systex | b6beaa5faecede0c769c8885eb54dd64a0ca72b2f6521b55dfb3618b64152bde

Analysis

max time kernel
149s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 05:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_ebc76efb9597d19ca593a3737eb3aad5_amadey_darkgate_elex_smoke-loader_stop.exe
Size 384KB
Sample260820-fsvxlazdmd
SHA256 b6beaa5faecede0c769c8885eb54dd64a0ca72b2f6521b55dfb3618b64152bde
MD5 ebc76efb9597d19ca593a3737eb3aad5
SHA1 986bccfe75102791fd74cfef28fce68c437dd8f5
SHA512 c60a1f2146bb66250c360c05fea8926b0aba115ea6c5e083f23c5d79fc2d69934a78260967d1848778f14e5e0034c1c252f1bfb9446bbfe7fb11ac08114b043d
SSDEEP 3072:n9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:9ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T18E847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
4668	uomgeywuomjeczur.exe
6336	uomgeywuomjeczur.sys
3376	CreateProcess.exe
5124	ecwuomgeyw.exe
4396	CreateProcess.exe
6412	CreateProcess.exe
1120	i_ecwuomgeyw.exe
6016	jhtrljdbzt.sys
3280	CreateProcess.exe
4464	wtrjgbzwro.exe
6908	CreateProcess.exe
2204	CreateProcess.exe
6480	i_wtrjgbzwro.exe
5952	ljgbytqojg.sys
6284	CreateProcess.exe
6660	geyvqnljdb.exe
6904	CreateProcess.exe
5696	CreateProcess.exe
5552	i_geyvqnljdb.exe
2156	igdyvtqoig.sys
2756	CreateProcess.exe
7080	lidbvtnlfd.exe
6532	CreateProcess.exe
2924	CreateProcess.exe
5964	i_lidbvtnlfd.exe
2404	sqnigaysqk.sys
3532	CreateProcess.exe
1232	snlidavsnl.exe
4460	CreateProcess.exe
4604	CreateProcess.exe
3728	i_snlidavsnl.exe
124	sqkicanhfa.sys
6108	CreateProcess.exe
3168	cxvpnhfzxs.exe
6788	CreateProcess.exe
6520	CreateProcess.exe
6516	i_cxvpnhfzxs.exe
6824	fcaxvpnhfa.sys
6620	CreateProcess.exe
7140	kfcxusmzxr.exe
6064	CreateProcess.exe
5772	CreateProcess.exe
3332	i_kfcxusmzxr.exe
5420	pkhczurmke.sys
7152	CreateProcess.exe
1188	mhfzxupmkh.exe
6292	CreateProcess.exe
5072	CreateProcess.exe
1880	i_mhfzxupmkh.exe
6416	rmjhbzxrpm.sys
1344	CreateProcess.exe
5720	rmhezxrpje.exe
2492	CreateProcess.exe
3396	CreateProcess.exe
2384	i_rmhezxrpje.exe
4416	trmjhbztrm.sys
5920	CreateProcess.exe
3960	jebwuomgey.exe
4964	CreateProcess.exe
1500	CreateProcess.exe
2060	i_jebwuomgey.exe
5444	ljdbztromg.sys
2104	CreateProcess.exe
3564	ljdbwtromg.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5856_1027597494\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5856_392644375\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5856_392644375\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5856_392644375\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5856_392644375\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5856_1027597494\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_ebc76efb9597d19ca593a3737eb3aad5_amadey_darkgate_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snlidavsnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmhezxrpje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oljdbvtnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqlidaysql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomhecwusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtrjgbzwro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kfcxusmzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmhezxrpje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfzxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causmkecxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_causmkecxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urpjhbztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwuomgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtrjgbzwro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhfzxupmkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jebwuomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifaxsqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwuomgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geyvqnljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lidbvtnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snlidavsnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxvpnhfzxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfcxusmzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhfzxupmkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfzxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifaxsqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urpjhbztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqojgbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqojgbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomgeywuomjeczur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbwtromg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oljdbvtnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqlidaysql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geyvqnljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cxvpnhfzxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jebwuomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbwtromg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomhecwusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqoljdbytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lidbvtnlfd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6428	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2020	ipconfig.exe
4648	ipconfig.exe
2636	ipconfig.exe
5488	ipconfig.exe
4288	ipconfig.exe
6264	ipconfig.exe
5716	ipconfig.exe
6544	ipconfig.exe
108	ipconfig.exe
5748	ipconfig.exe
3164	ipconfig.exe
5596	ipconfig.exe
3024	ipconfig.exe
6420	ipconfig.exe
4928	ipconfig.exe
3976	ipconfig.exe
5028	ipconfig.exe
2020	ipconfig.exe
1336	ipconfig.exe
3560	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134316761268050408"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{95134CFA-3323-4360-8AAC-C64C2332FD13}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
484	2026-08-20_ebc76efb9597d19ca593a3737eb3aad5_amadey_darkgate_elex_smoke-loader_stop.exe
484	2026-08-20_ebc76efb9597d19ca593a3737eb3aad5_amadey_darkgate_elex_smoke-loader_stop.exe
484	2026-08-20_ebc76efb9597d19ca593a3737eb3aad5_amadey_darkgate_elex_smoke-loader_stop.exe
484	2026-08-20_ebc76efb9597d19ca593a3737eb3aad5_amadey_darkgate_elex_smoke-loader_stop.exe
484	2026-08-20_ebc76efb9597d19ca593a3737eb3aad5_amadey_darkgate_elex_smoke-loader_stop.exe
484	2026-08-20_ebc76efb9597d19ca593a3737eb3aad5_amadey_darkgate_elex_smoke-loader_stop.exe
484	2026-08-20_ebc76efb9597d19ca593a3737eb3aad5_amadey_darkgate_elex_smoke-loader_stop.exe
484	2026-08-20_ebc76efb9597d19ca593a3737eb3aad5_amadey_darkgate_elex_smoke-loader_stop.exe
484	2026-08-20_ebc76efb9597d19ca593a3737eb3aad5_amadey_darkgate_elex_smoke-loader_stop.exe
484	2026-08-20_ebc76efb9597d19ca593a3737eb3aad5_amadey_darkgate_elex_smoke-loader_stop.exe
484	2026-08-20_ebc76efb9597d19ca593a3737eb3aad5_amadey_darkgate_elex_smoke-loader_stop.exe
484	2026-08-20_ebc76efb9597d19ca593a3737eb3aad5_amadey_darkgate_elex_smoke-loader_stop.exe
484	2026-08-20_ebc76efb9597d19ca593a3737eb3aad5_amadey_darkgate_elex_smoke-loader_stop.exe
484	2026-08-20_ebc76efb9597d19ca593a3737eb3aad5_amadey_darkgate_elex_smoke-loader_stop.exe
484	2026-08-20_ebc76efb9597d19ca593a3737eb3aad5_amadey_darkgate_elex_smoke-loader_stop.exe
484	2026-08-20_ebc76efb9597d19ca593a3737eb3aad5_amadey_darkgate_elex_smoke-loader_stop.exe
484	2026-08-20_ebc76efb9597d19ca593a3737eb3aad5_amadey_darkgate_elex_smoke-loader_stop.exe
484	2026-08-20_ebc76efb9597d19ca593a3737eb3aad5_amadey_darkgate_elex_smoke-loader_stop.exe
484	2026-08-20_ebc76efb9597d19ca593a3737eb3aad5_amadey_darkgate_elex_smoke-loader_stop.exe
484	2026-08-20_ebc76efb9597d19ca593a3737eb3aad5_amadey_darkgate_elex_smoke-loader_stop.exe
484	2026-08-20_ebc76efb9597d19ca593a3737eb3aad5_amadey_darkgate_elex_smoke-loader_stop.exe
484	2026-08-20_ebc76efb9597d19ca593a3737eb3aad5_amadey_darkgate_elex_smoke-loader_stop.exe
484	2026-08-20_ebc76efb9597d19ca593a3737eb3aad5_amadey_darkgate_elex_smoke-loader_stop.exe
484	2026-08-20_ebc76efb9597d19ca593a3737eb3aad5_amadey_darkgate_elex_smoke-loader_stop.exe
484	2026-08-20_ebc76efb9597d19ca593a3737eb3aad5_amadey_darkgate_elex_smoke-loader_stop.exe
484	2026-08-20_ebc76efb9597d19ca593a3737eb3aad5_amadey_darkgate_elex_smoke-loader_stop.exe
484	2026-08-20_ebc76efb9597d19ca593a3737eb3aad5_amadey_darkgate_elex_smoke-loader_stop.exe
484	2026-08-20_ebc76efb9597d19ca593a3737eb3aad5_amadey_darkgate_elex_smoke-loader_stop.exe
484	2026-08-20_ebc76efb9597d19ca593a3737eb3aad5_amadey_darkgate_elex_smoke-loader_stop.exe
484	2026-08-20_ebc76efb9597d19ca593a3737eb3aad5_amadey_darkgate_elex_smoke-loader_stop.exe
484	2026-08-20_ebc76efb9597d19ca593a3737eb3aad5_amadey_darkgate_elex_smoke-loader_stop.exe
484	2026-08-20_ebc76efb9597d19ca593a3737eb3aad5_amadey_darkgate_elex_smoke-loader_stop.exe
484	2026-08-20_ebc76efb9597d19ca593a3737eb3aad5_amadey_darkgate_elex_smoke-loader_stop.exe
484	2026-08-20_ebc76efb9597d19ca593a3737eb3aad5_amadey_darkgate_elex_smoke-loader_stop.exe
484	2026-08-20_ebc76efb9597d19ca593a3737eb3aad5_amadey_darkgate_elex_smoke-loader_stop.exe
484	2026-08-20_ebc76efb9597d19ca593a3737eb3aad5_amadey_darkgate_elex_smoke-loader_stop.exe
484	2026-08-20_ebc76efb9597d19ca593a3737eb3aad5_amadey_darkgate_elex_smoke-loader_stop.exe
484	2026-08-20_ebc76efb9597d19ca593a3737eb3aad5_amadey_darkgate_elex_smoke-loader_stop.exe
484	2026-08-20_ebc76efb9597d19ca593a3737eb3aad5_amadey_darkgate_elex_smoke-loader_stop.exe
484	2026-08-20_ebc76efb9597d19ca593a3737eb3aad5_amadey_darkgate_elex_smoke-loader_stop.exe
484	2026-08-20_ebc76efb9597d19ca593a3737eb3aad5_amadey_darkgate_elex_smoke-loader_stop.exe
484	2026-08-20_ebc76efb9597d19ca593a3737eb3aad5_amadey_darkgate_elex_smoke-loader_stop.exe
484	2026-08-20_ebc76efb9597d19ca593a3737eb3aad5_amadey_darkgate_elex_smoke-loader_stop.exe
484	2026-08-20_ebc76efb9597d19ca593a3737eb3aad5_amadey_darkgate_elex_smoke-loader_stop.exe
484	2026-08-20_ebc76efb9597d19ca593a3737eb3aad5_amadey_darkgate_elex_smoke-loader_stop.exe
484	2026-08-20_ebc76efb9597d19ca593a3737eb3aad5_amadey_darkgate_elex_smoke-loader_stop.exe
484	2026-08-20_ebc76efb9597d19ca593a3737eb3aad5_amadey_darkgate_elex_smoke-loader_stop.exe
484	2026-08-20_ebc76efb9597d19ca593a3737eb3aad5_amadey_darkgate_elex_smoke-loader_stop.exe
484	2026-08-20_ebc76efb9597d19ca593a3737eb3aad5_amadey_darkgate_elex_smoke-loader_stop.exe
484	2026-08-20_ebc76efb9597d19ca593a3737eb3aad5_amadey_darkgate_elex_smoke-loader_stop.exe
484	2026-08-20_ebc76efb9597d19ca593a3737eb3aad5_amadey_darkgate_elex_smoke-loader_stop.exe
484	2026-08-20_ebc76efb9597d19ca593a3737eb3aad5_amadey_darkgate_elex_smoke-loader_stop.exe
484	2026-08-20_ebc76efb9597d19ca593a3737eb3aad5_amadey_darkgate_elex_smoke-loader_stop.exe
484	2026-08-20_ebc76efb9597d19ca593a3737eb3aad5_amadey_darkgate_elex_smoke-loader_stop.exe
484	2026-08-20_ebc76efb9597d19ca593a3737eb3aad5_amadey_darkgate_elex_smoke-loader_stop.exe
484	2026-08-20_ebc76efb9597d19ca593a3737eb3aad5_amadey_darkgate_elex_smoke-loader_stop.exe
4668	uomgeywuomjeczur.exe
4668	uomgeywuomjeczur.exe
4668	uomgeywuomjeczur.exe
4668	uomgeywuomjeczur.exe
4668	uomgeywuomjeczur.exe
4668	uomgeywuomjeczur.exe
4668	uomgeywuomjeczur.exe
4668	uomgeywuomjeczur.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5856	msedge.exe
5856	msedge.exe
5856	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	1120	i_ecwuomgeyw.exe
Token: SeDebugPrivilege	6480	i_wtrjgbzwro.exe
Token: SeDebugPrivilege	5552	i_geyvqnljdb.exe
Token: SeDebugPrivilege	5964	i_lidbvtnlfd.exe
Token: SeDebugPrivilege	3728	i_snlidavsnl.exe
Token: SeDebugPrivilege	6516	i_cxvpnhfzxs.exe
Token: SeDebugPrivilege	3332	i_kfcxusmzxr.exe
Token: SeDebugPrivilege	1880	i_mhfzxupmkh.exe
Token: SeDebugPrivilege	2384	i_rmhezxrpje.exe
Token: SeDebugPrivilege	2060	i_jebwuomgey.exe
Token: SeDebugPrivilege	2712	i_ljdbwtromg.exe
Token: SeDebugPrivilege	5672	i_oljdbvtnlg.exe
Token: SeDebugPrivilege	4288	i_sqlidaysql.exe
Token: SeDebugPrivilege	1120	i_ifaxsqkica.exe
Token: SeDebugPrivilege	2816	i_nhfzxvpnhf.exe
Token: SeDebugPrivilege	1512	i_causmkecxu.exe
Token: SeDebugPrivilege	3312	i_uomhecwusm.exe
Token: SeDebugPrivilege	4228	i_urpjhbztrm.exe
Token: SeDebugPrivilege	6420	i_wqojgbztrl.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5856	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 484 wrote to memory of 4668	484	2026-08-20_ebc76efb9597d19ca593a3737eb3aad5_amadey_darkgate_elex_smoke-loader_stop.exe	89
PID 484 wrote to memory of 3424	484	2026-08-20_ebc76efb9597d19ca593a3737eb3aad5_amadey_darkgate_elex_smoke-loader_stop.exe	90
PID 3424 wrote to memory of 5856	3424	iexplore.exe	91
PID 5856 wrote to memory of 4940	5856	msedge.exe	92
PID 5856 wrote to memory of 1868	5856	msedge.exe	93
PID 5856 wrote to memory of 6428	5856	msedge.exe	94
PID 5856 wrote to memory of 1868	5856	msedge.exe	93
PID 5856 wrote to memory of 1868	5856	msedge.exe	93
PID 5856 wrote to memory of 4748	5856	msedge.exe	95
PID 5856 wrote to memory of 4748	5856	msedge.exe	95
PID 5856 wrote to memory of 4944	5856	msedge.exe	97
PID 5856 wrote to memory of 4944	5856	msedge.exe	97
PID 5856 wrote to memory of 4944	5856	msedge.exe	97
PID 5856 wrote to memory of 4412	5856	msedge.exe	98
PID 5856 wrote to memory of 4412	5856	msedge.exe	98
PID 5856 wrote to memory of 4412	5856	msedge.exe	98
PID 5856 wrote to memory of 6200	5856	msedge.exe	103
PID 5856 wrote to memory of 5452	5856	msedge.exe	102
PID 5856 wrote to memory of 6200	5856	msedge.exe	103
PID 5856 wrote to memory of 5452	5856	msedge.exe	102
PID 4668 wrote to memory of 3376	4668	uomgeywuomjeczur.exe	101
PID 5856 wrote to memory of 6868	5856	msedge.exe	106
PID 5124 wrote to memory of 4396	5124	ecwuomgeyw.exe	108
PID 4668 wrote to memory of 6412	4668	uomgeywuomjeczur.exe	113
PID 4668 wrote to memory of 3280	4668	uomgeywuomjeczur.exe	117
PID 4464 wrote to memory of 6908	4464	wtrjgbzwro.exe	119
PID 4668 wrote to memory of 2204	4668	uomgeywuomjeczur.exe	122
PID 4668 wrote to memory of 6284	4668	uomgeywuomjeczur.exe	126
PID 6660 wrote to memory of 6904	6660	geyvqnljdb.exe	128
PID 4668 wrote to memory of 5696	4668	uomgeywuomjeczur.exe	131
PID 4668 wrote to memory of 2756	4668	uomgeywuomjeczur.exe	135
PID 7080 wrote to memory of 6532	7080	lidbvtnlfd.exe	137
PID 4668 wrote to memory of 2924	4668	uomgeywuomjeczur.exe	141
PID 5856 wrote to memory of 5624	5856	msedge.exe	143
PID 5856 wrote to memory of 5628	5856	msedge.exe	144
PID 5856 wrote to memory of 5664	5856	msedge.exe	145
PID 4668 wrote to memory of 3532	4668	uomgeywuomjeczur.exe	148
PID 1232 wrote to memory of 4460	1232	snlidavsnl.exe	150
PID 4668 wrote to memory of 4604	4668	uomgeywuomjeczur.exe	153
PID 4668 wrote to memory of 6108	4668	uomgeywuomjeczur.exe	157
PID 3168 wrote to memory of 6788	3168	cxvpnhfzxs.exe	159
PID 4668 wrote to memory of 6520	4668	uomgeywuomjeczur.exe	162
PID 4668 wrote to memory of 6620	4668	uomgeywuomjeczur.exe	166
PID 7140 wrote to memory of 6064	7140	kfcxusmzxr.exe	168
PID 4668 wrote to memory of 5772	4668	uomgeywuomjeczur.exe	171
PID 4668 wrote to memory of 7152	4668	uomgeywuomjeczur.exe	175
PID 1188 wrote to memory of 6292	1188	mhfzxupmkh.exe	177
PID 4668 wrote to memory of 5072	4668	uomgeywuomjeczur.exe	180
PID 5856 wrote to memory of 5468	5856	msedge.exe	182
PID 5856 wrote to memory of 5468	5856	msedge.exe	182
PID 4668 wrote to memory of 1344	4668	uomgeywuomjeczur.exe	187
PID 5720 wrote to memory of 2492	5720	rmhezxrpje.exe	189
PID 4668 wrote to memory of 3396	4668	uomgeywuomjeczur.exe	192
PID 4668 wrote to memory of 5920	4668	uomgeywuomjeczur.exe	196
PID 3960 wrote to memory of 4964	3960	jebwuomgey.exe	198
PID 4668 wrote to memory of 1500	4668	uomgeywuomjeczur.exe	201
PID 4668 wrote to memory of 2104	4668	uomgeywuomjeczur.exe	205
PID 3564 wrote to memory of 4760	3564	ljdbwtromg.exe	207
PID 4668 wrote to memory of 4132	4668	uomgeywuomjeczur.exe	210
PID 4668 wrote to memory of 7120	4668	uomgeywuomjeczur.exe	214
PID 6388 wrote to memory of 6276	6388	oljdbvtnlg.exe	216
PID 4668 wrote to memory of 5872	4668	uomgeywuomjeczur.exe	219
PID 4668 wrote to memory of 264	4668	uomgeywuomjeczur.exe	223
PID 5856 wrote to memory of 5888	5856	msedge.exe	224

C:\Users\Admin\AppData\Local\Temp\2026-08-20_ebc76efb9597d19ca593a3737eb3aad5_amadey_darkgate_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_ebc76efb9597d19ca593a3737eb3aad5_amadey_darkgate_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:484
- C:\Temp\uomgeywuomjeczur.exe
  C:\Temp\uomgeywuomjeczur.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4668
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ecwuomgeyw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3376
  - - C:\Temp\ecwuomgeyw.exe
      C:\Temp\ecwuomgeyw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5124
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4396
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4288
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ecwuomgeyw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6412
  - - C:\Temp\i_ecwuomgeyw.exe
      C:\Temp\i_ecwuomgeyw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1120
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wtrjgbzwro.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3280
  - - C:\Temp\wtrjgbzwro.exe
      C:\Temp\wtrjgbzwro.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4464
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6908
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3164
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wtrjgbzwro.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2204
  - - C:\Temp\i_wtrjgbzwro.exe
      C:\Temp\i_wtrjgbzwro.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6480
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\geyvqnljdb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6284
  - - C:\Temp\geyvqnljdb.exe
      C:\Temp\geyvqnljdb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6660
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6904
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6264
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_geyvqnljdb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5696
  - - C:\Temp\i_geyvqnljdb.exe
      C:\Temp\i_geyvqnljdb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5552
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lidbvtnlfd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2756
  - - C:\Temp\lidbvtnlfd.exe
      C:\Temp\lidbvtnlfd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:7080
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6532
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5716
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lidbvtnlfd.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2924
  - - C:\Temp\i_lidbvtnlfd.exe
      C:\Temp\i_lidbvtnlfd.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5964
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\snlidavsnl.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3532
  - - C:\Temp\snlidavsnl.exe
      C:\Temp\snlidavsnl.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1232
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4460
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2020
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_snlidavsnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4604
  - - C:\Temp\i_snlidavsnl.exe
      C:\Temp\i_snlidavsnl.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3728
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cxvpnhfzxs.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6108
  - - C:\Temp\cxvpnhfzxs.exe
      C:\Temp\cxvpnhfzxs.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3168
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6788
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5596
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cxvpnhfzxs.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6520
  - - C:\Temp\i_cxvpnhfzxs.exe
      C:\Temp\i_cxvpnhfzxs.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6516
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kfcxusmzxr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6620
  - - C:\Temp\kfcxusmzxr.exe
      C:\Temp\kfcxusmzxr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:7140
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6064
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4648
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kfcxusmzxr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5772
  - - C:\Temp\i_kfcxusmzxr.exe
      C:\Temp\i_kfcxusmzxr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3332
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mhfzxupmkh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:7152
  - - C:\Temp\mhfzxupmkh.exe
      C:\Temp\mhfzxupmkh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1188
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6292
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3024
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mhfzxupmkh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5072
  - - C:\Temp\i_mhfzxupmkh.exe
      C:\Temp\i_mhfzxupmkh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1880
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rmhezxrpje.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1344
  - - C:\Temp\rmhezxrpje.exe
      C:\Temp\rmhezxrpje.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5720
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2492
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3976
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rmhezxrpje.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3396
  - - C:\Temp\i_rmhezxrpje.exe
      C:\Temp\i_rmhezxrpje.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2384
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jebwuomgey.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5920
  - - C:\Temp\jebwuomgey.exe
      C:\Temp\jebwuomgey.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3960
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4964
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5028
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jebwuomgey.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1500
  - - C:\Temp\i_jebwuomgey.exe
      C:\Temp\i_jebwuomgey.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2060
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljdbwtromg.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2104
  - - C:\Temp\ljdbwtromg.exe
      C:\Temp\ljdbwtromg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3564
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4760
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6544
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljdbwtromg.exe ups_ins
    3⤵
    PID:4132
  - - C:\Temp\i_ljdbwtromg.exe
      C:\Temp\i_ljdbwtromg.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2712
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\oljdbvtnlg.exe ups_run
    3⤵
    PID:7120
  - - C:\Temp\oljdbvtnlg.exe
      C:\Temp\oljdbvtnlg.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6388
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6276
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2020
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_oljdbvtnlg.exe ups_ins
    3⤵
    PID:5872
  - - C:\Temp\i_oljdbvtnlg.exe
      C:\Temp\i_oljdbvtnlg.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5672
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqlidaysql.exe ups_run
    3⤵
    PID:264
  - - C:\Temp\sqlidaysql.exe
      C:\Temp\sqlidaysql.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5208
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6892
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6420
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqlidaysql.exe ups_ins
    3⤵
    PID:2720
  - - C:\Temp\i_sqlidaysql.exe
      C:\Temp\i_sqlidaysql.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4288
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ifaxsqkica.exe ups_run
    3⤵
    PID:4404
  - - C:\Temp\ifaxsqkica.exe
      C:\Temp\ifaxsqkica.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6864
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6812
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1336
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ifaxsqkica.exe ups_ins
    3⤵
    PID:5652
  - - C:\Temp\i_ifaxsqkica.exe
      C:\Temp\i_ifaxsqkica.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1120
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nhfzxvpnhf.exe ups_run
    3⤵
    PID:2536
  - - C:\Temp\nhfzxvpnhf.exe
      C:\Temp\nhfzxvpnhf.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6564
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2752
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3560
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nhfzxvpnhf.exe ups_ins
    3⤵
    PID:6416
  - - C:\Temp\i_nhfzxvpnhf.exe
      C:\Temp\i_nhfzxvpnhf.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2816
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\causmkecxu.exe ups_run
    3⤵
    PID:5604
  - - C:\Temp\causmkecxu.exe
      C:\Temp\causmkecxu.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6636
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5504
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2636
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_causmkecxu.exe ups_ins
    3⤵
    PID:6264
  - - C:\Temp\i_causmkecxu.exe
      C:\Temp\i_causmkecxu.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1512
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\uomhecwusm.exe ups_run
    3⤵
    PID:3028
  - - C:\Temp\uomhecwusm.exe
      C:\Temp\uomhecwusm.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4544
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:880
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4928
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_uomhecwusm.exe ups_ins
    3⤵
    PID:1308
  - - C:\Temp\i_uomhecwusm.exe
      C:\Temp\i_uomhecwusm.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3312
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\urpjhbztrm.exe ups_run
    3⤵
    PID:5824
  - - C:\Temp\urpjhbztrm.exe
      C:\Temp\urpjhbztrm.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2712
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5728
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5488
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_urpjhbztrm.exe ups_ins
    3⤵
    PID:5044
  - - C:\Temp\i_urpjhbztrm.exe
      C:\Temp\i_urpjhbztrm.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4228
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wqojgbztrl.exe ups_run
    3⤵
    PID:2676
  - - C:\Temp\wqojgbztrl.exe
      C:\Temp\wqojgbztrl.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3388
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1460
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:108
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wqojgbztrl.exe ups_ins
    3⤵
    PID:4224
  - - C:\Temp\i_wqojgbztrl.exe
      C:\Temp\i_wqojgbztrl.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6420
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wqoljdbytq.exe ups_run
    3⤵
    PID:3228
  - - C:\Temp\wqoljdbytq.exe
      C:\Temp\wqoljdbytq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4400
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5596
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5748
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffc2000c188,0x7ffc2000c194,0x7ffc2000c1a0
      4⤵
      PID:4940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1688,i,4016580756232098487,16428987531273005891,262144 --field-trial-handle=2380,i,13439990625354403121,18284430478505133952,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:2
      4⤵
      PID:1868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,10089732668602062181,824744571301412625,524288 --field-trial-handle=2380,i,13439990625354403121,18284430478505133952,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:11
      4⤵
      System Time Discovery
      PID:6428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2464,i,12265402171900479879,4375753226005313839,524288 --field-trial-handle=2380,i,13439990625354403121,18284430478505133952,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:13
      4⤵
      PID:4748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3604,i,6806228970437659057,13028464440447451453,2097152 --field-trial-handle=2380,i,13439990625354403121,18284430478505133952,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
      4⤵
      PID:4944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3684,i,8176185930774955792,6775067364569515547,2097152 --field-trial-handle=2380,i,13439990625354403121,18284430478505133952,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
      4⤵
      PID:4412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,8488886030243563480,8166332631654791646,524288 --field-trial-handle=2380,i,13439990625354403121,18284430478505133952,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:14
      4⤵
      PID:5452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,9206810411198495988,3959192765361060686,524288 --field-trial-handle=2380,i,13439990625354403121,18284430478505133952,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:14
      4⤵
      PID:6200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5716,i,7631822451875615016,403225533407126869,524288 --field-trial-handle=2380,i,13439990625354403121,18284430478505133952,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:14
      4⤵
      PID:6332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5716,i,7631822451875615016,403225533407126869,524288 --field-trial-handle=2380,i,13439990625354403121,18284430478505133952,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:14
      4⤵
      PID:6868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,12088125639522915907,3959932225350859033,524288 --field-trial-handle=2380,i,13439990625354403121,18284430478505133952,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:14
      4⤵
      PID:5624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6504,i,15368499355497569317,5266597406249354466,524288 --field-trial-handle=2380,i,13439990625354403121,18284430478505133952,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:14
      4⤵
      PID:5628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6508,i,8657147823346326581,1731507304839932842,524288 --field-trial-handle=2380,i,13439990625354403121,18284430478505133952,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:14
      4⤵
      PID:5664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,14239837045919879457,1845698782867202461,524288 --field-trial-handle=2380,i,13439990625354403121,18284430478505133952,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:14
      4⤵
      PID:5468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,7896806917521507999,8014645373951951581,524288 --field-trial-handle=2380,i,13439990625354403121,18284430478505133952,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:14
      4⤵
      PID:5888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6512,i,15092595879334173555,10358036208022950474,262144 --field-trial-handle=2380,i,13439990625354403121,18284430478505133952,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:10
      4⤵
      PID:6060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,6662888553099768630,8309414236366068112,524288 --field-trial-handle=2380,i,13439990625354403121,18284430478505133952,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:14
      4⤵
      PID:4340

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2020

C:\Temp\uomgeywuomjeczur.sys
C:\Temp\uomgeywuomjeczur.sys
1⤵
- Executes dropped EXE
PID:6336

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6212

C:\Temp\jhtrljdbzt.sys
C:\Temp\jhtrljdbzt.sys
1⤵
- Executes dropped EXE
PID:6016

C:\Temp\ljgbytqojg.sys
C:\Temp\ljgbytqojg.sys
1⤵
- Executes dropped EXE
PID:5952

C:\Temp\igdyvtqoig.sys
C:\Temp\igdyvtqoig.sys
1⤵
- Executes dropped EXE
PID:2156

C:\Temp\sqnigaysqk.sys
C:\Temp\sqnigaysqk.sys
1⤵
- Executes dropped EXE
PID:2404

C:\Temp\sqkicanhfa.sys
C:\Temp\sqkicanhfa.sys
1⤵
- Executes dropped EXE
PID:124

C:\Temp\fcaxvpnhfa.sys
C:\Temp\fcaxvpnhfa.sys
1⤵
- Executes dropped EXE
PID:6824

C:\Temp\pkhczurmke.sys
C:\Temp\pkhczurmke.sys
1⤵
- Executes dropped EXE
PID:5420

C:\Temp\rmjhbzxrpm.sys
C:\Temp\rmjhbzxrpm.sys
1⤵
- Executes dropped EXE
PID:6416

C:\Temp\trmjhbztrm.sys
C:\Temp\trmjhbztrm.sys
1⤵
- Executes dropped EXE
PID:4416

C:\Temp\ljdbztromg.sys
C:\Temp\ljdbztromg.sys
1⤵
- Executes dropped EXE
PID:5444

C:\Temp\oljdbvtnlg.sys
C:\Temp\oljdbvtnlg.sys
1⤵
PID:5488

C:\Temp\tqlidbvtnl.sys
C:\Temp\tqlidbvtnl.sys
1⤵
PID:6676

C:\Temp\pnlfdxvqfa.sys
C:\Temp\pnlfdxvqfa.sys
1⤵
PID:6192

C:\Temp\qkicausnki.sys
C:\Temp\qkicausnki.sys
1⤵
PID:4860

C:\Temp\hfzxusmkic.sys
C:\Temp\hfzxusmkic.sys
1⤵
PID:5152

C:\Temp\upjhezxrpm.sys
C:\Temp\upjhezxrpm.sys
1⤵
PID:3032

C:\Temp\ezwrpmkecw.sys
C:\Temp\ezwrpmkecw.sys
1⤵
PID:1072

C:\Temp\ebwuomgbzt.sys
C:\Temp\ebwuomgbzt.sys
1⤵
PID:6676

C:\Temp\vtoljdbztr.sys
C:\Temp\vtoljdbztr.sys
1⤵
PID:4560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cxvpnhfzxs.exe

Path C:\Temp\cxvpnhfzxs.exe
Size 384KB
SHA256 68960fd73865975f7128c4925b3ff3f309d4a518b88a7e59319611cf663ace27
MD5 83c832607b183fe7c0beb02a7e2f3900
SHA1 22f6d8e3617791cd9e805e2ca09dfac4803d3310
SHA512 9044b5698f9a9df9c4aed16b3439898403438c6ffa1dbdfe092bf83442efb11d4acae37716ee13dbcce4ffbd0e301e56727a8052952a4cbd4251a7c930f624aa
SSDEEP 3072:59ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:TctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T13F847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecwuomgeyw.exe

Path C:\Temp\ecwuomgeyw.exe
Size 384KB
SHA256 ebd955901a2d31286020643d910f68ea226b710bd6f6089ec385316912189905
MD5 9e7143cdc6554b2aa21cb73e9cb28911
SHA1 d7c8139b88f5fd4477966fc98050ecfa04ad406f
SHA512 7e92d6e4f4f6dcc63ec907d34b4a9679117ef38ed832e2bf711c557b22631486e084af26280bd06726c690ee4f586f8f488ab3a2487f2c11ea4fdd3fb13ea20c
SSDEEP 3072:O9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pL:sctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T108847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fcaxvpnhfa.sys

Path C:\Temp\fcaxvpnhfa.sys
Size 293KB
SHA256 3596058e6256c76e2f4e128e1ac3083c798b89c5997b500dca775e98e6076008
MD5 9c8a72cd2c9131f7cfaf9a064f681aea
SHA1 7d4f4cf21aebd66ed2e89a2df8ef93c341be4dd7
SHA512 026afbc9a01e648f268c7ecea37402eac6774e1a40efa1b193df1e3a7af974492553e9ba37801de025f754c12ec1813b36c2cd4462ab4312cee680a6e0c6a29f
SSDEEP 3072:dtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:dIJjiJcbI03GBc3ucY5DCSj
TLSH
T146545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geyvqnljdb.exe

Path C:\Temp\geyvqnljdb.exe
Size 384KB
SHA256 1ab608c8b565a5ff3a5c9d39ab6256603c870a8ee831bba63b8f08d2efcfc542
MD5 49d768ce6d7496306d98c93666c5f92b
SHA1 3e635fa597e530f267a770d0aa757b869ae11d68
SHA512 538bb0e23212be39f78129fab88ab69b69c08c8ec4078d17c2535a6fef0d87110573d846004a4b4a7923f2baee5b0437160a72a8e6780f8fe0e1a68318291a17
SSDEEP 3072:h9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:rctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T17D847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_cxvpnhfzxs.exe

Path C:\Temp\i_cxvpnhfzxs.exe
Size 384KB
SHA256 8ff6f81818d5616ce6578307cefec0c10ccc160eb01f1afbca020d7a20990cd8
MD5 b91c4f5514a655787635751b6be22faa
SHA1 50c2f1369c5ea74ab97221b3abdd8a88abae720e
SHA512 36ce44d8b71610641c29a063cf44bfb039571517955edefcb4be9ff23b12ef0b685cfb012eda7670aa7555639907d6c4123952bb4c24b471f410f1cb74d4e6ce
SSDEEP 3072:a9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:ActFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C5847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ecwuomgeyw.exe

Path C:\Temp\i_ecwuomgeyw.exe
Size 384KB
SHA256 57922659801a40ea76db4d797a002b70f56c6acd27e81f8a31fa098ca6a908c6
MD5 4c48843c6be2bf395922381bc7f50a4d
SHA1 1cf7f0ccecd7a4d84a931a8b8201d5c31d68f188
SHA512 1f304224d8dd6914a2ce908166283e68a064cc1f28bcd2b88e12d1b0af430df9cecd80f0ad58bef0c7ba6b8d753dfe3a0f7179a69b93ed9190ded04a97074c26
SSDEEP 3072:a9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:ActFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B9847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_geyvqnljdb.exe

Path C:\Temp\i_geyvqnljdb.exe
Size 384KB
SHA256 d2de1b6e7e11b57e6771c2231e7f33bbc726cf099bdce98e4a457ca2b7eb2049
MD5 8e22c3dfc9a2ff34ed617d5a8cc9922f
SHA1 9872983bfee53def9fb45cdce7814850caca17da
SHA512 ea6511e01be91ec3759370341ca5ba2edf8b5377a4541cbf4aae12ad589da06fbf14561cb118626d4a228f2cd0e7c27e6f5d27d7633416f6bafb3e883bfaab18
SSDEEP 3072:s9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:2ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B1847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lidbvtnlfd.exe

Path C:\Temp\i_lidbvtnlfd.exe
Size 384KB
SHA256 727e87186c27469f30f00e33f9054acdf107a1ad163018d77e74fe962a818845
MD5 4ac6c2fc44f81fc887915c38ebaa9c8a
SHA1 d9eba274b4b7205cde81dd92f0c24e1b6b99b3ab
SHA512 06ea68e87ed7a8e0a71537ecacf5f7b515bb5ca255b3552abd284dec0fb8a802a0e438ca32c1f3defdfb44d462422856cb1ec3e1d53c09a12bfc52fba249beef
SSDEEP 3072:D9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:hctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D9846B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_snlidavsnl.exe

Path C:\Temp\i_snlidavsnl.exe
Size 384KB
SHA256 0fcc442461ed99bace2c2995bcd39c62a54a29302d2b41b55919e0417d5ef629
MD5 50110aadc5cb5fa4f665810e3e4a1f69
SHA1 1c593e288d1e04244ffaa4cf59e914827c83f8ef
SHA512 df26db42b9db1bd9dc3d3711490ed280281efa500a75526ad87224e24e329acde949f363862fd239609a96c0e164ebcc1e375857f16f4841bd6d6a22e472c168
SSDEEP 3072:a9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:ActFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T155847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wtrjgbzwro.exe

Path C:\Temp\i_wtrjgbzwro.exe
Size 384KB
SHA256 cd99e35166a4b6afc45729a394b41610602f5fda5a9121729c9f7eb3112f2be2
MD5 050757b638ed3ccb8de79287dacdd75f
SHA1 e5e8bd2b30ab9380920757daa8daa5c1e48e6ab1
SHA512 69a913255d2a8584b67a898a1b70cfaa454e8169683d83fec20b52d29c2164b1f2c60f99a17ada6226a4614ef61d98a2996c84e5b884092c068a4647313f994b
SSDEEP 3072:U9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:uctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T191847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igdyvtqoig.sys

Path C:\Temp\igdyvtqoig.sys
Size 293KB
SHA256 c7dc588985ae2f810ae5255b09a5a520a94c61f0b9b7dbd5ce37a7d855cc8f87
MD5 4db0301ee641bb20db1dfaac55403123
SHA1 e49804f1e868505cc63d5bf7f403b696d422147e
SHA512 f893ce642b2e49ba62629f0f71fa90a3be20e3bb61f3adc0e39e320fc0071d3bdfa02a5f73745caa57b8ab8eff01d42687b6dcbf7b1bfaa5598a23392bc0ca2d
SSDEEP 3072:4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:4IJjiJcbI03GBc3ucY5DCSj
TLSH
T16A545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhtrljdbzt.sys

Path C:\Temp\jhtrljdbzt.sys
Size 293KB
SHA256 d98040b52b1bd7d4d4567a27a8003eab9921abc1d174fd11eaacda851b8af989
MD5 7688e331c056f6b2c80a481e8c760075
SHA1 9e9c39e5ebf092cce344464b29a617202d9e8b6a
SHA512 7912708cfda8f8cbeecc96896976c515637b7859c962307237ed441721fa6bbeb2473a1c20eed3541cd959de2d2c04a0010b892d86326b343430a616f8d8d0fc
SSDEEP 3072:dtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:dIJjiJcbI03GBc3ucY5DCSj
TLSH
T175545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kfcxusmzxr.exe

Path C:\Temp\kfcxusmzxr.exe
Size 384KB
SHA256 f85f72744f2aefc0dbcabb1ff2e76aad90f5456e4228d1feb814e62e8de8ce03
MD5 cfd258806c6257e5853be74779a6f1e8
SHA1 e694a59f06cc4273e04b80b20a2cf1604567d58a
SHA512 7a2cd34c123c726e3895f817236b7e0a1ff7f9b6313b3618d28bbf84a795551a3c561f99547038231ba1233577f91b2095bccea156adbc1c5b0f30c5cf9a6291
SSDEEP 3072:v9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:1ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T132847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lidbvtnlfd.exe

Path C:\Temp\lidbvtnlfd.exe
Size 384KB
SHA256 dcce8ea574911d638a8617cbb9da75fa423aabc52a0cc39d9d8ccaf133adba84
MD5 dc0083431419c34cf6b41e0a2c88f2f4
SHA1 185c7bdf5d182013ff5ebf7b1ae731b5918deb96
SHA512 f34551484d98498f8af5172b9bb820187115e7b84f012cd61180076ed865a0ea8fd9326474ce8b0783e124f87d92058104ad2ae45a21ddeda768ea1f22d49368
SSDEEP 3072:y9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:IctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T126847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljgbytqojg.sys

Path C:\Temp\ljgbytqojg.sys
Size 293KB
SHA256 b246e0cd138023b15719fe1ef26cf16ea64c4437983eaafb24c301c663909d6e
MD5 d8114a36b4145abe2195a5e1b5e4ff56
SHA1 7add050a87922f5d4596807c9e7f41d930a06f1f
SHA512 ccb2ac7fc09582ae00088b90b7966d67404cc83b49ffa61877b8bb48c595ee039c20200c71095f789038fc656bbe7f200762bfcef0d0a50163a83b32a0b317d8
SSDEEP 3072:7tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:7IJjiJcbI03GBc3ucY5DCSj
TLSH
T13A545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snlidavsnl.exe

Path C:\Temp\snlidavsnl.exe
Size 384KB
SHA256 559a69a3c7cdb6574f50eeb51c5792da7afeab348bf998c99756c90000558391
MD5 c8f8ae29cb445bc6e7e9cf9570bfb796
SHA1 09faf822b1c9e6f4372810f0f43e4a141c5a7509
SHA512 b19e68791a5f2591e170b3fb4a9126f8c649b9e74df716297ac5fbce3aa917d5fec3c9466fb4b43f49089d097601c45610838e3d02362c964895566dc6cb6d15
SSDEEP 3072:O9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:sctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T128846B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqkicanhfa.sys

Path C:\Temp\sqkicanhfa.sys
Size 293KB
SHA256 ad4a2e1b39d147037f05eb440856b27fadb1a9d61288782f0245446fb5ec57dd
MD5 8c66607b1bbdfd1b3d1718835bd99598
SHA1 ba6119b2e901f07391ca033f25de07d53337df5f
SHA512 a286690400e07e057ead5e90caaf0aeb50a06ac1df22e02643c45f9a1e5876ec95d50060518ff45feb14639faf9a8707ca8ffdf08e6c2a0e89e61f65a682226b
SSDEEP 3072:htKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:hIJjiJcbI03GBc3ucY5DCSj
TLSH
T163545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqnigaysqk.sys

Path C:\Temp\sqnigaysqk.sys
Size 293KB
SHA256 e474c6c99bd960e8a367ec7c6ae6efea00541b6c1150fedd48cb222b26ad428e
MD5 68e7078ff35212e6d85a579e678e7256
SHA1 cd26ba1cd507a2d67d6d02a197a779f78d8cb836
SHA512 17b572a6c7e699f879b40aca8dd936fc29ccf992fc3bdd1e5f89215a0e37293846ac1ed3d09848a8e092590379a94c94a5bb6d667b4ad06dbca6ea69f4025cd0
SSDEEP 3072:wtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:wIJjiJcbI03GBc3ucY5DCSj
TLSH
T11C545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uomgeywuomjeczur.exe

Path C:\Temp\uomgeywuomjeczur.exe
Size 384KB
SHA256 c511020973bd26e736becf93ca69413988b0ee337282f995d9f467018c95f3a6
MD5 7a1c17c7ed4da83fae8b3ec0654525e1
SHA1 166234e3468dc210525e1df7c95955d513000824
SHA512 92ba75611ae93ab5b2bb9d771865d5278d6f6ad03c61b6009116e11b550a32b2d158ad0383de53a9c7d3a44b5937852b3228d0b8390c9631427ed98bb29af7a2
SSDEEP 3072:n9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:9ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1CC847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uomgeywuomjeczur.sys

Path C:\Temp\uomgeywuomjeczur.sys
Size 293KB
SHA256 1ed611670223e90c4d1a38cd5282aed5672e223cdcd4273f2a7f0ad562559770
MD5 976343592ba22af09c6434f366f60295
SHA1 65e34844961e7640736fcf8c950c5a14be9f42d2
SHA512 f786604867e33eb3ba239d3069ec5e248fe820185670c2fc743388b27fa35868109c6e579aaf608e502fe34968254ed20be403addee564ef609fcc99d11e5e38
SSDEEP 3072:PtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9Ed1:PIJjiJcbI03GBc3ucY5DCSj
TLSH
T1BE545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wtrjgbzwro.exe

Path C:\Temp\wtrjgbzwro.exe
Size 384KB
SHA256 5b329556f109d2981722187f48cf5b8c305c78457ab55c3131c1326e72a56d7a
MD5 ac1f515f787121f99ec0b74cee6223f3
SHA1 2c884f19d2e1833ffd3dc03454005cdd5ca126e5
SHA512 80c017bff09900db264c755c2691003599fa1dfb8c7840868ab60f44284e084d70d1a959f56f651719f6cb93eab510d490f3ea7249030d752a0074d64bdc4e48
SSDEEP 3072:u9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:MctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T12D847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e9e31f5fb014f6a7439a4e224bdae6d3d8b22db7c287d9c004b0184cc18e6bf8
MD5 00fe8112e1beaff1b09c3e772b0b70e6
SHA1 1d234f4d61d2fe0153bb63a7a246d37e6fc0aabe
SHA512 aaafc34862d38399e66858477aa9d3d624e9e071371fe2961aac0159845c41dbe1ed0ae62f8b9c52f327e4e4a97abdaf614ae741bcfd2627ec55b1d4f6fb6d74
TLSH
T1EAD08071B7286847D9551931D432CB017A57546365BAD1025160410C6C7BDB553CA155
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 8ae70a2c97acb8a664577f234ca4528b3fa3f1b347ab77bc09b62d4295876b02
MD5 1367b8dc423435800e0e73aba3a0542b
SHA1 d3569705cf9ee3b45d0ede2650bbd936c018930f
SHA512 fcf7c475ca69b8ec36250a1c02e40212ff3d60d0f5a47833f94814c35988485dab33d5dc7aa892edf898a45370e56a3994f8a8e7ce5313aee5dd9169474e4048
TLSH
T19CE02B65C921BC3759FD2B1860544747E740135B3B40884B3B3D812C8FB063B5387C5C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 7f3bbe0b883899db2c1746870a452f0b12cba1aa280e37d2b781223c56027c5e
MD5 31023bbbe90b0d4c8b08f01623bf6122
SHA1 eb760cfe5556a9e651009af2bdfd8dd2342574df
SHA512 975903f917fe87e3600341c92f31414084784a0fe18c4cc24a2a3ebb9aa99d309c633d4ad050e4c556b78573cbdc41d3a2334e7b9438b433d2668284cd496b6e
TLSH
T10841DFF383F4856EDA1195F0AA18AE2FCF1D0514432C7D9AC9E0AE2793E3471E041A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 b1076a96c6e1464da69185419ee1f9776e31a7ed64afa3a910402e5269a9134a
MD5 53358de46828ee8f5f27e2885094f3f5
SHA1 ef599cc414ce6d6cee6290eb4b7ccc2eef7ebad0
SHA512 0320fdc68f30bb57429a7d9ba3da3a7a9c290fcc651ad9c870013ca2f299b1ad148b3d98c8efce45178f795641ce3ef83f3a9a1150efdaa44ad2c19343ac33c1
SSDEEP 384:sxRXnqnx/f1sTCN/RIpoo/5N/WH2sGQ6Suim:sDqnx/fYgW5/5xWH2sGQ6j
TLSH
T17E72D715A9289D7BDCDBE219FA957F93D3F81173A1505E44AAFC8E0C04E66ED210382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 c2bb7b92347c0dcd819d0905c9869553cf0f3fddcb197a3a366565f67ea0d4ab
MD5 cf5e59031cc42e3a67550ac94a96a38d
SHA1 4895b8fe01f55e088d2d0048fbfcd3d967a8c2c4
SHA512 d4807a2b18a0a6a14db4533b2e402dd55d04ca4243a25713a2df6eec91869e01f4ee58a7bd7ab7619ea4c4c7732e0c61cfcf908f978d8898cb48cf9d51bd929d
SSDEEP 384:sxRXn8x/f1sFSN/RIpoo/5N/WHMsGQ6Sjs:sD8x/fKQW5/5xWHMsGQ6j
TLSH
T1B472C815AA389D7BCCDBD209FA957F53D3F81173A1905E44AAFC8A0C14E66ED210382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 79b61325c40edce613bda42feed2d5ffb60939a7d78b8001ffd6de1db3ec5578
MD5 1aef7b0ccc9b456a3d486041679d0b25
SHA1 6c6001259e3f31394e626fe859f605ebc02b444a
SHA512 12cedee28571f7cb5ec9bfaad10599fe938dc8c74e3b7cce9cd6147716864e6874bec609aa6f25c4e9b890b5acc6d16227be4517f7b4cf510d1f1a9a1de242a7
SSDEEP 768:Ob4YZx7pLuL7yTWg1NfwB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVnobbDwzroO140:Ob4YZnE7yTWg1NfwBu1jakobHwAOq0
TLSH
T13CE2FB3B280CCB7E4F804ADDEC29BD9A6DA801CF56D8C95447FA850C03C6BEB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 b9cf67f40251a5f8a7f7ec13e4a82857e359625929e539eb5ff8e79c6a5de5f5
MD5 d8baadf0d94bc2857edfdd0858852b5c
SHA1 011a23a8cd891fa78a54acd660f4b0e0b15f8334
SHA512 5f7d5ad01bf9cfe5a6a535c3954ea7471e288f84dc91930f1587f05fd956c77ff46b4772706f5e9630ad5ad712a1cfbf3b667ad970dfebdeab699d48c04832f5
SSDEEP 768:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ99toK:yv+RpPYDDRPbIhJ99toK
TLSH
T11EB23E51713F4680387EA90C9178D82F96C2B4637419E52F7BA802A65F67E03DDFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 2f6146714192ab734d6c277c13d039fb4b25d27dadcecc72e6312cae29b66c43
MD5 9da795078a9f4e54f12abb05e82e9ebc
SHA1 4f207bfb2ce70792589641015f7a5c7c4827eee6
SHA512 1d851533ac7ac39bab2bd105f1ef6e3ca676b431319e658086cf37e62c8bf161a5dad7b9b3f198fa18e1a411d8444f0e50e5add992d83360daa9755241458e55
SSDEEP 384:nNiF1tNn/s3n9Sn8NgO8TUNTUlIRiPvuTuYREqf+GGECXcMsLZOObjI9G6w7m98M:EF1j+9SXOwgUuJZGEPhZ29Mm
TLSH
T1F1C24A36E865CEB7EDE64FD9B74A7A46EEE0516785DC59C4DAC85E0C00C31AD030381A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 443f9496ef8af3b5cc00027d7e2870b15dc1bf890aec0ca7eb0497cce74c6940
MD5 f09df20f84aacaf44ca00a813671b2d0
SHA1 5183f27fdd9761973e9dfea60cbb8421de28a1cf
SHA512 1224ecc68c90baf7b8add1bf831d3d24d7e4993ddc30d347fade4fca4b1298ec6c71138b80bf96160282ab03e6f4fd8f715159c2cdd9ed1cce3b9f696e1e43d4
SSDEEP 384:nQiFiZcIw8NLY8TUNTUlIRQPvuTbYkEqf+GGECXcMlZAelaivsH8LEEIzPo0:rFQwQYwguuowGEPKaiQj
TLSH
T145C24A31ECA5CDB7ECFA9AD9B7497642EFE4516389CC9AC4D9C85E1C008719E070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 632fa71053468db89521189765e8c2a03718b8930f6631f294c42f08cb68ca93
MD5 3f84846a437789c2c600f1ac86d18b92
SHA1 16d9e573b0ff7ee406cb29eb46dd2c670574d519
SHA512 849acfa9062ffdcf24fd7fb3e2c78d27dd7f9374a48052debc2a7c95b88942be30889a1b1c29dd74bef0100c3a83a574d37b868f15018b9bf261456584154aca
SSDEEP 384:nJiF1tNn/s3n9Su8NLY8TUNTUlIRlPvuTtYkEqf+GGECXcMlZAelaE8LEEIzSQ:gF1j+9LQYwgvu6wGEPKa4
TLSH
T142B22A32E8A5CD77ECEA9AD8B74A3682DEE4516388CC9ED4DAC95D4C00C729D0707C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 c420e814c3f95a0fbac36c717d99002d71bf242cc81602f8d89d96d772340075
MD5 0c224203cf6a923a836fea6f424d8764
SHA1 fe516fd88145a36f6da066ae35dde684b2608e62
SHA512 cc4a74ee541528a317ac37a7a35e49ef4b46193074361ec1d8371ead76d2c05de4d0bf8c1e2043c07e0847c6cb6f72d1916e36188ea78a0a348da4ff5803b62b
SSDEEP 384:nJiFiZcIw8NLY8TUNTUlIRQPvuTbYkEqf+GGECXcMlZAelaivsH8LEEIzPo0:gFQwQYwguuowGEPKaiQj
TLSH
T1B0C24A31ECA5CDB7ECFA9AD8B7497642EFE4516389CC9AC4D9C85E0C008759E070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 f3f26e7390fdcf12b621e7bd68455ae96bca63cddea5b1a0bd333c8ddd1ad116
MD5 576bdebccc117bd60d46488499a98d57
SHA1 8f5c8384aa5edd304494c91a3338b0e2df5a2763
SHA512 ce866326f8bd1b927bea1abdf1c83abaeabf387f3f5ec533c421e8af8958c81d0c0c81c26125d4989dc9c7c7f3d385df8c90b3630b4a446b30b0d3b4996e3564
SSDEEP 384:nsiF1tNn/s3n9Sn8NgY8TUNTUlIRiPvuTVhkEqf+GGECXcMlZAekaOObjI9G6w7m:XF1j+9SXYwgUubwGEP9a29Mm
TLSH
T15EC25B36E855CE77ECE74EE8B74A3686EEE051B389CC5AC8EAC85D4C00C719D070781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 8e317bd48961be11e889ef8f9108d7ae8eacdc4e996c860a83f044fd4abfcb84
MD5 a2f538e7eadddd7a72410353cae05b8a
SHA1 b0631a8fbd5901b8637653c7df8a699a49a89eb8
SHA512 b3e4062744fda312a278988eed352caea1544f279ce7c3d3be0c120c0fbc1a94b6323f42111dd812384404816431da8c3f957dd99857271b64b20372c0a96e90
SSDEEP 384:nuiFiZcId8NLY8TUNTUlIRQPvuTbFkEqf+GGECXcMlZAdBaivsH8LEEIzPo0:FFQdQYwguuVwGEPRaiQj
TLSH
T106E2A2F198D78977E8AE9B97A77D2D429AFCD063B4884984B7C44D0CCC861BFC706816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 462d7e808963e2604c30ade17e2177d755e533a3d5aafcfbd2a338e44dc14cbc
MD5 4f68dd1a44247528a0d6d45f87ce7cac
SHA1 915377a893f8c5ecd5719a8c912769fc0dcc13d7
SHA512 a6b09d5a431c47f0a1fa3a5c33b691431b8ae6599019bd7234d89ea7c4b0db1b23099541e7816a87f856c0237ad1af9b703afe90f4f88c203704e09c67a9d5bd
TLSH
T1724163D04C391AC1D4BD0E6FB45B29FC94ECD726F490347C2858EA98567E65E314083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 a3278f957234771d848a4b3ee9901aeec341d2434b924c995300d2e0713b1b7b
MD5 893e4b2373eda936d6ab8fb4a1e8c47b
SHA1 5dfe17ef2f135c6fe6fcf58b53b0628e776e1f54
SHA512 1a716a864fce6b95f1feb9176544c1cf943db5897e41d0030e0c9ace03815ee6a21880b6a9211f32946768874b0c281da0606c7d4c602fd416ce3f6e05c06a5e
TLSH
T119412FE04C391AD1D4BE0E6EB45729FC94EC9726F89434382858EA98967A65E358083F
MD5 SHA1 SHA512 TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 7e7505dc2356693c69cdfc5f071feb49e0642bfe2b53c2472d7321731cc207ee
MD5 f02399ec919e28a7beb27774b25b8d63
SHA1 d1c435126aa3b50fba59126b2d9d050ee44b0723
SHA512 21b62a6edd9f823e23c6ef5a94c8f2d67fc255a655a98a94b9f372bdaf207b2d1e8a87a24f99cd53936472ff7705d4132ad537a67c89b7145c5a946a8596d17e
TLSH
T11F7123835BB9DAF3C1DA5BF502835648F6FB22784B2330300B555586AB30B7E58B8F08
MD5 SHA1 SHA512 TLSH

Submit Download

memory/124-235-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1072-367-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2156-209-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2404-222-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3032-361-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4416-285-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4560-412-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4860-352-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5152-356-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5420-277-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5444-310-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5488-314-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5952-189-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6016-154-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6192-335-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6336-61-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6416-281-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6676-318-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6676-392-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6824-271-0x0000000000010000-0x00000000000AB000-memory.dmp

Download