBD55E0DCC8217FC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 12ab9bd97460e6b1446c33aae3a83ec7ac9c86b6c0f2d6b3f130c5ef49be6f80
MD5 e7716d4b10a71e173d6a508eb2fbba15
SHA1 9d58815da44d0f85558b37ff4783d2272bc39f48
SHA512 97ef635cb934a98a002d245ae7281359ba1f895d31e4ee205b6c10e2775c61919882e129685d94894581fae1169296246ba7d8c92b88895401203a68966f08c2
SSDEEP 768:hrv+4UNbdz3X6/TBOWBoONXyer1IRCzniB7eVH1SK7:hbsbV3qESIqnsEH1l
TLSH
T12803BF32A4A89E338DE2A3C5B14776137FF86057D6800790EDDE2F4E069B59E130B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 09741acb1c3d06e43ff53346049cdbe3363c986b6c9e8316c81ba42fab5f3820
MD5 284e99982b034281745038e2766a0942
SHA1 2b994b6601b126aa5cbeeb734369fb59603fdbb8
SHA512 313e5bece85863c3743496ab9d979513b4aea58b0181eb1de01e45be95534803cbf6bb81c5b6b39cb724d37cc8a53e0e1acb8a58feef3eebd56d3a2f48c2f686
SSDEEP 768:sC3dLy4U/TBOWBbat1ONXyer1IRCzni9bPi9PTQ:sC3d2XeSIqnMPUQ
TLSH
T194F2BF70E5A99D234CE6F3D6B1563343BFF85067D5C44A44EEDA9B1D058361E130B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 2e629379a97e86c9774c22fd9b81bbf7312bc1ea29b327e72283ac82ff312fac
MD5 8c57306d414735a9b0c5af4152741cf0
SHA1 75bf92db8bf3ca5705560e2ddf5d90a69b5378c8
SHA512 d418341b56d683f0421051506375c8ae1a27a7e36f885c37837afa8e29505fc262ea5f4a2b675faa5dbbb5bec77568604940a91b26368e054f5aa8bc378ba510
SSDEEP 768:brv+4UNbdz3pm/TBOWBbathONXyer1IRCzniwbeVH1SK7:bbsbV3kuSIqn/EH1l
TLSH
T1CF03BF31A1A9DE334DE2B396B14773537FB8206789800B90EDDA1F5E069759E230F91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 af1d5e024cc0ec8ab9340df7e6091de2dd995b9b7107ec32873da970209b59da
MD5 c00cb569087949bb1f2b70b4b0d0a6b6
SHA1 0f7d282b140404a19b89eaa3f040d4d206b3fb35
SHA512 b2be9b6dc6a1540ea37fd712ca12cc94ef5a5008e1625aa7d89c6e666fdf8f0f826352e8130283d96199d2620fd02096336f56e44bdd81f5ebf5c89f75405f2a
SSDEEP 768:IC3ELy4U/TBOWBbat1ONXyer1IRCzni9bPi9PTQ:IC3E2XeSIqnMPUQ
TLSH
T11CF2BF70E5A99D234CE6F3D6B2563343BFF85063D5C44A44EEDA9B1D098361E130B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

f633a0ba-bbe4-4c05-8d5d-c8d0e12800b5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f633a0ba-bbe4-4c05-8d5d-c8d0e12800b5.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4260_415318635\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 57eec07f97409ea583aeb9c42ffbb113b517371aa6439fc1b1f4658c870f8afe
MD5 ef71bfa0857e18b70cdeb5aeb13534a4
SHA1 4580b666d69fd26ed73091cd6663b45aabb6051f
SHA512 f99cf0e972b929b8c9a4ab84a31a490390bfc60231d84f51b2a4e5514c774ff0fb3235c299ec05db3c6d72e43a0df6d2f70c519420be128e426e4603eb5205ba
TLSH
T16471238357ADC5F3C2DE5BF003835684F5FB627C072330614B625586AB34A3A54B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1188-264-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1256-420-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1488-236-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1960-431-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2716-375-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3476-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3552-363-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3572-305-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4084-277-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4344-388-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4560-435-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4564-354-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4680-426-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4896-334-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4968-318-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5464-396-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5756-189-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5760-416-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5760-422-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6132-320-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6132-314-0x0000000000010000-0x00000000000AB000-memory.dmp

Download