systex | f25c9f95ba58d1b732c2e9092dbe973602ad1562bff8475e351261c482cdf3ae

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 12:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_dc4abc5225fb9a7d625eadb57b238d3b_amadey_darkgate_elex_smoke-loader_stop.exe
Size 384KB
Sample260819-prmn9stgra
SHA256 f25c9f95ba58d1b732c2e9092dbe973602ad1562bff8475e351261c482cdf3ae
MD5 dc4abc5225fb9a7d625eadb57b238d3b
SHA1 ad0a45aea82bff55a11d8321f22b5c6eea4905cb
SHA512 f6749133c20109b88b7c05f3716c7c5fc5c919543b4c17da7fb67e6ce5047cb028372f7a284cfaaba64d0ed1672dc60f804507a8f976fb5a8687ad712dddfba7
SSDEEP 3072:R9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:bctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T136847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
2136	vtnlgdbytqligayw.exe
5656	vtnlgdbytqligayw.sys
824	CreateProcess.exe
1988	gdytqoigdy.exe
3844	CreateProcess.exe
2856	CreateProcess.exe
3344	i_gdytqoigdy.exe
3756	favqnlfdxv.sys
4232	CreateProcess.exe
3264	qnigaxsqni.exe
1472	CreateProcess.exe
4720	CreateProcess.exe
4320	i_qnigaxsqni.exe
6112	vpnhfdavsn.sys
1384	CreateProcess.exe
1268	nhfdavpnfc.exe
4640	CreateProcess.exe
204	CreateProcess.exe
3536	i_nhfdavpnfc.exe
468	cxvpnhfcxu.sys
3384	CreateProcess.exe
1984	urpnkfcxup.exe
2272	CreateProcess.exe
2644	CreateProcess.exe
5252	i_urpnkfcxup.exe
2924	zurmkecwup.sys
3300	CreateProcess.exe
4304	rpjhcxupmh.exe
2456	CreateProcess.exe
4672	CreateProcess.exe
4104	i_rpjhcxupmh.exe
5708	mjecwtrpmh.sys
5336	CreateProcess.exe
4504	pmhecwuomg.exe
5704	CreateProcess.exe
5652	CreateProcess.exe
5992	i_pmhecwuomg.exe
1872	jgeywrojhe.sys
1392	CreateProcess.exe
2852	geywrojhbz.exe
4240	CreateProcess.exe
4116	CreateProcess.exe
2532	i_geywrojhbz.exe
1064	bztrojgeyw.sys
2128	CreateProcess.exe
5688	vtqligeywq.exe
4916	CreateProcess.exe
244	CreateProcess.exe
112	i_vtqligeywq.exe
4540	lgdbvtnlge.sys
3064	CreateProcess.exe
2668	dbvtnlfdyv.exe
5976	CreateProcess.exe
4372	CreateProcess.exe
2876	i_dbvtnlfdyv.exe
5188	dyvqnifdxv.sys
4828	CreateProcess.exe
756	ayvtnlfdyv.exe
1332	CreateProcess.exe
4768	CreateProcess.exe
4664	i_ayvtnlfdyv.exe
2244	causnkidxv.sys
4180	CreateProcess.exe
3528	dxvpnifaxv.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnigaxsqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtqligeywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvtnlfdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urpnkfcxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_dc4abc5225fb9a7d625eadb57b238d3b_amadey_darkgate_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnigaxsqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urpnkfcxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtqligeywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztqojgbytr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywrojhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pkhczxupnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eczusmkebz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ayvtnlfdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztqojgbytr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbytrljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywrojhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dxvpnifaxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pkhczxupnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ausmkfcxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omjhbztrom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqoigayvqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlidavsnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhcxupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmhecwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdytqoigdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfdavpnfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfdavpnfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbytrljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlidavsnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhcxupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmhecwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvtnlfdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ayvtnlfdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxvpnifaxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ausmkfcxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omjhbztrom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlgdbytqligayw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdytqoigdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eczusmkebz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqoigayvqn.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1180	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3416	ipconfig.exe
2668	ipconfig.exe
1504	ipconfig.exe
4996	ipconfig.exe
2544	ipconfig.exe
4324	ipconfig.exe
5736	ipconfig.exe
1276	ipconfig.exe
3292	ipconfig.exe
5708	ipconfig.exe
5188	ipconfig.exe
3532	ipconfig.exe
5068	ipconfig.exe
5576	ipconfig.exe
3348	ipconfig.exe
4664	ipconfig.exe
5112	ipconfig.exe
2140	ipconfig.exe
5628	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134316164449254696"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{EA0FA5E2-8010-4E95-B27B-164D7E3B93DD}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5832	2026-08-19_dc4abc5225fb9a7d625eadb57b238d3b_amadey_darkgate_elex_smoke-loader_stop.exe
5832	2026-08-19_dc4abc5225fb9a7d625eadb57b238d3b_amadey_darkgate_elex_smoke-loader_stop.exe
5832	2026-08-19_dc4abc5225fb9a7d625eadb57b238d3b_amadey_darkgate_elex_smoke-loader_stop.exe
5832	2026-08-19_dc4abc5225fb9a7d625eadb57b238d3b_amadey_darkgate_elex_smoke-loader_stop.exe
5832	2026-08-19_dc4abc5225fb9a7d625eadb57b238d3b_amadey_darkgate_elex_smoke-loader_stop.exe
5832	2026-08-19_dc4abc5225fb9a7d625eadb57b238d3b_amadey_darkgate_elex_smoke-loader_stop.exe
5832	2026-08-19_dc4abc5225fb9a7d625eadb57b238d3b_amadey_darkgate_elex_smoke-loader_stop.exe
5832	2026-08-19_dc4abc5225fb9a7d625eadb57b238d3b_amadey_darkgate_elex_smoke-loader_stop.exe
5832	2026-08-19_dc4abc5225fb9a7d625eadb57b238d3b_amadey_darkgate_elex_smoke-loader_stop.exe
5832	2026-08-19_dc4abc5225fb9a7d625eadb57b238d3b_amadey_darkgate_elex_smoke-loader_stop.exe
5832	2026-08-19_dc4abc5225fb9a7d625eadb57b238d3b_amadey_darkgate_elex_smoke-loader_stop.exe
5832	2026-08-19_dc4abc5225fb9a7d625eadb57b238d3b_amadey_darkgate_elex_smoke-loader_stop.exe
5832	2026-08-19_dc4abc5225fb9a7d625eadb57b238d3b_amadey_darkgate_elex_smoke-loader_stop.exe
5832	2026-08-19_dc4abc5225fb9a7d625eadb57b238d3b_amadey_darkgate_elex_smoke-loader_stop.exe
5832	2026-08-19_dc4abc5225fb9a7d625eadb57b238d3b_amadey_darkgate_elex_smoke-loader_stop.exe
5832	2026-08-19_dc4abc5225fb9a7d625eadb57b238d3b_amadey_darkgate_elex_smoke-loader_stop.exe
5832	2026-08-19_dc4abc5225fb9a7d625eadb57b238d3b_amadey_darkgate_elex_smoke-loader_stop.exe
5832	2026-08-19_dc4abc5225fb9a7d625eadb57b238d3b_amadey_darkgate_elex_smoke-loader_stop.exe
5832	2026-08-19_dc4abc5225fb9a7d625eadb57b238d3b_amadey_darkgate_elex_smoke-loader_stop.exe
5832	2026-08-19_dc4abc5225fb9a7d625eadb57b238d3b_amadey_darkgate_elex_smoke-loader_stop.exe
5832	2026-08-19_dc4abc5225fb9a7d625eadb57b238d3b_amadey_darkgate_elex_smoke-loader_stop.exe
5832	2026-08-19_dc4abc5225fb9a7d625eadb57b238d3b_amadey_darkgate_elex_smoke-loader_stop.exe
5832	2026-08-19_dc4abc5225fb9a7d625eadb57b238d3b_amadey_darkgate_elex_smoke-loader_stop.exe
5832	2026-08-19_dc4abc5225fb9a7d625eadb57b238d3b_amadey_darkgate_elex_smoke-loader_stop.exe
5832	2026-08-19_dc4abc5225fb9a7d625eadb57b238d3b_amadey_darkgate_elex_smoke-loader_stop.exe
5832	2026-08-19_dc4abc5225fb9a7d625eadb57b238d3b_amadey_darkgate_elex_smoke-loader_stop.exe
5832	2026-08-19_dc4abc5225fb9a7d625eadb57b238d3b_amadey_darkgate_elex_smoke-loader_stop.exe
5832	2026-08-19_dc4abc5225fb9a7d625eadb57b238d3b_amadey_darkgate_elex_smoke-loader_stop.exe
5832	2026-08-19_dc4abc5225fb9a7d625eadb57b238d3b_amadey_darkgate_elex_smoke-loader_stop.exe
5832	2026-08-19_dc4abc5225fb9a7d625eadb57b238d3b_amadey_darkgate_elex_smoke-loader_stop.exe
5832	2026-08-19_dc4abc5225fb9a7d625eadb57b238d3b_amadey_darkgate_elex_smoke-loader_stop.exe
5832	2026-08-19_dc4abc5225fb9a7d625eadb57b238d3b_amadey_darkgate_elex_smoke-loader_stop.exe
5832	2026-08-19_dc4abc5225fb9a7d625eadb57b238d3b_amadey_darkgate_elex_smoke-loader_stop.exe
5832	2026-08-19_dc4abc5225fb9a7d625eadb57b238d3b_amadey_darkgate_elex_smoke-loader_stop.exe
5832	2026-08-19_dc4abc5225fb9a7d625eadb57b238d3b_amadey_darkgate_elex_smoke-loader_stop.exe
5832	2026-08-19_dc4abc5225fb9a7d625eadb57b238d3b_amadey_darkgate_elex_smoke-loader_stop.exe
5832	2026-08-19_dc4abc5225fb9a7d625eadb57b238d3b_amadey_darkgate_elex_smoke-loader_stop.exe
5832	2026-08-19_dc4abc5225fb9a7d625eadb57b238d3b_amadey_darkgate_elex_smoke-loader_stop.exe
5832	2026-08-19_dc4abc5225fb9a7d625eadb57b238d3b_amadey_darkgate_elex_smoke-loader_stop.exe
5832	2026-08-19_dc4abc5225fb9a7d625eadb57b238d3b_amadey_darkgate_elex_smoke-loader_stop.exe
5832	2026-08-19_dc4abc5225fb9a7d625eadb57b238d3b_amadey_darkgate_elex_smoke-loader_stop.exe
5832	2026-08-19_dc4abc5225fb9a7d625eadb57b238d3b_amadey_darkgate_elex_smoke-loader_stop.exe
5832	2026-08-19_dc4abc5225fb9a7d625eadb57b238d3b_amadey_darkgate_elex_smoke-loader_stop.exe
5832	2026-08-19_dc4abc5225fb9a7d625eadb57b238d3b_amadey_darkgate_elex_smoke-loader_stop.exe
5832	2026-08-19_dc4abc5225fb9a7d625eadb57b238d3b_amadey_darkgate_elex_smoke-loader_stop.exe
5832	2026-08-19_dc4abc5225fb9a7d625eadb57b238d3b_amadey_darkgate_elex_smoke-loader_stop.exe
5832	2026-08-19_dc4abc5225fb9a7d625eadb57b238d3b_amadey_darkgate_elex_smoke-loader_stop.exe
5832	2026-08-19_dc4abc5225fb9a7d625eadb57b238d3b_amadey_darkgate_elex_smoke-loader_stop.exe
5832	2026-08-19_dc4abc5225fb9a7d625eadb57b238d3b_amadey_darkgate_elex_smoke-loader_stop.exe
5832	2026-08-19_dc4abc5225fb9a7d625eadb57b238d3b_amadey_darkgate_elex_smoke-loader_stop.exe
5832	2026-08-19_dc4abc5225fb9a7d625eadb57b238d3b_amadey_darkgate_elex_smoke-loader_stop.exe
5832	2026-08-19_dc4abc5225fb9a7d625eadb57b238d3b_amadey_darkgate_elex_smoke-loader_stop.exe
5832	2026-08-19_dc4abc5225fb9a7d625eadb57b238d3b_amadey_darkgate_elex_smoke-loader_stop.exe
5832	2026-08-19_dc4abc5225fb9a7d625eadb57b238d3b_amadey_darkgate_elex_smoke-loader_stop.exe
5832	2026-08-19_dc4abc5225fb9a7d625eadb57b238d3b_amadey_darkgate_elex_smoke-loader_stop.exe
5832	2026-08-19_dc4abc5225fb9a7d625eadb57b238d3b_amadey_darkgate_elex_smoke-loader_stop.exe
2136	vtnlgdbytqligayw.exe
2136	vtnlgdbytqligayw.exe
2136	vtnlgdbytqligayw.exe
2136	vtnlgdbytqligayw.exe
2136	vtnlgdbytqligayw.exe
2136	vtnlgdbytqligayw.exe
2136	vtnlgdbytqligayw.exe
2136	vtnlgdbytqligayw.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	3344	i_gdytqoigdy.exe
Token: SeDebugPrivilege	4320	i_qnigaxsqni.exe
Token: SeDebugPrivilege	3536	i_nhfdavpnfc.exe
Token: SeDebugPrivilege	5252	i_urpnkfcxup.exe
Token: SeDebugPrivilege	4104	i_rpjhcxupmh.exe
Token: SeDebugPrivilege	5992	i_pmhecwuomg.exe
Token: SeDebugPrivilege	2532	i_geywrojhbz.exe
Token: SeDebugPrivilege	112	i_vtqligeywq.exe
Token: SeDebugPrivilege	2876	i_dbvtnlfdyv.exe
Token: SeDebugPrivilege	4664	i_ayvtnlfdyv.exe
Token: SeDebugPrivilege	1684	i_dxvpnifaxv.exe
Token: SeDebugPrivilege	4488	i_pkhczxupnh.exe
Token: SeDebugPrivilege	1152	i_ausmkfcxup.exe
Token: SeDebugPrivilege	5460	i_eczusmkebz.exe
Token: SeDebugPrivilege	2248	i_omjhbztrom.exe
Token: SeDebugPrivilege	4992	i_ztqojgbytr.exe
Token: SeDebugPrivilege	2268	i_dbytrljdbv.exe
Token: SeDebugPrivilege	4464	i_sqoigayvqn.exe
Token: SeDebugPrivilege	4160	i_nlidavsnlf.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5172	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5832 wrote to memory of 2136	5832	2026-08-19_dc4abc5225fb9a7d625eadb57b238d3b_amadey_darkgate_elex_smoke-loader_stop.exe	90
PID 5832 wrote to memory of 620	5832	2026-08-19_dc4abc5225fb9a7d625eadb57b238d3b_amadey_darkgate_elex_smoke-loader_stop.exe	91
PID 620 wrote to memory of 5172	620	iexplore.exe	92
PID 5172 wrote to memory of 4548	5172	msedge.exe	93
PID 5172 wrote to memory of 1372	5172	msedge.exe	95
PID 5172 wrote to memory of 1180	5172	msedge.exe	96
PID 5172 wrote to memory of 1372	5172	msedge.exe	95
PID 5172 wrote to memory of 1372	5172	msedge.exe	95
PID 5172 wrote to memory of 4080	5172	msedge.exe	97
PID 5172 wrote to memory of 4080	5172	msedge.exe	97
PID 5172 wrote to memory of 5380	5172	msedge.exe	98
PID 5172 wrote to memory of 5380	5172	msedge.exe	98
PID 5172 wrote to memory of 5380	5172	msedge.exe	98
PID 5172 wrote to memory of 3308	5172	msedge.exe	99
PID 5172 wrote to memory of 3308	5172	msedge.exe	99
PID 5172 wrote to memory of 3308	5172	msedge.exe	99
PID 5172 wrote to memory of 3696	5172	msedge.exe	101
PID 5172 wrote to memory of 5756	5172	msedge.exe	100
PID 5172 wrote to memory of 3696	5172	msedge.exe	101
PID 5172 wrote to memory of 3696	5172	msedge.exe	101
PID 5172 wrote to memory of 5756	5172	msedge.exe	100
PID 5172 wrote to memory of 5756	5172	msedge.exe	100
PID 5172 wrote to memory of 4544	5172	msedge.exe	102
PID 5172 wrote to memory of 4544	5172	msedge.exe	102
PID 2136 wrote to memory of 824	2136	vtnlgdbytqligayw.exe	106
PID 5172 wrote to memory of 4952	5172	msedge.exe	109
PID 5172 wrote to memory of 4952	5172	msedge.exe	109
PID 5172 wrote to memory of 3768	5172	msedge.exe	110
PID 5172 wrote to memory of 3768	5172	msedge.exe	110
PID 1988 wrote to memory of 3844	1988	gdytqoigdy.exe	111
PID 5172 wrote to memory of 3444	5172	msedge.exe	115
PID 5172 wrote to memory of 5336	5172	msedge.exe	116
PID 5172 wrote to memory of 5336	5172	msedge.exe	116
PID 5172 wrote to memory of 4760	5172	msedge.exe	119
PID 5172 wrote to memory of 4760	5172	msedge.exe	119
PID 2136 wrote to memory of 2856	2136	vtnlgdbytqligayw.exe	120
PID 5172 wrote to memory of 2440	5172	msedge.exe	124
PID 5172 wrote to memory of 2440	5172	msedge.exe	124
PID 5172 wrote to memory of 2440	5172	msedge.exe	124
PID 2136 wrote to memory of 4232	2136	vtnlgdbytqligayw.exe	125
PID 3264 wrote to memory of 1472	3264	qnigaxsqni.exe	127
PID 5172 wrote to memory of 2360	5172	msedge.exe	130
PID 5172 wrote to memory of 2360	5172	msedge.exe	130
PID 5172 wrote to memory of 2360	5172	msedge.exe	130
PID 2136 wrote to memory of 4720	2136	vtnlgdbytqligayw.exe	131
PID 2136 wrote to memory of 1384	2136	vtnlgdbytqligayw.exe	135
PID 1268 wrote to memory of 4640	1268	nhfdavpnfc.exe	137
PID 2136 wrote to memory of 204	2136	vtnlgdbytqligayw.exe	140
PID 2136 wrote to memory of 3384	2136	vtnlgdbytqligayw.exe	145
PID 1984 wrote to memory of 2272	1984	urpnkfcxup.exe	147
PID 2136 wrote to memory of 2644	2136	vtnlgdbytqligayw.exe	150
PID 5172 wrote to memory of 1036	5172	msedge.exe	152
PID 5172 wrote to memory of 5688	5172	msedge.exe	153
PID 5172 wrote to memory of 2972	5172	msedge.exe	154
PID 2136 wrote to memory of 3300	2136	vtnlgdbytqligayw.exe	157
PID 4304 wrote to memory of 2456	4304	rpjhcxupmh.exe	159
PID 2136 wrote to memory of 4672	2136	vtnlgdbytqligayw.exe	162
PID 2136 wrote to memory of 5336	2136	vtnlgdbytqligayw.exe	166
PID 4504 wrote to memory of 5704	4504	pmhecwuomg.exe	168
PID 2136 wrote to memory of 5652	2136	vtnlgdbytqligayw.exe	171
PID 2136 wrote to memory of 1392	2136	vtnlgdbytqligayw.exe	175
PID 2852 wrote to memory of 4240	2852	geywrojhbz.exe	177
PID 2136 wrote to memory of 4116	2136	vtnlgdbytqligayw.exe	180
PID 2136 wrote to memory of 2128	2136	vtnlgdbytqligayw.exe	184

C:\Users\Admin\AppData\Local\Temp\2026-08-19_dc4abc5225fb9a7d625eadb57b238d3b_amadey_darkgate_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_dc4abc5225fb9a7d625eadb57b238d3b_amadey_darkgate_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5832
- C:\Temp\vtnlgdbytqligayw.exe
  C:\Temp\vtnlgdbytqligayw.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2136
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gdytqoigdy.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:824
  - - C:\Temp\gdytqoigdy.exe
      C:\Temp\gdytqoigdy.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1988
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3844
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3416
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gdytqoigdy.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2856
  - - C:\Temp\i_gdytqoigdy.exe
      C:\Temp\i_gdytqoigdy.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3344
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qnigaxsqni.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4232
  - - C:\Temp\qnigaxsqni.exe
      C:\Temp\qnigaxsqni.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3264
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1472
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3532
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qnigaxsqni.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4720
  - - C:\Temp\i_qnigaxsqni.exe
      C:\Temp\i_qnigaxsqni.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4320
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nhfdavpnfc.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1384
  - - C:\Temp\nhfdavpnfc.exe
      C:\Temp\nhfdavpnfc.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1268
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4640
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2668
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nhfdavpnfc.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:204
  - - C:\Temp\i_nhfdavpnfc.exe
      C:\Temp\i_nhfdavpnfc.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3536
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\urpnkfcxup.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3384
  - - C:\Temp\urpnkfcxup.exe
      C:\Temp\urpnkfcxup.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1984
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2272
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4996
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_urpnkfcxup.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2644
  - - C:\Temp\i_urpnkfcxup.exe
      C:\Temp\i_urpnkfcxup.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5252
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rpjhcxupmh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3300
  - - C:\Temp\rpjhcxupmh.exe
      C:\Temp\rpjhcxupmh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4304
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2456
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2544
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rpjhcxupmh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4672
  - - C:\Temp\i_rpjhcxupmh.exe
      C:\Temp\i_rpjhcxupmh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4104
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pmhecwuomg.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5336
  - - C:\Temp\pmhecwuomg.exe
      C:\Temp\pmhecwuomg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4504
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5704
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5068
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pmhecwuomg.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5652
  - - C:\Temp\i_pmhecwuomg.exe
      C:\Temp\i_pmhecwuomg.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5992
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\geywrojhbz.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1392
  - - C:\Temp\geywrojhbz.exe
      C:\Temp\geywrojhbz.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2852
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4240
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5112
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_geywrojhbz.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4116
  - - C:\Temp\i_geywrojhbz.exe
      C:\Temp\i_geywrojhbz.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2532
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtqligeywq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2128
  - - C:\Temp\vtqligeywq.exe
      C:\Temp\vtqligeywq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5688
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4916
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1504
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtqligeywq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:244
  - - C:\Temp\i_vtqligeywq.exe
      C:\Temp\i_vtqligeywq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:112
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbvtnlfdyv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3064
  - - C:\Temp\dbvtnlfdyv.exe
      C:\Temp\dbvtnlfdyv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2668
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5976
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5576
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbvtnlfdyv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4372
  - - C:\Temp\i_dbvtnlfdyv.exe
      C:\Temp\i_dbvtnlfdyv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2876
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ayvtnlfdyv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4828
  - - C:\Temp\ayvtnlfdyv.exe
      C:\Temp\ayvtnlfdyv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:756
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1332
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4324
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ayvtnlfdyv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4768
  - - C:\Temp\i_ayvtnlfdyv.exe
      C:\Temp\i_ayvtnlfdyv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4664
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dxvpnifaxv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4180
  - - C:\Temp\dxvpnifaxv.exe
      C:\Temp\dxvpnifaxv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3528
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1516
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2140
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dxvpnifaxv.exe ups_ins
    3⤵
    PID:4552
  - - C:\Temp\i_dxvpnifaxv.exe
      C:\Temp\i_dxvpnifaxv.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1684
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pkhczxupnh.exe ups_run
    3⤵
    PID:2008
  - - C:\Temp\pkhczxupnh.exe
      C:\Temp\pkhczxupnh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5016
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3640
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5736
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pkhczxupnh.exe ups_ins
    3⤵
    PID:2076
  - - C:\Temp\i_pkhczxupnh.exe
      C:\Temp\i_pkhczxupnh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4488
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ausmkfcxup.exe ups_run
    3⤵
    PID:3436
  - - C:\Temp\ausmkfcxup.exe
      C:\Temp\ausmkfcxup.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1568
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1176
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1276
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ausmkfcxup.exe ups_ins
    3⤵
    PID:1952
  - - C:\Temp\i_ausmkfcxup.exe
      C:\Temp\i_ausmkfcxup.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1152
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\eczusmkebz.exe ups_run
    3⤵
    PID:4184
  - - C:\Temp\eczusmkebz.exe
      C:\Temp\eczusmkebz.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5456
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:952
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3292
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_eczusmkebz.exe ups_ins
    3⤵
    PID:1476
  - - C:\Temp\i_eczusmkebz.exe
      C:\Temp\i_eczusmkebz.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5460
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\omjhbztrom.exe ups_run
    3⤵
    PID:4676
  - - C:\Temp\omjhbztrom.exe
      C:\Temp\omjhbztrom.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5324
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2072
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3348
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_omjhbztrom.exe ups_ins
    3⤵
    PID:4468
  - - C:\Temp\i_omjhbztrom.exe
      C:\Temp\i_omjhbztrom.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2248
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ztqojgbytr.exe ups_run
    3⤵
    PID:4728
  - - C:\Temp\ztqojgbytr.exe
      C:\Temp\ztqojgbytr.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2964
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4932
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5708
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ztqojgbytr.exe ups_ins
    3⤵
    PID:4108
  - - C:\Temp\i_ztqojgbytr.exe
      C:\Temp\i_ztqojgbytr.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4992
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbytrljdbv.exe ups_run
    3⤵
    PID:4576
  - - C:\Temp\dbytrljdbv.exe
      C:\Temp\dbytrljdbv.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3628
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3756
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5188
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbytrljdbv.exe ups_ins
    3⤵
    PID:4172
  - - C:\Temp\i_dbytrljdbv.exe
      C:\Temp\i_dbytrljdbv.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2268
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqoigayvqn.exe ups_run
    3⤵
    PID:3000
  - - C:\Temp\sqoigayvqn.exe
      C:\Temp\sqoigayvqn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3076
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2296
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4664
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqoigayvqn.exe ups_ins
    3⤵
    PID:2232
  - - C:\Temp\i_sqoigayvqn.exe
      C:\Temp\i_sqoigayvqn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4464
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nlidavsnlf.exe ups_run
    3⤵
    PID:4908
  - - C:\Temp\nlidavsnlf.exe
      C:\Temp\nlidavsnlf.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3688
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5404
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5628
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nlidavsnlf.exe ups_ins
    3⤵
    PID:5928
  - - C:\Temp\i_nlidavsnlf.exe
      C:\Temp\i_nlidavsnlf.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4160
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hfzxspkhfz.exe ups_run
    3⤵
    PID:2768
  - - C:\Temp\hfzxspkhfz.exe
      C:\Temp\hfzxspkhfz.exe ups_run
      4⤵
      PID:4596
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f8,0x2fc,0x300,0x2f4,0x2c8,0x7ffd24efc188,0x7ffd24efc194,0x7ffd24efc1a0
      4⤵
      PID:4548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1932,i,11115381501824822835,15071787134468149992,262144 --field-trial-handle=2504,i,16738966189822226153,2985515689428625550,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:2
      4⤵
      PID:1372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2092,i,9988768583826199011,4870097625402148964,524288 --field-trial-handle=2504,i,16738966189822226153,2985515689428625550,262144 --variations-seed-version --mojo-platform-channel-handle=2768 /prefetch:11
      4⤵
      System Time Discovery
      PID:1180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2532,i,10469735071372724129,710110840917658951,524288 --field-trial-handle=2504,i,16738966189822226153,2985515689428625550,262144 --variations-seed-version --mojo-platform-channel-handle=3220 /prefetch:13
      4⤵
      PID:4080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3584,i,5490956056289295470,10739858906010080840,2097152 --field-trial-handle=2504,i,16738966189822226153,2985515689428625550,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
      4⤵
      PID:5380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3588,i,10663333249460068530,14586603875942055337,2097152 --field-trial-handle=2504,i,16738966189822226153,2985515689428625550,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
      4⤵
      PID:3308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,3441080853417297218,3830358986421067129,2097152 --field-trial-handle=2504,i,16738966189822226153,2985515689428625550,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:1
      4⤵
      PID:5756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,492050350416006832,10732961232967176882,2097152 --field-trial-handle=2504,i,16738966189822226153,2985515689428625550,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:9
      4⤵
      PID:3696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,4227115816507688374,12681967301135623798,524288 --field-trial-handle=2504,i,16738966189822226153,2985515689428625550,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:14
      4⤵
      PID:4544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,17058497778385509698,12268087726612690809,524288 --field-trial-handle=2504,i,16738966189822226153,2985515689428625550,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:14
      4⤵
      PID:4952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,16486401897964512195,6630590111929178263,524288 --field-trial-handle=2504,i,16738966189822226153,2985515689428625550,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:14
      4⤵
      PID:3768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,14464509340653550499,6252660586644118943,524288 --field-trial-handle=2504,i,16738966189822226153,2985515689428625550,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:14
      4⤵
      PID:3632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,14464509340653550499,6252660586644118943,524288 --field-trial-handle=2504,i,16738966189822226153,2985515689428625550,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:14
      4⤵
      PID:3444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,13672178762518172453,15668849459385775633,524288 --field-trial-handle=2504,i,16738966189822226153,2985515689428625550,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:14
      4⤵
      PID:5336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6640,i,4396945922220854953,4131894407378901978,524288 --field-trial-handle=2504,i,16738966189822226153,2985515689428625550,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:14
      4⤵
      PID:4760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6716,i,8594641069018979197,4530591224575205172,2097152 --field-trial-handle=2504,i,16738966189822226153,2985515689428625550,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:1
      4⤵
      PID:2440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3648,i,10751671589648733429,7902337241706872170,2097152 --field-trial-handle=2504,i,16738966189822226153,2985515689428625550,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:1
      4⤵
      PID:2360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1312,i,209293307906096146,14401198499470953022,524288 --field-trial-handle=2504,i,16738966189822226153,2985515689428625550,262144 --variations-seed-version --mojo-platform-channel-handle=1468 /prefetch:14
      4⤵
      PID:1036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1316,i,4197120483193706668,5737289375499467054,524288 --field-trial-handle=2504,i,16738966189822226153,2985515689428625550,262144 --variations-seed-version --mojo-platform-channel-handle=1452 /prefetch:14
      4⤵
      PID:5688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1320,i,14477116632677235023,9705485694806336708,524288 --field-trial-handle=2504,i,16738966189822226153,2985515689428625550,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:14
      4⤵
      PID:2972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,12830113763198159436,18156718670053696798,524288 --field-trial-handle=2504,i,16738966189822226153,2985515689428625550,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:14
      4⤵
      PID:5516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6852,i,7020904869943103117,15914605904858813732,262144 --field-trial-handle=2504,i,16738966189822226153,2985515689428625550,262144 --variations-seed-version --mojo-platform-channel-handle=6860 /prefetch:10
      4⤵
      PID:3144

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3260

C:\Temp\vtnlgdbytqligayw.sys
C:\Temp\vtnlgdbytqligayw.sys
1⤵
- Executes dropped EXE
PID:5656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4540

C:\Temp\favqnlfdxv.sys
C:\Temp\favqnlfdxv.sys
1⤵
- Executes dropped EXE
PID:3756

C:\Temp\vpnhfdavsn.sys
C:\Temp\vpnhfdavsn.sys
1⤵
- Executes dropped EXE
PID:6112

C:\Temp\cxvpnhfcxu.sys
C:\Temp\cxvpnhfcxu.sys
1⤵
- Executes dropped EXE
PID:468

C:\Temp\zurmkecwup.sys
C:\Temp\zurmkecwup.sys
1⤵
- Executes dropped EXE
PID:2924

C:\Temp\mjecwtrpmh.sys
C:\Temp\mjecwtrpmh.sys
1⤵
- Executes dropped EXE
PID:5708

C:\Temp\jgeywrojhe.sys
C:\Temp\jgeywrojhe.sys
1⤵
- Executes dropped EXE
PID:1872

C:\Temp\bztrojgeyw.sys
C:\Temp\bztrojgeyw.sys
1⤵
- Executes dropped EXE
PID:1064

C:\Temp\lgdbvtnlge.sys
C:\Temp\lgdbvtnlge.sys
1⤵
- Executes dropped EXE
PID:4540

C:\Temp\dyvqnifdxv.sys
C:\Temp\dyvqnifdxv.sys
1⤵
- Executes dropped EXE
PID:5188

C:\Temp\causnkidxv.sys
C:\Temp\causnkidxv.sys
1⤵
- Executes dropped EXE
PID:2244

C:\Temp\cavsnkfdxv.sys
C:\Temp\cavsnkfdxv.sys
1⤵
PID:5304

C:\Temp\xusmkecxus.sys
C:\Temp\xusmkecxus.sys
1⤵
PID:936

C:\Temp\zxupmhecwu.sys
C:\Temp\zxupmhecwu.sys
1⤵
PID:4508

C:\Temp\jhezwtrljg.sys
C:\Temp\jhezwtrljg.sys
1⤵
PID:3548

C:\Temp\eywuomgebw.sys
C:\Temp\eywuomgebw.sys
1⤵
PID:788

C:\Temp\eywqoigdbz.sys
C:\Temp\eywqoigdbz.sys
1⤵
PID:4856

C:\Temp\ywqoigdyvq.sys
C:\Temp\ywqoigdyvq.sys
1⤵
PID:6060

C:\Temp\qkidavsqki.sys
C:\Temp\qkidavsqki.sys
1⤵
PID:5948

C:\Temp\pnkfdxvsni.sys
C:\Temp\pnkfdxvsni.sys
1⤵
PID:676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cxvpnhfcxu.sys

Path C:\Temp\cxvpnhfcxu.sys
Size 293KB
SHA256 2b71b86e69855ffd681524d40983151be7908899efd118090cbb96189536b731
MD5 45cd2d26bfcd2b8f6e5ca23a6dc80162
SHA1 bff2a783c85ec2a1e820d2c936916a4bc39bd696
SHA512 a158882d53696d9422868f59b55c96f5972d3525683f207064c3668cc2b1646d5f231bb6cd2537162527f8fd460e0115cdd9253e9b918020d023a627faccb921
SSDEEP 3072:mtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:mIJjiJcbI03GBc3ucY5DCSj
TLSH
T1AD545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favqnlfdxv.sys

Path C:\Temp\favqnlfdxv.sys
Size 293KB
SHA256 5b84d8e3bb29d478634798273faf3cc898c513810eecb0a582b46d0e12c7cfec
MD5 eea8c19a96021f99aaf6e83ae59482d3
SHA1 6074a1a702c22171661600963854ce9a7ab2f598
SHA512 fe74903cdc7edd8ff961c78c8a48fa5d8c52b2165bd81af5c5a1b3d512ea3b6ee8c256132760b04195dde00b6a33144be54955d96903ff1bfe3a828acd15f8a7
SSDEEP 3072:1tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:1IJjiJcbI03GBc3ucY5DCSj
TLSH
T11A545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gdytqoigdy.exe

Path C:\Temp\gdytqoigdy.exe
Size 384KB
SHA256 9800d07e238fab3336574d671fb40a9b10eb8bf8a496dfb9ef78dd2acd3c0a57
MD5 afa139d34c23c268b57886f3ca79f91e
SHA1 98cc6c03a1889e2ad0a97270a77eba8aefa84258
SHA512 4c2a4c55917b586dc026328db266483f0205985fe55ec1072cf8ea74ec6ee5c63f25d644bcb13d1a25ce961f31002059251b3069a6584e95991e76af2deaf8c0
SSDEEP 3072:c9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:mctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T11D847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gdytqoigdy.exe

Path C:\Temp\i_gdytqoigdy.exe
Size 384KB
SHA256 d1534fcf0013bf0d9e9dedf3590c3c96c5b9dac4906c95087634d767169a7754
MD5 d135098c924fbd76d2c9e48bb4897c67
SHA1 e130139fc50ed95c500ea347f1aebda035fe44e1
SHA512 b94e9eaa565a839a60d4c15079ca1652dcffb0d421dc18a78bcf75cfbfd67d566b2f09517d42d7c4a032de62b741f1d43787b9366f48077c26741e4fb8d46299
SSDEEP 3072:Q9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:ictFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D1847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nhfdavpnfc.exe

Path C:\Temp\i_nhfdavpnfc.exe
Size 384KB
SHA256 9682ad644f193928c568dfe54ab9f56661f109e4bc139eb3190232060ecba05a
MD5 189b4efa7fe9ed57ac58205be738e4b5
SHA1 23043ca0ecbba7753f662addcf6240e8dcc21301
SHA512 2732c62926f4a71799d9268c2d003d6720bfec6e5f608097ac1fac81ff164cfa3d336eea2887d6953795282e37abf5de95ca0b4ee7f2440bc87eae6365482491
SSDEEP 3072:79ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:pctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T10A847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qnigaxsqni.exe

Path C:\Temp\i_qnigaxsqni.exe
Size 384KB
SHA256 cc1040126dbe16cbce320a3d3df6efa7e7df0d69db7bfbf76e531e6a79dbade6
MD5 94093c893fd8caf6c5a024a377e4b972
SHA1 487496852d4d2fc93044c48bb34c5dd3f11a8ea6
SHA512 a609711d03a4e389d0dba32bc10d74adb2d1ad50dac6b7f23b46c0c8c0c39f18a4ca4f93b611c2c9afa14c3653c30920b96f75cf9817395d24dc22b30ab8b5c7
SSDEEP 3072:49ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:6ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1AA847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rpjhcxupmh.exe

Path C:\Temp\i_rpjhcxupmh.exe
Size 384KB
SHA256 94467f0ab7ab0f307e1722a81b3d3d353210e7deb009462ee83847d2d4475ef4
MD5 e99a6686b062503b813c8e55277a1f09
SHA1 d33f4f83974669c3552efb09e1937a62dfe3d97f
SHA512 04706989363c5756f23cdca0acb6059aae4bcb1b3c28af2a617d4be509fcad45f449f8c975fb0a26b3ad22c34eb62e1d798dfc0cac0a66bbb9b8504105d94325
SSDEEP 3072:O9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:sctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T16E847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_urpnkfcxup.exe

Path C:\Temp\i_urpnkfcxup.exe
Size 384KB
SHA256 0d0b3d3a4753c3e14ca1a3baac4ac59849df4bb864b97220439407fa8ae8984a
MD5 d07217ed3e319d601f312fb4a1ce5ed4
SHA1 99778bdcc617a9714673037100c787a70a47a91d
SHA512 ba0c8fbb907190908c1b4bb92dffd9d023030b362e0ccb3beb89e3c5e0530cce7c3f5a63df0a8907271e9c0f82987e17ba0431bb1b83738b02254e2b469b9768
SSDEEP 3072:a9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:ActFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D2847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mjecwtrpmh.sys

Path C:\Temp\mjecwtrpmh.sys
Size 293KB
SHA256 9d0a006a697d707e8e77158b7bea2f22cc51a05dd780bbeabd64a61cbac661b0
MD5 16f4a1426187b599641c77c977b9a126
SHA1 6b7836fa57b1d67445cc634131856e3c67e55b86
SHA512 9137023c9f0566d866796e27c53a4d05635430df52d9a7aa38b471e4034db50dc2a9c067b3f0751854fcc68dd227a04e1d7e8f8f27adfec201842b353434319d
SSDEEP 3072:OtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:OIJjiJcbI03GBc3ucY5DCSj
TLSH
T172545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nhfdavpnfc.exe

Path C:\Temp\nhfdavpnfc.exe
Size 384KB
SHA256 4b95477fcb0fdae3b47490f272d2dc46139b1c275e1a0ce3e29af5c4f4659b3d
MD5 07b515a03be506c283433a38e9094b30
SHA1 58a55ccea46f32bdf06fb45ff67daa722b0c9aea
SHA512 2700ca67f585e213c4e07356adeaf3745b109a56bde83b1c9a86f7d318699997ad962476e179d04fd4fff66043df84905791d696c4736b7b06df2a4a2e353188
SSDEEP 3072:Z9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:zctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T17D847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmhecwuomg.exe

Path C:\Temp\pmhecwuomg.exe
Size 384KB
SHA256 ff6cf975919bc369eae94976883a24502e6921d57c1a991b8e378aaee14b0151
MD5 853cb11bf9324aa35796951dbbcc4133
SHA1 9d4651015586e0f9e426360aa465bd434b6d912c
SHA512 8f6c5bb89f111419289d848e19051539f01088b91b1c195e895abcb7fc563a55036fbaf869a1e1932c5e7afdb2bbb651b0d74570d6ecb14f92a2db35fad54df0
SSDEEP 3072:09ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:OctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E1847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qnigaxsqni.exe

Path C:\Temp\qnigaxsqni.exe
Size 384KB
SHA256 fd46805a3e9a345fb619a5d992f0fbc3e9079e29a37592bab8c02d7a9341ff0c
MD5 993876e7e87c6ee1f090145082f8eed4
SHA1 cd905975807431dcb5bfb98326a2a1c5a937b5de
SHA512 9c9b22f04e806cacfbdd03beddaebba021b97c83a064aef695f503a32393f6202a668c7e799a6eebcb0f4c912e874a931a1efaf30205aaf44c8db72924b9cd48
SSDEEP 3072:T9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:xctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T141847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpjhcxupmh.exe

Path C:\Temp\rpjhcxupmh.exe
Size 384KB
SHA256 1c3f96960bd9165d5a9ae25ef20aba12620181b5f520c98cdc6e94ae2722a2c8
MD5 9ad6f992d56085257a1dd2e033d3fb58
SHA1 5284ffe40d476fced5d374f2565255bb04fdc4ad
SHA512 f64c1e034887124aa4aa6e8257c9a27bb7563e26fd5d6f2ee3a50439e0868480d1add53f2a0391e2f1f09b9a42d7678060110af72e759108570f1d6c6c5b9c26
SSDEEP 3072:d9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:vctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T130847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urpnkfcxup.exe

Path C:\Temp\urpnkfcxup.exe
Size 384KB
SHA256 6bec8a1c94f2215b0e6d264f2af07342fbe56af0dda2d1343b06d2d12473298f
MD5 b2584bb822647ef5d1a7c7ac355ea019
SHA1 78028035e1fd625ff192cec20dba92cd088af4bc
SHA512 1769d3899fd996b99549133e352bc3705c08929c38b45b320d4105f506ef12605ff1a4679f3b65627aac196926b3a51f606dcd0e8fd4fc2b4736adf0443c84b4
SSDEEP 3072:p9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:DctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T183847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vpnhfdavsn.sys

Path C:\Temp\vpnhfdavsn.sys
Size 293KB
SHA256 48a4fe369361adf6f89585351305d31255930e01ae02a42db7bbd4f1dceb51da
MD5 c4bf0dc14b248220f0f264c8bed15ea8
SHA1 066d9203664a4b163370f8accb467c7e8171498a
SHA512 172d059060f7f97f44d08d13375a26934c6fc0fbb3bd99082f5c6937fbbdc4345d0dc91a4bca1b3b0ee7f40fadab5c716e1d275e94a6454317a75239b9efeae2
SSDEEP 3072:ItKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:IIJjiJcbI03GBc3ucY5DCSj
TLSH
T1A4545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtnlgdbytqligayw.exe

Path C:\Temp\vtnlgdbytqligayw.exe
Size 384KB
SHA256 562a64dee4f564b3f65c70ce47b7055d27614ae7db4c750beaf00cdf6554a32c
MD5 d14e657d30fbdaf8d661b0ca31231609
SHA1 2f367d5760060f06eeceebf8c83943a9f30d5641
SHA512 bb5f635b7ebdb9f39dd4b48b19712f254d818b9462d700f117ba122038be2abd31e521059e5cefa9df344ceb12337bc7b8cbaaa5dbc3287cef82eb2a0f1ece26
SSDEEP 3072:d9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:vctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T170847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtnlgdbytqligayw.sys

Path C:\Temp\vtnlgdbytqligayw.sys
Size 293KB
SHA256 b4b4d8ac99a3550e468170c820ea93fd0b526457310c1e0ec0b1bd2039882bfd
MD5 9438ea110a7486eb6b386ed0704d11a8
SHA1 523b0f26622a120b4db70c1924406ac5bf32c211
SHA512 da4baae42d2442efe837ecbc6c95abda87ef27939dec85da75e8e025b4f260a382bea1fe4c4e1c76a5634ddb6c077998623f629a1a0722adfbe37a7d95c2ff29
SSDEEP 3072:etKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:eIJjiJcbI03GBc3ucY5DCSj
TLSH
T13F545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zurmkecwup.sys

Path C:\Temp\zurmkecwup.sys
Size 293KB
SHA256 d4ff80e7bc9af5168f9c1199a4d394c96a34334a4df08910fca917224447c51b
MD5 8c3c1d405400906e95a6072246f2e124
SHA1 b7de4c23cacfa68d88bd0b19193b128ae0a976a7
SHA512 16873a18282a472a548e8bbc1322a558fb4b215ecb457cc0e0b7d7327e0c1485c685c3a35404fce716a34024f78369789659e998b9ce0ec354ab9fa45c123425
SSDEEP 3072:MtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:MIJjiJcbI03GBc3ucY5DCSj
TLSH
T1EF545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 49af854224e8a3edc1fee82aba5bcb7ec97754725de0903e39707db338e9363a
MD5 612be1a8e3008a854b66f5412c4788bb
SHA1 95c3516cfb7c129e9f7e1ec177791eb92d57474a
SHA512 e66cf697674ad312244b51d686c67916472f2e0738a45ed26cc977777bc91159128d35181866266b5434332a7632587fc3252ee5617d4fc03668bdf1af17bbe6
TLSH
T1D45172D00BEA0AD2CBFD4EFA21E626CE73F0C49D45635A9065522D741A4EFA7A0D0C37
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 2a9b7f4501a13f90414263472b25d5cf19e02b8cc4c48a47e0b8ab4a1a3cb48a
MD5 7bed0f8eb28dd32c06fffdf78eeeb278
SHA1 64c14a6802870838f99fe45a60e9c769b14d56fa
SHA512 47b131c74f4820bd9aa88cc3198575819b033142f2d98d6454a9de7028c9c948ec810d558620bfd1eacc944f19b09117814849a86bbda0d790368781671ef24e
TLSH
T16741ADF7C3F4857E8A0156F0AA18AE2BCE2D0915432C7D5A89E4AF2B93E3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 21492b16eb4e4f255d8f282939f7256677aa965108cef4a52965000a651fafb3
MD5 c7ed3fbcda081aab493c0dc245937819
SHA1 0673975511957a50e97debb444e2071f5c77c68b
SHA512 d17bc9a75cea1f01e09b453f37934c15a90de505f36cef2018efe2748fe9483f9566e0e6de9f2b774cc33b6989e2359f437cc1d3fc232aed33dcb15410e10ca7
SSDEEP 192:sxRyRICI/f0smyD10ZhKaFzoA8pi/g6+WNIYot5NYfGMIgVAJ:sxRyNI/f0sm+1KhKNi/5It6m
TLSH
T1F132B9196E28A93B4CC7E21DBB65BF53D2F9103261D42E48FAFC961C04E7ADD520740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 80c41ee768c2942c2bc7c73b3963b17ba65b39764839353a6b1196905d1482b5
MD5 3f8ab4ed4245c35a912ebe800e19ceb5
SHA1 d4fd7555ba470ff8819e9861c2fd47d39d6bf2ee
SHA512 1d7f67ba1ce4215bb9367e3261ea68a8570b51a49b5cfae8283fc9dedaa1667b43cafa7883b48beb8dd799b346e4c69e3ed015f9bc64ff9bb8e03798cdd2e350
SSDEEP 192:sxRRRICI/f0sKyD60ZhKatzoA8p90/g6+WNCsj/YoutNYfGMIgDoAJ:sxRRNI/f0sK+6KhKF+/5J/+6R
TLSH
T17542C9196D386D3B8CC7E21DBA65BF53D3F91032A1D51E48AAFC961C14E7ADD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 2f978c01bdb5bdd7cbadbcbb11c2e84c8bb0bcdc17187c61806493aebe277847
MD5 3f2a90ae0995f6b0b4c1465dacf82898
SHA1 783625a22eb1dd63562bfc0e280ae2f278d730df
SHA512 8625182a47c235371b377319387b38850db461b0940e1b9cdd346d4aa84d981d656a6badcf28d80f50c1f3c11f22881c1b50e4cdb6d6b6fa69211c0e4e927a6e
SSDEEP 192:sxRRRICI/f0sKyD10ZhKatzoA8p90/g6+WNCsj/YoT5NYfGMIgDSAJ:sxRRNI/f0sK+1KhKF+/5J/H6H
TLSH
T18842C91A6D38AD3B8CC7E21DBA65BF53D3F91032A1D51E48AAFC961C14E7ADD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 0ec67ebfa907a8413fc513dccc780ba19c1ba1d1cc953b86dbec047c4e557c46
MD5 5b55e4ebb404b64578a12d05fa805a9a
SHA1 4121aab264764b3bab914e351f9775fbf094e2e6
SHA512 e3ef7133340c5bf0aa1c82158049d4e01df1ebcad26557ddcb7873b06cc8100fbf72de02c41a8b0ce3f09d2c74ab4d43737891f4ac341d7f0e0fd7a8cc042357
SSDEEP 768:j26HUo7pLuL7MRWgs2f028F1+UoAYDCx9Tuqh0VfUC9xbog/OV7BBVuwuro9Ue0h:j26HUUE7MRWgs2f02u1ja8BB4wl7e
TLSH
T1D5D2DB7B640DCA7F4F800ADDEC197E9F6D6802CB9698CD8447FE941C02C6BEA511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 72080dc32f0f16e06f6a93d2b3fe63992de29d27c79436ea89ad7e70fb43c342
MD5 80550a355682ea5675ade6727d4cac42
SHA1 6c042b5ae25161944c98d83ce4172fae04d48da3
SHA512 10f564aac329ce6448da72ed7e31cabc853cca005b6ea699df991f0d3da2935d361e2ae9c470ab486c34b306d90eda0f8298ef4f78ae3ee629a6a53f46c179b0
SSDEEP 96:KRCHuC0UECWMZxgyCK4ngoCcSaBgCrHlyLf1vz3W7gugn3K4Wg53cdF4LvVET/Nw:CCHuC0UE9MZSy6ngoJSaBgCrHlyLf1vb
TLSH
T188919245757A02443C7F7A0991BC892FDA82B473351DF46B7BA802A61F67E024DFC8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a802e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a802e.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 c2f3403448d2c847883a6e6ef59b557a41a9f28a28b4274b668f94ef66ce2fe1
MD5 5d9d7bc7f5e4b32b646954352bc7cdca
SHA1 3486915ca7e3bca2ac5a1440a3a2687f21dc5738
SHA512 ef64a834c4ef4390fb5d0b078696ea1ddb82eb1b537639b551891973b80ed87508f6ccde68d6af80b3eb9afaf2688015271dc33b287b5438eb466f1ad13e7abc
SSDEEP 768:hrv+4UNbdz3cq/TBOWSYONXyer1IRCzniBReVH1SK7:hbsbV39BSIqneEH1l
TLSH
T19D03C032E4989E338DE2A3C5B047B6437FB86057D6840790DDDE2F4D069B99E230B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 3506a330f134bf4b33790b255c7f5f9709ae49a5ae56a8765d3ea95b704eb831
MD5 d4250be178655efb43d195d1a66300b8
SHA1 b39bfd427d456f3c8165281dbc80bb80ccb9b520
SHA512 e08f12d259a64f738fc8e9027b7095369bb8628127df843627de2e67a1b550572ad293e8580c5734d6930a337b6826799bddd3329e957d02ac703370db52d545
SSDEEP 768:frv+4UNbde3wI55J/TBOWS3zttONXyer1IRCzni9hf3ul:fbsbc3wKPYSIqnKf3q
TLSH
T1B803CF30E9689E334DE5A3D5F047A7837FB8206B88C50A90DDDA5F9D059B99E230F907
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 854ebf351c8a4ef8ba8a895befaad02d47aa2f80f388cc67c3cac97e444c9e38
MD5 3b2c6253e3727874172110cf5b8c071a
SHA1 5cd8e4eeab10d215e01ed36c7094650d3a0fc3b7
SHA512 2673a94ab8f4ce1f40174f8cdb1d5a5fbc85052b0178c04b5b19776a4e3adfba00f846a0b6b3000275d53f688f8d69f700f3343e6f6b7e5fc77cbcbb64157cf5
SSDEEP 768:1l3wI5rJ/TBOWS3zttONXyer1IRCzni9hf3uN:1l3wK1YSIqnKf3+
TLSH
T14DF2BE30A8A59D234CE5E3C6F1436793AFF82077D5C40A50E9EA9F1E0597A5E270F81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 93bd189154efe3e85e31dc753e3cc50ccf0687bdf7712c270406092e41c6f598
MD5 08b26909eae3bd0d6b9f2a05885e38db
SHA1 d13080a5639e75cf4990e2f0a65c112f65742446
SHA512 f22b4c27fec0e28e79070ffafe42e597ed7d586c768007885623893968853fb0a1f9955934be8625169480728f74c0a57ce80adcab886789beb3c266671ab2c6
SSDEEP 768:Brv+4UNbdz3Q//TBOWS3zt/ONXyer1IRCzniwheVH1SK7:BbsbV3E4SIqn1EH1l
TLSH
T1B003BF31A569DE334DE2A396B047B7837FB82067C5800B90EDDA1F4D099799E230F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 0b5fb1b8774cb442289d715bad6647fb7a85bd6ae8e55feac517fd1fa10add89
MD5 0d1cc4464bafcc4e357ac25682f5cf1c
SHA1 eb6c0bce6031a0a90ac7c6c03bdbf25a2ab5e748
SHA512 16e9a79ff4a0afc7feb8667aa916093f4e50cdd577140fab153827f5fe5a284aa0c8a03c97586b9fb87ac304ebe1b1ddb10b5d13e6e1e3e20c23e727c22c387c
SSDEEP 768:hl3nI5rJ/TBOWS3zttONXyer1IRCzni9hf3uN:hl3nK1YSIqnKf3+
TLSH
T181F2BE30A8A59D234CE5E3C2F1436793BFB82067D5C40E50A9EA9F1E0597A5E270F81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 ced1d949018c27dc008caaae0b2054318ddf2153e5b3a5365d709a00b3cfc765
MD5 9de2441435d5b52ed6f387cdb7b45950
SHA1 bf6f40bad21e9e2135bc6fa9de02b222953b0538
SHA512 f1dec49bd05856f817d91d096d60425182597e6304ef78203a610d058f397865cd1c18694605947922162501d7085837dbd07f83ec44ac05281d870277a7a782
SSDEEP 768:0FQL3DwgTI53upsOWS3ztrONXyer1IRCzni9hf3uN:XL3tK+VSIqnKf3+
TLSH
T1801349F598D38933D8AD9383A33D6E429EBCD067B5884990BBD55E4DCC865BFC30A805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

535ae3de-47c0-49ab-8f65-a2fd5b9f3e22.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\535ae3de-47c0-49ab-8f65-a2fd5b9f3e22.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5172_695619696\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 a6927a248d0f8afa4a6884e40723767ea6de4fca32c48dacc480b6e83dfda473
MD5 582e4453a2f162034025300999edc2b6
SHA1 bac9b25d92868e46f91ac6e547c0eb7fee15eb04
SHA512 52508378a8dbb9e881eaa7c3c6e3c91c943d273cec57bad30e780dbb8f900346f9f1ded0b6bb9f5a4945537e15ad92395b4b15e1a8bce898ec76f3509ab238e3
TLSH
T1BD71C09396A9CAB2D19E5BF102839644F6FB26380767702007956586EB30A7A58B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/468-261-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/676-412-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/788-394-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/936-382-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1064-313-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1872-309-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2244-357-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2924-273-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3548-390-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3756-188-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4508-386-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4540-328-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4856-399-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5188-332-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5304-369-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5656-216-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5708-301-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5948-408-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6060-404-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6112-236-0x0000000000010000-0x00000000000AB000-memory.dmp

Download