systex | c3d544faffa38a294c977d418df444d5227266625398a4e33f1715113834f117

Analysis

max time kernel
150s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 17:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_91db159afffa917889c5625859eb38a9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Size 376KB
Sample260816-vzh9psshna
SHA256 c3d544faffa38a294c977d418df444d5227266625398a4e33f1715113834f117
MD5 91db159afffa917889c5625859eb38a9
SHA1 fadde57c063f8210bbb0e292ba4541df6690745f
SHA512 63e53e88ad713febc6c6e34443a6e89a8c0c8732fbfb6959d6f3d3b89fd929bac4167fa81f1a6b94e34b0976588227bc0b5c761aaa1cf2200bbae80310d30e3e
SSDEEP 3072:xFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:xFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T182847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
2396	bztrljebwtrmjebw.exe
6336	bztrljebwtrmjebw.sys
6728	CreateProcess.exe
3752	jebzurojhb.exe
124	CreateProcess.exe
1120	CreateProcess.exe
2068	i_jebzurojhb.exe
4508	eywqomjebw.sys
4856	CreateProcess.exe
5256	wtomgeywto.exe
3972	CreateProcess.exe
4684	CreateProcess.exe
3700	i_wtomgeywto.exe
2624	wqolgeywto.sys
1372	CreateProcess.exe
2384	idbvtnlgdb.exe
7072	CreateProcess.exe
5552	CreateProcess.exe
5480	i_idbvtnlgdb.exe
2756	bvtnlfdyvt.sys
2764	CreateProcess.exe
3028	vtqoigaytq.exe
4756	CreateProcess.exe
6232	CreateProcess.exe
4564	i_vtqoigaytq.exe
3324	igdyvqnida.sys
1216	CreateProcess.exe
3140	gaysqniday.exe
7036	CreateProcess.exe
2828	CreateProcess.exe
7028	i_gaysqniday.exe
4396	kicaxsqkic.sys
5336	CreateProcess.exe
4184	icausnkfdx.exe
6944	CreateProcess.exe
4556	CreateProcess.exe
6392	i_icausnkfdx.exe
6416	fzxspkhfzx.sys
1384	CreateProcess.exe
6064	xupnhczusm.exe
5620	CreateProcess.exe
6136	CreateProcess.exe
1188	i_xupnhczusm.exe
1692	zxuspjhfca.sys
6384	CreateProcess.exe
6292	fzxrpmhfcw.exe
1444	CreateProcess.exe
1880	CreateProcess.exe
3164	i_fzxrpmhfcw.exe
2912	bzxrpjebzu.sys
4144	CreateProcess.exe
4792	urpjhbzurm.exe
3976	CreateProcess.exe
5296	CreateProcess.exe
2756	i_urpjhbzurm.exe
5972	mgeywtrljg.sys
6532	CreateProcess.exe
2932	rljdbwtomj.exe
3380	CreateProcess.exe
5380	CreateProcess.exe
3384	i_rljdbwtomj.exe
5860	ljgbztolgd.sys
4772	CreateProcess.exe
6032	eywqoigbyt.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywqoigbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtqljdbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrljebwtrmjebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtqoigaytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xupnhczusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urpjhbzurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpjhfzuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtomgeywto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_idbvtnlgdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtqoigaytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaysqniday.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icausnkfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxrpmhfcw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urpjhbzurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljdbwtomj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cxvpnhfzxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hczxupnhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgeywurpjg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxrpmhfcw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtqljdbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkidavtnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifdxvsnkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpjhfzuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jeywqoigby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljdbwtomj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_91db159afffa917889c5625859eb38a9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	idbvtnlgdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icausnkfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hczxupnhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgeywurpjg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jebzurojhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jebzurojhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywqoigbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkidavtnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifdxvsnkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtomgeywto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gaysqniday.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jeywqoigby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xupnhczusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxvpnhfzxs.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4204	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5092	ipconfig.exe
3396	ipconfig.exe
3276	ipconfig.exe
2640	ipconfig.exe
3396	ipconfig.exe
6336	ipconfig.exe
5816	ipconfig.exe
6000	ipconfig.exe
5468	ipconfig.exe
7020	ipconfig.exe
1840	ipconfig.exe
1092	ipconfig.exe
5556	ipconfig.exe
5816	ipconfig.exe
2316	ipconfig.exe
6432	ipconfig.exe
3544	ipconfig.exe
4932	ipconfig.exe
6088	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134313747439754391"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{BF8DE5CF-5031-4D1F-95E5-9CA6AA8618EA}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4724	2026-08-16_91db159afffa917889c5625859eb38a9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4724	2026-08-16_91db159afffa917889c5625859eb38a9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4724	2026-08-16_91db159afffa917889c5625859eb38a9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4724	2026-08-16_91db159afffa917889c5625859eb38a9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4724	2026-08-16_91db159afffa917889c5625859eb38a9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4724	2026-08-16_91db159afffa917889c5625859eb38a9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4724	2026-08-16_91db159afffa917889c5625859eb38a9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4724	2026-08-16_91db159afffa917889c5625859eb38a9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4724	2026-08-16_91db159afffa917889c5625859eb38a9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4724	2026-08-16_91db159afffa917889c5625859eb38a9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4724	2026-08-16_91db159afffa917889c5625859eb38a9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4724	2026-08-16_91db159afffa917889c5625859eb38a9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4724	2026-08-16_91db159afffa917889c5625859eb38a9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4724	2026-08-16_91db159afffa917889c5625859eb38a9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4724	2026-08-16_91db159afffa917889c5625859eb38a9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4724	2026-08-16_91db159afffa917889c5625859eb38a9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4724	2026-08-16_91db159afffa917889c5625859eb38a9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4724	2026-08-16_91db159afffa917889c5625859eb38a9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4724	2026-08-16_91db159afffa917889c5625859eb38a9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4724	2026-08-16_91db159afffa917889c5625859eb38a9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4724	2026-08-16_91db159afffa917889c5625859eb38a9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4724	2026-08-16_91db159afffa917889c5625859eb38a9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4724	2026-08-16_91db159afffa917889c5625859eb38a9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4724	2026-08-16_91db159afffa917889c5625859eb38a9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4724	2026-08-16_91db159afffa917889c5625859eb38a9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4724	2026-08-16_91db159afffa917889c5625859eb38a9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4724	2026-08-16_91db159afffa917889c5625859eb38a9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4724	2026-08-16_91db159afffa917889c5625859eb38a9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4724	2026-08-16_91db159afffa917889c5625859eb38a9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4724	2026-08-16_91db159afffa917889c5625859eb38a9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4724	2026-08-16_91db159afffa917889c5625859eb38a9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4724	2026-08-16_91db159afffa917889c5625859eb38a9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4724	2026-08-16_91db159afffa917889c5625859eb38a9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4724	2026-08-16_91db159afffa917889c5625859eb38a9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4724	2026-08-16_91db159afffa917889c5625859eb38a9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4724	2026-08-16_91db159afffa917889c5625859eb38a9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4724	2026-08-16_91db159afffa917889c5625859eb38a9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4724	2026-08-16_91db159afffa917889c5625859eb38a9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4724	2026-08-16_91db159afffa917889c5625859eb38a9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4724	2026-08-16_91db159afffa917889c5625859eb38a9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4724	2026-08-16_91db159afffa917889c5625859eb38a9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4724	2026-08-16_91db159afffa917889c5625859eb38a9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4724	2026-08-16_91db159afffa917889c5625859eb38a9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4724	2026-08-16_91db159afffa917889c5625859eb38a9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4724	2026-08-16_91db159afffa917889c5625859eb38a9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4724	2026-08-16_91db159afffa917889c5625859eb38a9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4724	2026-08-16_91db159afffa917889c5625859eb38a9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4724	2026-08-16_91db159afffa917889c5625859eb38a9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4724	2026-08-16_91db159afffa917889c5625859eb38a9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4724	2026-08-16_91db159afffa917889c5625859eb38a9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4724	2026-08-16_91db159afffa917889c5625859eb38a9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4724	2026-08-16_91db159afffa917889c5625859eb38a9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4724	2026-08-16_91db159afffa917889c5625859eb38a9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4724	2026-08-16_91db159afffa917889c5625859eb38a9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4724	2026-08-16_91db159afffa917889c5625859eb38a9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4724	2026-08-16_91db159afffa917889c5625859eb38a9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2396	bztrljebwtrmjebw.exe
2396	bztrljebwtrmjebw.exe
2396	bztrljebwtrmjebw.exe
2396	bztrljebwtrmjebw.exe
2396	bztrljebwtrmjebw.exe
2396	bztrljebwtrmjebw.exe
2396	bztrljebwtrmjebw.exe
2396	bztrljebwtrmjebw.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
2356	msedge.exe
2356	msedge.exe
2356	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	2068	i_jebzurojhb.exe
Token: SeDebugPrivilege	3700	i_wtomgeywto.exe
Token: SeDebugPrivilege	5480	i_idbvtnlgdb.exe
Token: SeDebugPrivilege	4564	i_vtqoigaytq.exe
Token: SeDebugPrivilege	7028	i_gaysqniday.exe
Token: SeDebugPrivilege	6392	i_icausnkfdx.exe
Token: SeDebugPrivilege	1188	i_xupnhczusm.exe
Token: SeDebugPrivilege	3164	i_fzxrpmhfcw.exe
Token: SeDebugPrivilege	2756	i_urpjhbzurm.exe
Token: SeDebugPrivilege	3384	i_rljdbwtomj.exe
Token: SeDebugPrivilege	5824	i_eywqoigbyt.exe
Token: SeDebugPrivilege	4652	i_vtqljdbvtn.exe
Token: SeDebugPrivilege	6512	i_qkidavtnlf.exe
Token: SeDebugPrivilege	2488	i_ifdxvsnkic.exe
Token: SeDebugPrivilege	2924	i_cxvpnhfzxs.exe
Token: SeDebugPrivilege	6264	i_hczxupnhfz.exe
Token: SeDebugPrivilege	5632	i_xrpjhfzuom.exe
Token: SeDebugPrivilege	628	i_mgeywurpjg.exe
Token: SeDebugPrivilege	5548	i_jeywqoigby.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2356	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4724 wrote to memory of 2396	4724	2026-08-16_91db159afffa917889c5625859eb38a9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 4724 wrote to memory of 2052	4724	2026-08-16_91db159afffa917889c5625859eb38a9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 2052 wrote to memory of 2356	2052	iexplore.exe	91
PID 2356 wrote to memory of 4840	2356	msedge.exe	92
PID 2356 wrote to memory of 5352	2356	msedge.exe	94
PID 2356 wrote to memory of 4204	2356	msedge.exe	95
PID 2356 wrote to memory of 5352	2356	msedge.exe	94
PID 2356 wrote to memory of 5352	2356	msedge.exe	94
PID 2356 wrote to memory of 3884	2356	msedge.exe	96
PID 2356 wrote to memory of 3884	2356	msedge.exe	96
PID 2356 wrote to memory of 4892	2356	msedge.exe	97
PID 2356 wrote to memory of 4892	2356	msedge.exe	97
PID 2356 wrote to memory of 2644	2356	msedge.exe	98
PID 2356 wrote to memory of 4892	2356	msedge.exe	97
PID 2356 wrote to memory of 2644	2356	msedge.exe	98
PID 2356 wrote to memory of 2644	2356	msedge.exe	98
PID 2356 wrote to memory of 3512	2356	msedge.exe	101
PID 2356 wrote to memory of 5088	2356	msedge.exe	102
PID 2356 wrote to memory of 3512	2356	msedge.exe	101
PID 2356 wrote to memory of 5088	2356	msedge.exe	102
PID 2396 wrote to memory of 6728	2396	bztrljebwtrmjebw.exe	103
PID 2356 wrote to memory of 236	2356	msedge.exe	107
PID 3752 wrote to memory of 124	3752	jebzurojhb.exe	108
PID 2396 wrote to memory of 1120	2396	bztrljebwtrmjebw.exe	113
PID 2396 wrote to memory of 4856	2396	bztrljebwtrmjebw.exe	117
PID 5256 wrote to memory of 3972	5256	wtomgeywto.exe	119
PID 2396 wrote to memory of 4684	2396	bztrljebwtrmjebw.exe	122
PID 2396 wrote to memory of 1372	2396	bztrljebwtrmjebw.exe	126
PID 2384 wrote to memory of 7072	2384	idbvtnlgdb.exe	128
PID 2396 wrote to memory of 5552	2396	bztrljebwtrmjebw.exe	131
PID 2396 wrote to memory of 2764	2396	bztrljebwtrmjebw.exe	136
PID 3028 wrote to memory of 4756	3028	vtqoigaytq.exe	138
PID 2396 wrote to memory of 6232	2396	bztrljebwtrmjebw.exe	141
PID 2356 wrote to memory of 2928	2356	msedge.exe	143
PID 2356 wrote to memory of 5896	2356	msedge.exe	144
PID 2356 wrote to memory of 4708	2356	msedge.exe	145
PID 2396 wrote to memory of 1216	2396	bztrljebwtrmjebw.exe	148
PID 3140 wrote to memory of 7036	3140	gaysqniday.exe	150
PID 2396 wrote to memory of 2828	2396	bztrljebwtrmjebw.exe	153
PID 2396 wrote to memory of 5336	2396	bztrljebwtrmjebw.exe	157
PID 4184 wrote to memory of 6944	4184	icausnkfdx.exe	159
PID 2396 wrote to memory of 4556	2396	bztrljebwtrmjebw.exe	162
PID 2396 wrote to memory of 1384	2396	bztrljebwtrmjebw.exe	166
PID 6064 wrote to memory of 5620	6064	xupnhczusm.exe	168
PID 2396 wrote to memory of 6136	2396	bztrljebwtrmjebw.exe	171
PID 2396 wrote to memory of 6384	2396	bztrljebwtrmjebw.exe	175
PID 6292 wrote to memory of 1444	6292	fzxrpmhfcw.exe	177
PID 2396 wrote to memory of 1880	2396	bztrljebwtrmjebw.exe	180
PID 2356 wrote to memory of 6724	2356	msedge.exe	182
PID 2356 wrote to memory of 6724	2356	msedge.exe	182
PID 2396 wrote to memory of 4144	2396	bztrljebwtrmjebw.exe	187
PID 4792 wrote to memory of 3976	4792	urpjhbzurm.exe	189
PID 2396 wrote to memory of 5296	2396	bztrljebwtrmjebw.exe	192
PID 2396 wrote to memory of 6532	2396	bztrljebwtrmjebw.exe	196
PID 2932 wrote to memory of 3380	2932	rljdbwtomj.exe	198
PID 2396 wrote to memory of 5380	2396	bztrljebwtrmjebw.exe	201
PID 2396 wrote to memory of 4772	2396	bztrljebwtrmjebw.exe	205
PID 6032 wrote to memory of 1304	6032	eywqoigbyt.exe	207
PID 2396 wrote to memory of 6620	2396	bztrljebwtrmjebw.exe	210
PID 2396 wrote to memory of 6684	2396	bztrljebwtrmjebw.exe	214
PID 5068 wrote to memory of 2392	5068	vtqljdbvtn.exe	216
PID 2396 wrote to memory of 7028	2396	bztrljebwtrmjebw.exe	219
PID 2396 wrote to memory of 248	2396	bztrljebwtrmjebw.exe	223
PID 6676 wrote to memory of 3624	6676	qkidavtnlf.exe	225

C:\Users\Admin\AppData\Local\Temp\2026-08-16_91db159afffa917889c5625859eb38a9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_91db159afffa917889c5625859eb38a9_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4724
- C:\Temp\bztrljebwtrmjebw.exe
  C:\Temp\bztrljebwtrmjebw.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2396
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jebzurojhb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6728
  - - C:\Temp\jebzurojhb.exe
      C:\Temp\jebzurojhb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3752
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:124
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2316
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jebzurojhb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1120
  - - C:\Temp\i_jebzurojhb.exe
      C:\Temp\i_jebzurojhb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2068
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wtomgeywto.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4856
  - - C:\Temp\wtomgeywto.exe
      C:\Temp\wtomgeywto.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5256
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3972
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5468
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wtomgeywto.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4684
  - - C:\Temp\i_wtomgeywto.exe
      C:\Temp\i_wtomgeywto.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3700
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\idbvtnlgdb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1372
  - - C:\Temp\idbvtnlgdb.exe
      C:\Temp\idbvtnlgdb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2384
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:7072
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3396
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_idbvtnlgdb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5552
  - - C:\Temp\i_idbvtnlgdb.exe
      C:\Temp\i_idbvtnlgdb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5480
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtqoigaytq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2764
  - - C:\Temp\vtqoigaytq.exe
      C:\Temp\vtqoigaytq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3028
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4756
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1092
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtqoigaytq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6232
  - - C:\Temp\i_vtqoigaytq.exe
      C:\Temp\i_vtqoigaytq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4564
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gaysqniday.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1216
  - - C:\Temp\gaysqniday.exe
      C:\Temp\gaysqniday.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3140
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:7036
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3276
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gaysqniday.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2828
  - - C:\Temp\i_gaysqniday.exe
      C:\Temp\i_gaysqniday.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:7028
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\icausnkfdx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5336
  - - C:\Temp\icausnkfdx.exe
      C:\Temp\icausnkfdx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4184
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6944
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5556
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_icausnkfdx.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4556
  - - C:\Temp\i_icausnkfdx.exe
      C:\Temp\i_icausnkfdx.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6392
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xupnhczusm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1384
  - - C:\Temp\xupnhczusm.exe
      C:\Temp\xupnhczusm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6064
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5620
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2640
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xupnhczusm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6136
  - - C:\Temp\i_xupnhczusm.exe
      C:\Temp\i_xupnhczusm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1188
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fzxrpmhfcw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6384
  - - C:\Temp\fzxrpmhfcw.exe
      C:\Temp\fzxrpmhfcw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6292
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1444
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5816
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fzxrpmhfcw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1880
  - - C:\Temp\i_fzxrpmhfcw.exe
      C:\Temp\i_fzxrpmhfcw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3164
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\urpjhbzurm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4144
  - - C:\Temp\urpjhbzurm.exe
      C:\Temp\urpjhbzurm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4792
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3976
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3396
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_urpjhbzurm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5296
  - - C:\Temp\i_urpjhbzurm.exe
      C:\Temp\i_urpjhbzurm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2756
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rljdbwtomj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6532
  - - C:\Temp\rljdbwtomj.exe
      C:\Temp\rljdbwtomj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2932
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3380
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:7020
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rljdbwtomj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5380
  - - C:\Temp\i_rljdbwtomj.exe
      C:\Temp\i_rljdbwtomj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3384
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\eywqoigbyt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4772
  - - C:\Temp\eywqoigbyt.exe
      C:\Temp\eywqoigbyt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6032
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1304
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6432
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_eywqoigbyt.exe ups_ins
    3⤵
    PID:6620
  - - C:\Temp\i_eywqoigbyt.exe
      C:\Temp\i_eywqoigbyt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5824
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtqljdbvtn.exe ups_run
    3⤵
    PID:6684
  - - C:\Temp\vtqljdbvtn.exe
      C:\Temp\vtqljdbvtn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5068
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2392
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6336
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtqljdbvtn.exe ups_ins
    3⤵
    PID:7028
  - - C:\Temp\i_vtqljdbvtn.exe
      C:\Temp\i_vtqljdbvtn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4652
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qkidavtnlf.exe ups_run
    3⤵
    PID:248
  - - C:\Temp\qkidavtnlf.exe
      C:\Temp\qkidavtnlf.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6676
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3624
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5092
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qkidavtnlf.exe ups_ins
    3⤵
    PID:1200
  - - C:\Temp\i_qkidavtnlf.exe
      C:\Temp\i_qkidavtnlf.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6512
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ifdxvsnkic.exe ups_run
    3⤵
    PID:5096
  - - C:\Temp\ifdxvsnkic.exe
      C:\Temp\ifdxvsnkic.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2332
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5644
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3544
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ifdxvsnkic.exe ups_ins
    3⤵
    PID:1188
  - - C:\Temp\i_ifdxvsnkic.exe
      C:\Temp\i_ifdxvsnkic.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2488
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cxvpnhfzxs.exe ups_run
    3⤵
    PID:580
  - - C:\Temp\cxvpnhfzxs.exe
      C:\Temp\cxvpnhfzxs.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:7160
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2812
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5816
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cxvpnhfzxs.exe ups_ins
    3⤵
    PID:3516
  - - C:\Temp\i_cxvpnhfzxs.exe
      C:\Temp\i_cxvpnhfzxs.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2924
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hczxupnhfz.exe ups_run
    3⤵
    PID:5992
  - - C:\Temp\hczxupnhfz.exe
      C:\Temp\hczxupnhfz.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3020
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6964
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4932
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hczxupnhfz.exe ups_ins
    3⤵
    PID:2088
  - - C:\Temp\i_hczxupnhfz.exe
      C:\Temp\i_hczxupnhfz.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6264
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xrpjhfzuom.exe ups_run
    3⤵
    PID:6324
  - - C:\Temp\xrpjhfzuom.exe
      C:\Temp\xrpjhfzuom.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5028
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5884
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6000
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xrpjhfzuom.exe ups_ins
    3⤵
    PID:2768
  - - C:\Temp\i_xrpjhfzuom.exe
      C:\Temp\i_xrpjhfzuom.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5632
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mgeywurpjg.exe ups_run
    3⤵
    PID:5896
  - - C:\Temp\mgeywurpjg.exe
      C:\Temp\mgeywurpjg.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3312
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5628
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6088
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mgeywurpjg.exe ups_ins
    3⤵
    PID:6432
  - - C:\Temp\i_mgeywurpjg.exe
      C:\Temp\i_mgeywurpjg.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:628
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jeywqoigby.exe ups_run
    3⤵
    PID:3476
  - - C:\Temp\jeywqoigby.exe
      C:\Temp\jeywqoigby.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3276
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2056
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1840
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jeywqoigby.exe ups_ins
    3⤵
    PID:7008
  - - C:\Temp\i_jeywqoigby.exe
      C:\Temp\i_jeywqoigby.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5548
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffc2000c188,0x7ffc2000c194,0x7ffc2000c1a0
      4⤵
      PID:4840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1972,i,14784850742463336803,12857632904917904115,262144 --field-trial-handle=2516,i,4819804576355220347,2065588147717914606,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:2
      4⤵
      PID:5352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2080,i,10565165974235640085,17998196805593033849,524288 --field-trial-handle=2516,i,4819804576355220347,2065588147717914606,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:11
      4⤵
      System Time Discovery
      PID:4204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2620,i,8911253170070222584,6585451196722491323,524288 --field-trial-handle=2516,i,4819804576355220347,2065588147717914606,262144 --variations-seed-version --mojo-platform-channel-handle=2936 /prefetch:13
      4⤵
      PID:3884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3508,i,7265518063157332419,5121163915886051578,2097152 --field-trial-handle=2516,i,4819804576355220347,2065588147717914606,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
      4⤵
      PID:4892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3516,i,8335155435786964193,7121112776115090535,2097152 --field-trial-handle=2516,i,4819804576355220347,2065588147717914606,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
      4⤵
      PID:2644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4980,i,15051546223411098345,1472026683824146126,524288 --field-trial-handle=2516,i,4819804576355220347,2065588147717914606,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:14
      4⤵
      PID:3512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4936,i,2848989882847208438,13831185218581179383,524288 --field-trial-handle=2516,i,4819804576355220347,2065588147717914606,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:14
      4⤵
      PID:5088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,12419910177716611477,13807402253211799706,524288 --field-trial-handle=2516,i,4819804576355220347,2065588147717914606,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:14
      4⤵
      PID:5300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,12419910177716611477,13807402253211799706,524288 --field-trial-handle=2516,i,4819804576355220347,2065588147717914606,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:14
      4⤵
      PID:236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1276,i,14503937982424814954,4390381176829725035,524288 --field-trial-handle=2516,i,4819804576355220347,2065588147717914606,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:14
      4⤵
      PID:2928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1280,i,3915662704559017615,8901505098718589591,524288 --field-trial-handle=2516,i,4819804576355220347,2065588147717914606,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:14
      4⤵
      PID:5896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1284,i,11172977401901605442,16098734281901652800,524288 --field-trial-handle=2516,i,4819804576355220347,2065588147717914606,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:14
      4⤵
      PID:4708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1416,i,2060857155231754037,3136619640222471193,524288 --field-trial-handle=2516,i,4819804576355220347,2065588147717914606,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:14
      4⤵
      PID:6724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5992,i,6126160004879794244,11036589214211579419,262144 --field-trial-handle=2516,i,4819804576355220347,2065588147717914606,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:10
      4⤵
      PID:5016

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2712

C:\Temp\bztrljebwtrmjebw.sys
C:\Temp\bztrljebwtrmjebw.sys
1⤵
- Executes dropped EXE
PID:6336

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1144

C:\Temp\eywqomjebw.sys
C:\Temp\eywqomjebw.sys
1⤵
- Executes dropped EXE
PID:4508

C:\Temp\wqolgeywto.sys
C:\Temp\wqolgeywto.sys
1⤵
- Executes dropped EXE
PID:2624

C:\Temp\bvtnlfdyvt.sys
C:\Temp\bvtnlfdyvt.sys
1⤵
- Executes dropped EXE
PID:2756

C:\Temp\igdyvqnida.sys
C:\Temp\igdyvqnida.sys
1⤵
- Executes dropped EXE
PID:3324

C:\Temp\kicaxsqkic.sys
C:\Temp\kicaxsqkic.sys
1⤵
- Executes dropped EXE
PID:4396

C:\Temp\fzxspkhfzx.sys
C:\Temp\fzxspkhfzx.sys
1⤵
- Executes dropped EXE
PID:6416

C:\Temp\zxuspjhfca.sys
C:\Temp\zxuspjhfca.sys
1⤵
- Executes dropped EXE
PID:1692

C:\Temp\bzxrpjebzu.sys
C:\Temp\bzxrpjebzu.sys
1⤵
- Executes dropped EXE
PID:2912

C:\Temp\mgeywtrljg.sys
C:\Temp\mgeywtrljg.sys
1⤵
- Executes dropped EXE
PID:5972

C:\Temp\ljgbztolgd.sys
C:\Temp\ljgbztolgd.sys
1⤵
- Executes dropped EXE
PID:5860

C:\Temp\ywqoljdbyt.sys
C:\Temp\ywqoljdbyt.sys
1⤵
PID:6468

C:\Temp\vtnigaysql.sys
C:\Temp\vtnigaysql.sys
1⤵
PID:5264

C:\Temp\ifdxvpnhfc.sys
C:\Temp\ifdxvpnhfc.sys
1⤵
PID:3456

C:\Temp\nhfaxvpnhf.sys
C:\Temp\nhfaxvpnhf.sys
1⤵
PID:4320

C:\Temp\eczxvpmkec.sys
C:\Temp\eczxvpmkec.sys
1⤵
PID:6608

C:\Temp\hbzurmkecw.sys
C:\Temp\hbzurmkecw.sys
1⤵
PID:6252

C:\Temp\rmgebwuomg.sys
C:\Temp\rmgebwuomg.sys
1⤵
PID:3424

C:\Temp\uomgeywqom.sys
C:\Temp\uomgeywqom.sys
1⤵
PID:4312

C:\Temp\geywqojgby.sys
C:\Temp\geywqojgby.sys
1⤵
PID:1520

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bvtnlfdyvt.sys

Path C:\Temp\bvtnlfdyvt.sys
Size 293KB
SHA256 a350732d29241c8418ca8ca5085454f77e575bf155a5e0b8b5e90e211299b156
MD5 0333e8287ec2d374044b9f2a66bdaf85
SHA1 97bd2f1ebeaec5bb3230a4f1e062db9e5c17858a
SHA512 0fcd03b9b0334a8bced8c0b431e93c624a8d5bbf7f120da08fb8b217009d7028fca7c16a5d9d00065b65f9fc50b037147d8285460d326277411ebc4381f14d52
SSDEEP 3072:gtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:gIJjiJcbI03GBc3ucY5DCSj
TLSH
T180545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bztrljebwtrmjebw.exe

Path C:\Temp\bztrljebwtrmjebw.exe
Size 376KB
SHA256 12ee36386df72d4862ce553c64183831431073aad064785a69ce2d6c3e2934d3
MD5 751a27c02d268aa72b98aab6d8499092
SHA1 3893bc69cc81324080fa6239f49e660a4025dfa4
SHA512 5dc9b2be55da76f665831d86b3b5e409ae7b4f1f47f094375feba62aba798f4f4bd97be917d152b129af93b945cd07ab28871db94b7c356099643bcee925f4dd
SSDEEP 3072:2FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:2FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E6847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bztrljebwtrmjebw.sys

Path C:\Temp\bztrljebwtrmjebw.sys
Size 293KB
SHA256 847379bcacccee2debe6b1291ae7ec1f4ee8989e6aba3dc8348595f59e543e03
MD5 44979ed908e57102dafa9e323f655726
SHA1 2868eb7ce5f81c5024d80972f1fa8fc97a62f769
SHA512 46eb6cddb161efa7948f1d7d8577ee3ca84714416445fa44d680c2ce9e583217e6163cf8eae9d8a1e17303e054aa50cbf3861eb3d93839e29011849d0ee03e70
SSDEEP 3072:4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:4IJjiJcbI03GBc3ucY5DCSj
TLSH
T13B545B44AAA4B0F6D9D5043C00EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eywqomjebw.sys

Path C:\Temp\eywqomjebw.sys
Size 293KB
SHA256 3a1810c54af39c86c4bb983c2771d93a34c6563020465a8a9d3939b94bf44905
MD5 0c930e8ed5f85e31624782148f41a09d
SHA1 f89c768a1212d5d01711277b1e1f479ecd1d3c57
SHA512 f25adad4aecb0d1c40d397f05977f969a9ab8e169eed655ff0ea7d4303b231d494ff887a3dd4f4ffad1e2a70bda36bfee2b15723b2d8d8d7817e4e1f3183af2a
SSDEEP 3072:WtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:WIJjiJcbI03GBc3ucY5DCSj
TLSH
T140545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fzxspkhfzx.sys

Path C:\Temp\fzxspkhfzx.sys
Size 293KB
SHA256 769094a770160d8fe881d50c81f9246c7459689761e93727183a88f4b8c71996
MD5 a68ee3dad52ebcd6cd65f3c275cf5edc
SHA1 4df2534edd9839508cc4f05429da12ceae68467b
SHA512 7d914fc9bc0f5eb9e079e6ff26759bed2f02ccdfa023f5639bdfbd0fac7e67f475dab17b3a7fbc167c0acf8746505c4361341a79661e4857bc2325a6ec87fc82
SSDEEP 3072:EtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:EIJjiJcbI03GBc3ucY5DCSj
TLSH
T19F545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gaysqniday.exe

Path C:\Temp\gaysqniday.exe
Size 376KB
SHA256 84b5ad8563eede170adccb66ec1eea451572c12783185dc4e866d117d9d85746
MD5 43577f6ee81d87b64bee2010aad5229a
SHA1 f7d647da898e0b10aa9f2a2eafb748eb888b98a0
SHA512 cb7a628d033cdee47d904e47c3cfae5b7a0be4d18017c4dce7724ac3889679b0cf6564a3f18df4e94bf6ba8d70f0e2caaaef1e3c75257af48942f162137fc249
SSDEEP 3072:VFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:VFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C4847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gaysqniday.exe

Path C:\Temp\i_gaysqniday.exe
Size 376KB
SHA256 166150e0c0753cb6b266e52a76ee51b5624f870a0b695a7b1d50de3ce44979d5
MD5 65bb8761aadcb971464928f251c2f5bf
SHA1 b834060d8bff4e14c0aec2c398f6554c4c363188
SHA512 0202de8d88bec2e28e3e3f886a758f744f54e2df50cf11dfdc4c6e1360c20ea6f1b4e89c952947571fa90127c0ff68467892761218d27f62f87d6f004983d27f
SSDEEP 3072:BFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:BFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F7847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_icausnkfdx.exe

Path C:\Temp\i_icausnkfdx.exe
Size 376KB
SHA256 c4910aa2e87c3903c0b8de2e1f9fab1c259a43dab623b39174fa1a9ee6acd220
MD5 757f6d90bcc83bf1eecdef016d4d70e7
SHA1 a87d2f24a2508328d7d7f47857720ed3eccce190
SHA512 9b8acd349cac08d61150a3b6c05624fd1d076687bba6f279cfd22ce98c1fca8ea18982f58280ffa8a83cddf27cda1e83c325ef277c19145fd5abcb7c9b2812dc
SSDEEP 3072:0FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:0FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T172847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_idbvtnlgdb.exe

Path C:\Temp\i_idbvtnlgdb.exe
Size 376KB
SHA256 512597dcbcfd18d9f99de7af7ac0e20bbfc137e9a87127a354f83da99030c576
MD5 8da7167ba3daaf751e800e67ca215b5e
SHA1 0c613df8cee95baef818e10e12f3b83650a69693
SHA512 8122ee7a4fa626e11810c769ff40124faf4a1b2ffeb1973bdfcaa8ab522f8ec15620cd9db53c17a76d4f476c8e6dedd3095f28b8b7d8f5ce158ff947792b0d47
SSDEEP 3072:cFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:cFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1FF847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jebzurojhb.exe

Path C:\Temp\i_jebzurojhb.exe
Size 376KB
SHA256 afbf3f5c2af640dbcbbb9137a50a9290d8e170b3a1d05c9f1a9181cc9c8426ee
MD5 3588bcc7f4a9529f1e423c3e9ec6249a
SHA1 33d8d393ca5a40b3c4628e6beadc78fea6be1879
SHA512 5121cfc96b0aa378dc26e3d3f11d64217b08d824396e638fc8fb309a280b21e9da26b4ace784ff24d5c081182a5c49f37cacb8fcf520836145693917e8af754c
SSDEEP 3072:sFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:sFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T126847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vtqoigaytq.exe

Path C:\Temp\i_vtqoigaytq.exe
Size 376KB
SHA256 1e7dcf49b0f04deb1c4a724fcd6658cfa8935cef90ab16562e87cb966c794aad
MD5 7b9c729df69669ef1a6f3961c9b6f78c
SHA1 5861efb2bca70cb60dc1f67814c0236c149f712c
SHA512 e6194a1f2897b29e8cc83c798170db3ee451a3152aeaf53d2e946f25e20062cbd6f8bceede7c50365498771884b1ce9f326d9f71d4b8633adbd0dc98724003bf
SSDEEP 3072:jFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:jFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T19D847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wtomgeywto.exe

Path C:\Temp\i_wtomgeywto.exe
Size 376KB
SHA256 ed7aac6069d277acd81f4942e83e8021b695001d6799923f6dcbcea92d7037a6
MD5 c08f8caa5f30e45aab905703e668681b
SHA1 993f9ea68af5d112fb199e81a63ce63355998c84
SHA512 d82fb2cdc5b853c8a5741695f7138c67650f732738193a307a38dc671c345240515afbd634563800b61d699edbbe572385182633cc8ae4bfed43fe36110d105b
SSDEEP 3072:CFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:CFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E0847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icausnkfdx.exe

Path C:\Temp\icausnkfdx.exe
Size 376KB
SHA256 df34176696df9f891357b3cb6dc1a48592a77ea9f9dd11561667591f5d851af0
MD5 25d478377d8171814de5c046cc8015ed
SHA1 8061c45a7db5bbd4e9a7edf33ec829ca374c308e
SHA512 21703fd789c32b6b9d304104a33d03379b478c857b866ecdb03f49dd292bcaa8c69fb478fa025b245296f8a687d938b8c88c387ca2603379c6ca7223dee414b1
SSDEEP 3072:0FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:0FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1AE847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idbvtnlgdb.exe

Path C:\Temp\idbvtnlgdb.exe
Size 376KB
SHA256 e9fda60a3d0fcede2f264df58d9f8191d0e355f3b45c7767ea283db0966e8f5a
MD5 aad53683659eb39a14e501e7ad5ef7ea
SHA1 cdeaef2b952e68b2262350b54cca59f9614677d1
SHA512 2ac78b3f5c47b8f9dd996142619bb381cb649a1aaccb1efb1aba6766ddaa0371ba4f692842d378c8f69553e710d081080837053cc8193b6616756e1e4c719d8a
SSDEEP 3072:FFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:FFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T195847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igdyvqnida.sys

Path C:\Temp\igdyvqnida.sys
Size 293KB
SHA256 c95410c71541e5823515393abfa7c73f64b323760370880de4c0315dcb53700c
MD5 86ea6dd632b070141546b0f1dee4dc1e
SHA1 2ee061c2b5a54434c210edd7b7933cc90e71ebd8
SHA512 de4b5243a0fdb8bbd529c8fb7778171ab0f2d54fa72adbacf7d743c2ede199beb45e3c7b765f76c40103d1cc6d26859401397e1ae2d8754bc3eeb7ea56e08adb
SSDEEP 3072:WtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:WIJjiJcbI03GBc3ucY5DCSj
TLSH
T19E545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jebzurojhb.exe

Path C:\Temp\jebzurojhb.exe
Size 376KB
SHA256 7749713810308cdedad3ce612b265cc94d7cae1b010c9bec4ac7646da081fca4
MD5 9c0ecac942f07eb811eaa016ce5d841a
SHA1 65de3017256fead412f90d6d2ec090180755144e
SHA512 a90d341af1228b0679b3e9f72aed0f01a0d92a3af2b7ffc68c6f660477858ca9b9bed4a1d198c24cffa5bc1281b520b5ca7481f97e2d18cc3e264f1dbf3f72c4
SSDEEP 3072:5FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:5FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1FB847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kicaxsqkic.sys

Path C:\Temp\kicaxsqkic.sys
Size 293KB
SHA256 5ca87e61f31b2e381d4332afe544817db5fde48d61b9c14feb0146e99e58463e
MD5 769f2c97b4fbba73d27c6fb5abbc98b0
SHA1 a709fd63fd533cd30b38a1a08f9d2d9719fe89e9
SHA512 15bfb779a2f32999bdd516e95b39d748cb21f08c9113e4b0be021910c523b6dcc5c293734c8bf607c4f9be2fc33e0d9394c28c3814944b52090afc32e3dd0b8f
SSDEEP 3072:FtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:FIJjiJcbI03GBc3ucY5DCSj
TLSH
T165545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtqoigaytq.exe

Path C:\Temp\vtqoigaytq.exe
Size 376KB
SHA256 fb0ed7d370d83276c00a9ae69e13808e05dcced18cef52c75272bb064a8da967
MD5 6d4dece262a07d53dabbfdce13916ebc
SHA1 0dc720f2a99f498285ccc583f13e758a99e617b3
SHA512 dcbf69da696a5a0fe24c7a3e0b8780712373dadbea79f2650b8b511b7712d951e44858c60c4149d30eac940e324c7a7c33e137d171f8c5e8bba046950459b9f2
SSDEEP 3072:xFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:xFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F7847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wqolgeywto.sys

Path C:\Temp\wqolgeywto.sys
Size 293KB
SHA256 7b5c09931c59152607c208a9ff2ba2c3a2cc693b754fba58090abc2ab4d7bed6
MD5 1f20de7795616208c51c4a25c8346d32
SHA1 2406376245f69c3aa97daadc3d2db9fded4bff09
SHA512 92d2c8f569eae0118fd961ac4ee3901671596cf3662f0fe816ea8e4eedad8f1496a04cc6963b3d1900eea102d0cf5ebed8210def0bad024b63c264fe2e79234d
SSDEEP 3072:4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:4IJjiJcbI03GBc3ucY5DCSj
TLSH
T140545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wtomgeywto.exe

Path C:\Temp\wtomgeywto.exe
Size 376KB
SHA256 ea1400958454fa08c9abd571726d32af18defc274edba08b635fa3f8a9f30a92
MD5 9acc8ca19ed73124ec748a3d3382d8c9
SHA1 80ccc030f0798f579ff20e3d3b3412c153e93f4b
SHA512 5a3081cf43c0fe186a2140584108dbf37981af0aafbd55b354ebe7f7672a2160dac6c9a207594c64465926b178f363039759390d3573b1978618b4645bbc2c79
SSDEEP 3072:IFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:IFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T17B847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e9e31f5fb014f6a7439a4e224bdae6d3d8b22db7c287d9c004b0184cc18e6bf8
MD5 00fe8112e1beaff1b09c3e772b0b70e6
SHA1 1d234f4d61d2fe0153bb63a7a246d37e6fc0aabe
SHA512 aaafc34862d38399e66858477aa9d3d624e9e071371fe2961aac0159845c41dbe1ed0ae62f8b9c52f327e4e4a97abdaf614ae741bcfd2627ec55b1d4f6fb6d74
TLSH
T1EAD08071B7286847D9551931D432CB017A57546365BAD1025160410C6C7BDB553CA155
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 59e0c976cb0867fe1b4beb0330daea8e1a80463d0b9d6852acf5ef95e6515fa5
MD5 90098adce563b05109f7252674db7ded
SHA1 0c46598d27db973fc227d4efe6ea7ddd75a444d4
SHA512 f89736ce6d6c07d013333a14a783ae8f1f29bfba2ae657aa5cbb87238783630e6b2b0f65a09eb5ff8e4d21586cd78735243c5f39147871b2ef5e8c937bdd0699
TLSH
T148E0E565C860BC275DF81B18A168064AE750131B3A40884B3A3C912C4FB0637428AC5C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 6bc3ba70a7914cd588e7fb5f648e19dba90946e5fb82f5486996dc25a7870cb5
MD5 6f00e616c16097c3f2100e9d9ce92090
SHA1 44bc52b34f656c2fceaa37a5db2da23330891915
SHA512 d1ef3200d3b143ecef525ac482321850cd85b2e8aeaf50b7aa5ee2aefae037a79c641d781c08641852c770b72633d9a0b2da6b0ae54f5ec946305edf8fdf364c
TLSH
T18541CDF783F4856EDA1196F0AA186E2FCF1C0515432C7D9AC9E0AE2793E3471E041A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 4877ea94b517455b305f0c1db2f7c4d00e7a91507f6d05db4f66462812615db4
MD5 5e0b7dbe30ff54564d2e88538b302718
SHA1 001994d8cbcdc53df039480b21337238e2d3dead
SHA512 746e41f9a204005e946a93cb5112efaf56ec37078355ec0346fac61384c8913ec4fe6e9ce52adbd52173f7557891e5371c75fe019bf8ac55337e7f0ccac4ee70
SSDEEP 384:sxR6+8z/fxsCXhwN/RIKwj/5e/WijsGQ7js:s2Dz/f7XsWN/5kWijsGQc
TLSH
T1B172D915A9349D7B8CDBD209FA95BF93D7F81173A1905E44AEFC8A0C04E66DD210782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 1ffc5f0d99383307cdfbdc9591a9ce36434ae01409d6c6e330d35581d1ac1de9
MD5 629696bdc31a3f7132165f14e147bd1e
SHA1 774d57f41ff2db3fcfa53631d8431a8d0ed96c88
SHA512 162d39760298133350e9c2eb55aaee28e52219ebb4a7eb86a4e7c85fc40e0351fad9f60360a99682659f1d2c5c157e6664a37529fa4f02b4b394a0dba01b1533
SSDEEP 384:sxR6+qHz/fxsmXhuN/RIKwj/5e/WidsGQ740:s2BHz/fjX2WN/5kWidsGQx
TLSH
T1F172D815A9249D7B9CDBE219FA95BF93D3F81173A1505E44AEFC8A0C04E66DD210382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 79b61325c40edce613bda42feed2d5ffb60939a7d78b8001ffd6de1db3ec5578
MD5 1aef7b0ccc9b456a3d486041679d0b25
SHA1 6c6001259e3f31394e626fe859f605ebc02b444a
SHA512 12cedee28571f7cb5ec9bfaad10599fe938dc8c74e3b7cce9cd6147716864e6874bec609aa6f25c4e9b890b5acc6d16227be4517f7b4cf510d1f1a9a1de242a7
SSDEEP 768:Ob4YZx7pLuL7yTWg1NfwB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVnobbDwzroO140:Ob4YZnE7yTWg1NfwBu1jakobHwAOq0
TLSH
T13CE2FB3B280CCB7E4F804ADDEC29BD9A6DA801CF56D8C95447FA850C03C6BEB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 8d0e93867dfc397ed6609daaaf7342ad74c94a716ee2d2028efef2213965659c
MD5 9e53ce142569c18cad36d5312c17722c
SHA1 ba0da2779e6f7ce433e7ce9593fcadfcdfba08fb
SHA512 1fbde3d9ce4fcd223f51ff15cda934cacad55f4157c9b47f8f0ca653176bd6312b554f598472fe4be583a490b423f12dc0d3b9447d91a12dd58f9733e6ae9bb8
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9EExiWESiNG/SOoQBUHMU3eipvIL:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRg
TLSH
T1EBB25F51713F4680387EB90C91B8982F96C2B4637419E53F7B6802A65F67E039DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 4a7b1e6377efafadc779d2ec168b90bf5d8c5fe592397f3b0d2251bd5f2f1f92
MD5 36b795fdedea2a36f92f8ded4c97e2cb
SHA1 eebf3e633e1c73a399cfb8d035e1eaf7df2b87c8
SHA512 5f832c159e6567c2d365b1fd498d6f4c9ac3db3f4277379bc65cd13f2a57d7846383bd397448f973d485a310f7af0776e57e1a9ab1979b17ae9dccd71d938b0d
SSDEEP 384:nZ4iFiZcI68NLT8TUNTUlIRNaPvuTJ8fEqf+GGECXcMlZA+hsOOPrXLpe8C/n8Lk:VFQ6QTwgiuq/GEPesOi9Ps
TLSH
T122E2B3F198D78977E8AE5B97677D2E429AFCD163B4884984B7C84D0CCC821BFC706816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 93dd425da1db9824c314354ae483f670d32f722543b64acacab7a4f36f714414
MD5 8c5324211f9a3a354035fd9c1c430169
SHA1 9d2efc53ba8dcf54c233387c285687078b425824
SHA512 1602e69006136622f0a85e7dddaa691c280344c61f4d458d83aeabf0dba393217922fa68cfc74278e77e6cb35caa1d10e25b5da5c0798fba2fd35f1a3b055fe6
SSDEEP 384:nNiF1tNn/s3n9Sn8NgO8TUNTUlIRiPvuTuxREqf+GGECXcMsLdOObjI9G6w7m98M:EF1j+9SXOwgUuAZGEPhd29Mm
TLSH
T161C24A36E865CEB7EDE64FD8B74A7A46EEE0516785DC59C8DAC85E0C00C31AD030381A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 1f032bfe624de776b6011e3bae14ff48c81922888d1ee38b1435c96ba9273e8d
MD5 202147f298a21fa3c1afd223ab6c1a78
SHA1 0754ba16a62216148b59dcfbfe39a2bfe185134a
SHA512 9da3497c6e6ac7594bbb1366230d6df291da524ebc4e3181f9d04c2cd60a76b5dea2c048efef7c89e1cc77715ff1eb0b43e1c9c540335602809313fa4422ae2c
SSDEEP 384:nZ9iFiZcIO8NLT8TUNTUlIRNaPvuTJPfEqf+GGECXcMlZAeFsOOPrXLpe8C/n8Lk:KFQOQTwgiu9/GEPWsOi9Ps
TLSH
T165D24B31E8A4C9A7ECFA9FD9A7497646DEE45163D5CC9AD8DAD88D0C00C319E070BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 dfe6ffcd98788cf506d1b0eb268cfc6ba7a057616cab253a7aae248fe6c39f92
MD5 edb517eed5fe41c0c0a250bdddc658ef
SHA1 34a4acb62610b74b451230d0489105981c4be718
SHA512 c797fd559c8cfc669f519022a42fa2bc78bb04fbd1cd1dfa6e1d4214ad8fbc56027d615dc0fd542145746b146711ab0488f93c5b0528aeaa0c7743efe46d7c1f
SSDEEP 384:n/iF1tNn/s3n9SA8NLT8TUNTUlIR1PvuTNPfEqf+GGECXcMlZAeFsXy8LEEIz6K:KF1j+9pQTwg7uR/GEPWsXU
TLSH
T1DDB24B32E855CDB7ECEA4FD9B70A7686DEE0516388CC99D4DAC95D4C00C729E070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 89e3e66907bb4084bdf6c0877477dde503b286b1d66912ef2fa2e180a041eb96
MD5 fb8faa9a11fe3b4e2bfa5f350511bbeb
SHA1 518d7926f9b158e4d818308afd3bd71937c65220
SHA512 e7e4e2d2ef6315932aa9a58778af962dae054bf41c75c0366018ae1577ed11054680fd832210832c70b1750bbd9990bf88ae630b82d2d5e28054b67b1a634a05
SSDEEP 384:n/iFiZcIO8NLT8TUNTUlIRNaPvuTJPfEqf+GGECXcMlZAeFsOOPrXLpe8C/n8LEl:KFQOQTwgiu9/GEPWsOi9Ps
TLSH
T175D24B31E8A4CDA7ECFA9FD9A7497646DEE45163D5C89AD8DAC88D0C00C319E070BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 2026de03587d6e2b230a0a04b325fed893eb8b5a59fb1dcd2509b4568ba13dad
MD5 472ce577c386947cd3082731601ad959
SHA1 7cf0a1dd6a2dffda342d1fb1dcfbdb057d47e1f6
SHA512 4e40616811880544f8424e38c3dd4026c95d4d7bcb14b62a79e3ad9fc32d1d0a15e12058cb0c726bcb5a5e1150650d6aab998b86a4c7139abe75d95429c6be09
SSDEEP 384:n9iF1tNn/s3n9Sn8NgT8TUNTUlIRiPvuTRlfEqf+GGECXcMlZAeksOObjI9G6w7m:0F1j+9SXTwgUuH/GEPls29Mm
TLSH
T124C25B32E855CEB7ECE74EE8B74A3686EEE051A789DC5EC4DAC95E4C00C719D070781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 dae5f175e1752376fbc9e545513a44e0f55d7f89fa461c84efbcf3fc9688faeb
MD5 6e5848bb46e6d98bf452a4076b91b8c1
SHA1 7e09da55b276bfc5d0d38c6d751a4abbe4ecdf89
SHA512 f7f8de2bdce04c0e07379f16f06d2f9393af73800d16b4d5e849d793893f99fa636058bf6283d77e0f25bc05fc2b49625e6ba43e381afe23db14a787d6826746
TLSH
T1F671048356B9C5B3C5DE5FF102835648F5BB22380B63306507515546AA70A3524B8F08
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1520-362-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1692-274-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2624-187-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2756-207-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2912-278-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3324-220-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3424-346-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3456-328-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4312-358-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4320-333-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4396-233-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4508-150-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5264-316-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5264-329-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5860-307-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5972-282-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6252-342-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6336-59-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6416-269-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6468-311-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6608-337-0x0000000000010000-0x00000000000AB000-memory.dmp

Download