systex | 09f838cfefd91b78515a861294df6c28517e4f469978dae74f6f43c4ba31bdf7

Analysis

max time kernel
149s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 09:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_d31fa251096abccfdf422c999a933e52_amadey_darkgate_elex_smoke-loader_stop.exe
Size 384KB
Sample260820-lh1mzstema
SHA256 09f838cfefd91b78515a861294df6c28517e4f469978dae74f6f43c4ba31bdf7
MD5 d31fa251096abccfdf422c999a933e52
SHA1 290624d412da5a474643c3e90bb1d8c69c8b32e3
SHA512 a773334d24ffad2d7277c2d9a3a3de3697cf82bcc0521254d3be5af92958f9bf2924712385dbfc5c49c641d5585e5793fed09184f8d18ad6ce8f8cc4e50da271
SSDEEP 3072:d9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:vctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T13F847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
1380	rpbwuomgebzurojh.exe
2372	rpbwuomgebzurojh.sys
1932	CreateProcess.exe
1172	trmjhbzwrm.exe
5416	CreateProcess.exe
2356	CreateProcess.exe
5856	i_trmjhbzwrm.exe
1524	cwuomgezwr.sys
4364	CreateProcess.exe
6012	mgeywqojgb.exe
5556	CreateProcess.exe
2080	CreateProcess.exe
2952	i_mgeywqojgb.exe
5912	zwrljgbztr.sys
3128	CreateProcess.exe
4564	rlgeywqoig.exe
1516	CreateProcess.exe
4832	CreateProcess.exe
2864	i_rlgeywqoig.exe
5372	ligayvtnlj.sys
4896	CreateProcess.exe
5064	nlgdyvqoig.exe
1736	CreateProcess.exe
2568	CreateProcess.exe
5856	i_nlgdyvqoig.exe
4076	kigaysqlid.sys
4920	CreateProcess.exe
5484	aysnlidxvq.exe
1376	CreateProcess.exe
1496	CreateProcess.exe
928	i_aysnlidxvq.exe
4680	ysqkifaxvq.sys
4296	CreateProcess.exe
1544	nkicausnkf.exe
1164	CreateProcess.exe
2524	CreateProcess.exe
200	i_nkicausnkf.exe
4772	faxspkicau.sys
872	CreateProcess.exe
2872	faxsqkicau.exe
5948	CreateProcess.exe
2764	CreateProcess.exe
3148	i_faxsqkicau.exe
5736	xrpjhczusp.sys
1440	CreateProcess.exe
3320	uspkhfcaus.exe
5380	CreateProcess.exe
4524	CreateProcess.exe
2536	i_uspkhfcaus.exe
2896	urmkecwuom.sys
4288	CreateProcess.exe
5836	khczurmkec.exe
4308	CreateProcess.exe
3408	CreateProcess.exe
4792	i_khczurmkec.exe
4924	jhbzurmjeb.sys
5816	CreateProcess.exe
4972	tromgebztr.exe
5312	CreateProcess.exe
2440	CreateProcess.exe
4668	i_tromgebztr.exe
3428	bztrljdbwt.sys
4260	CreateProcess.exe
2424	bywqojgeyw.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping996_753175875\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkicausnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faxsqkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uspkhfcaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bywqojgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvtrlgdywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usnkfdxvsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_avsmkfcaxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_upnhfzxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkecwurmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smkecwurmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gebwuomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trmjhbzwrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgeywqojgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_khczurmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tromgebztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upnhfzxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljgebwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_d31fa251096abccfdf422c999a933e52_amadey_darkgate_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rlgeywqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bywqojgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnlfdbvtqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usnkfdxvsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tromgebztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnlfdbvtqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljgebwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtrlgdywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlgdyvqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uspkhfcaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	khczurmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gebwuomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgeywqojgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rlgeywqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlgdyvqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faxsqkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avsmkfcaxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpbwuomgebzurojh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trmjhbzwrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysnlidxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysnlidxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkicausnkf.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4660	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5248	ipconfig.exe
260	ipconfig.exe
3520	ipconfig.exe
5340	ipconfig.exe
4400	ipconfig.exe
5768	ipconfig.exe
5528	ipconfig.exe
5300	ipconfig.exe
4616	ipconfig.exe
2716	ipconfig.exe
1828	ipconfig.exe
3400	ipconfig.exe
4688	ipconfig.exe
4976	ipconfig.exe
4216	ipconfig.exe
8	ipconfig.exe
928	ipconfig.exe
2780	ipconfig.exe
1004	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134316919781861240"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{02D5E291-B94C-4F9A-843A-3E975699A2BD}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3184	2026-08-20_d31fa251096abccfdf422c999a933e52_amadey_darkgate_elex_smoke-loader_stop.exe
3184	2026-08-20_d31fa251096abccfdf422c999a933e52_amadey_darkgate_elex_smoke-loader_stop.exe
3184	2026-08-20_d31fa251096abccfdf422c999a933e52_amadey_darkgate_elex_smoke-loader_stop.exe
3184	2026-08-20_d31fa251096abccfdf422c999a933e52_amadey_darkgate_elex_smoke-loader_stop.exe
3184	2026-08-20_d31fa251096abccfdf422c999a933e52_amadey_darkgate_elex_smoke-loader_stop.exe
3184	2026-08-20_d31fa251096abccfdf422c999a933e52_amadey_darkgate_elex_smoke-loader_stop.exe
3184	2026-08-20_d31fa251096abccfdf422c999a933e52_amadey_darkgate_elex_smoke-loader_stop.exe
3184	2026-08-20_d31fa251096abccfdf422c999a933e52_amadey_darkgate_elex_smoke-loader_stop.exe
3184	2026-08-20_d31fa251096abccfdf422c999a933e52_amadey_darkgate_elex_smoke-loader_stop.exe
3184	2026-08-20_d31fa251096abccfdf422c999a933e52_amadey_darkgate_elex_smoke-loader_stop.exe
3184	2026-08-20_d31fa251096abccfdf422c999a933e52_amadey_darkgate_elex_smoke-loader_stop.exe
3184	2026-08-20_d31fa251096abccfdf422c999a933e52_amadey_darkgate_elex_smoke-loader_stop.exe
3184	2026-08-20_d31fa251096abccfdf422c999a933e52_amadey_darkgate_elex_smoke-loader_stop.exe
3184	2026-08-20_d31fa251096abccfdf422c999a933e52_amadey_darkgate_elex_smoke-loader_stop.exe
3184	2026-08-20_d31fa251096abccfdf422c999a933e52_amadey_darkgate_elex_smoke-loader_stop.exe
3184	2026-08-20_d31fa251096abccfdf422c999a933e52_amadey_darkgate_elex_smoke-loader_stop.exe
3184	2026-08-20_d31fa251096abccfdf422c999a933e52_amadey_darkgate_elex_smoke-loader_stop.exe
3184	2026-08-20_d31fa251096abccfdf422c999a933e52_amadey_darkgate_elex_smoke-loader_stop.exe
3184	2026-08-20_d31fa251096abccfdf422c999a933e52_amadey_darkgate_elex_smoke-loader_stop.exe
3184	2026-08-20_d31fa251096abccfdf422c999a933e52_amadey_darkgate_elex_smoke-loader_stop.exe
3184	2026-08-20_d31fa251096abccfdf422c999a933e52_amadey_darkgate_elex_smoke-loader_stop.exe
3184	2026-08-20_d31fa251096abccfdf422c999a933e52_amadey_darkgate_elex_smoke-loader_stop.exe
3184	2026-08-20_d31fa251096abccfdf422c999a933e52_amadey_darkgate_elex_smoke-loader_stop.exe
3184	2026-08-20_d31fa251096abccfdf422c999a933e52_amadey_darkgate_elex_smoke-loader_stop.exe
3184	2026-08-20_d31fa251096abccfdf422c999a933e52_amadey_darkgate_elex_smoke-loader_stop.exe
3184	2026-08-20_d31fa251096abccfdf422c999a933e52_amadey_darkgate_elex_smoke-loader_stop.exe
3184	2026-08-20_d31fa251096abccfdf422c999a933e52_amadey_darkgate_elex_smoke-loader_stop.exe
3184	2026-08-20_d31fa251096abccfdf422c999a933e52_amadey_darkgate_elex_smoke-loader_stop.exe
3184	2026-08-20_d31fa251096abccfdf422c999a933e52_amadey_darkgate_elex_smoke-loader_stop.exe
3184	2026-08-20_d31fa251096abccfdf422c999a933e52_amadey_darkgate_elex_smoke-loader_stop.exe
3184	2026-08-20_d31fa251096abccfdf422c999a933e52_amadey_darkgate_elex_smoke-loader_stop.exe
3184	2026-08-20_d31fa251096abccfdf422c999a933e52_amadey_darkgate_elex_smoke-loader_stop.exe
3184	2026-08-20_d31fa251096abccfdf422c999a933e52_amadey_darkgate_elex_smoke-loader_stop.exe
3184	2026-08-20_d31fa251096abccfdf422c999a933e52_amadey_darkgate_elex_smoke-loader_stop.exe
3184	2026-08-20_d31fa251096abccfdf422c999a933e52_amadey_darkgate_elex_smoke-loader_stop.exe
1380	rpbwuomgebzurojh.exe
3184	2026-08-20_d31fa251096abccfdf422c999a933e52_amadey_darkgate_elex_smoke-loader_stop.exe
1380	rpbwuomgebzurojh.exe
3184	2026-08-20_d31fa251096abccfdf422c999a933e52_amadey_darkgate_elex_smoke-loader_stop.exe
3184	2026-08-20_d31fa251096abccfdf422c999a933e52_amadey_darkgate_elex_smoke-loader_stop.exe
1380	rpbwuomgebzurojh.exe
1380	rpbwuomgebzurojh.exe
1380	rpbwuomgebzurojh.exe
3184	2026-08-20_d31fa251096abccfdf422c999a933e52_amadey_darkgate_elex_smoke-loader_stop.exe
1380	rpbwuomgebzurojh.exe
3184	2026-08-20_d31fa251096abccfdf422c999a933e52_amadey_darkgate_elex_smoke-loader_stop.exe
1380	rpbwuomgebzurojh.exe
1380	rpbwuomgebzurojh.exe
3184	2026-08-20_d31fa251096abccfdf422c999a933e52_amadey_darkgate_elex_smoke-loader_stop.exe
3184	2026-08-20_d31fa251096abccfdf422c999a933e52_amadey_darkgate_elex_smoke-loader_stop.exe
1380	rpbwuomgebzurojh.exe
1380	rpbwuomgebzurojh.exe
3184	2026-08-20_d31fa251096abccfdf422c999a933e52_amadey_darkgate_elex_smoke-loader_stop.exe
3184	2026-08-20_d31fa251096abccfdf422c999a933e52_amadey_darkgate_elex_smoke-loader_stop.exe
1380	rpbwuomgebzurojh.exe
1380	rpbwuomgebzurojh.exe
3184	2026-08-20_d31fa251096abccfdf422c999a933e52_amadey_darkgate_elex_smoke-loader_stop.exe
3184	2026-08-20_d31fa251096abccfdf422c999a933e52_amadey_darkgate_elex_smoke-loader_stop.exe
1380	rpbwuomgebzurojh.exe
1380	rpbwuomgebzurojh.exe
3184	2026-08-20_d31fa251096abccfdf422c999a933e52_amadey_darkgate_elex_smoke-loader_stop.exe
3184	2026-08-20_d31fa251096abccfdf422c999a933e52_amadey_darkgate_elex_smoke-loader_stop.exe
3184	2026-08-20_d31fa251096abccfdf422c999a933e52_amadey_darkgate_elex_smoke-loader_stop.exe
3184	2026-08-20_d31fa251096abccfdf422c999a933e52_amadey_darkgate_elex_smoke-loader_stop.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	5856	i_trmjhbzwrm.exe
Token: SeDebugPrivilege	2952	i_mgeywqojgb.exe
Token: SeDebugPrivilege	2864	i_rlgeywqoig.exe
Token: SeDebugPrivilege	5856	i_nlgdyvqoig.exe
Token: SeDebugPrivilege	928	i_aysnlidxvq.exe
Token: SeDebugPrivilege	200	i_nkicausnkf.exe
Token: SeDebugPrivilege	3148	i_faxsqkicau.exe
Token: SeDebugPrivilege	2536	i_uspkhfcaus.exe
Token: SeDebugPrivilege	4792	i_khczurmkec.exe
Token: SeDebugPrivilege	4668	i_tromgebztr.exe
Token: SeDebugPrivilege	4340	i_bywqojgeyw.exe
Token: SeDebugPrivilege	2084	i_bvtrlgdywq.exe
Token: SeDebugPrivilege	5220	i_qnlfdbvtqn.exe
Token: SeDebugPrivilege	4784	i_usnkfdxvsq.exe
Token: SeDebugPrivilege	1108	i_avsmkfcaxv.exe
Token: SeDebugPrivilege	1048	i_upnhfzxvpn.exe
Token: SeDebugPrivilege	3428	i_smkecwurmj.exe
Token: SeDebugPrivilege	4480	i_gebwuomgey.exe
Token: SeDebugPrivilege	1084	i_ljgebwuomg.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
996	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3184 wrote to memory of 1380	3184	2026-08-20_d31fa251096abccfdf422c999a933e52_amadey_darkgate_elex_smoke-loader_stop.exe	89
PID 3184 wrote to memory of 4948	3184	2026-08-20_d31fa251096abccfdf422c999a933e52_amadey_darkgate_elex_smoke-loader_stop.exe	90
PID 4948 wrote to memory of 996	4948	iexplore.exe	91
PID 996 wrote to memory of 1972	996	msedge.exe	92
PID 996 wrote to memory of 4276	996	msedge.exe	94
PID 996 wrote to memory of 4660	996	msedge.exe	95
PID 996 wrote to memory of 4276	996	msedge.exe	94
PID 996 wrote to memory of 4276	996	msedge.exe	94
PID 996 wrote to memory of 3264	996	msedge.exe	96
PID 996 wrote to memory of 3264	996	msedge.exe	96
PID 996 wrote to memory of 3564	996	msedge.exe	97
PID 996 wrote to memory of 3564	996	msedge.exe	97
PID 996 wrote to memory of 4104	996	msedge.exe	98
PID 996 wrote to memory of 3564	996	msedge.exe	97
PID 996 wrote to memory of 4104	996	msedge.exe	98
PID 996 wrote to memory of 4104	996	msedge.exe	98
PID 996 wrote to memory of 3088	996	msedge.exe	99
PID 996 wrote to memory of 3088	996	msedge.exe	99
PID 996 wrote to memory of 3088	996	msedge.exe	99
PID 996 wrote to memory of 3440	996	msedge.exe	100
PID 996 wrote to memory of 3440	996	msedge.exe	100
PID 996 wrote to memory of 3440	996	msedge.exe	100
PID 996 wrote to memory of 3892	996	msedge.exe	102
PID 996 wrote to memory of 3892	996	msedge.exe	102
PID 1380 wrote to memory of 1932	1380	rpbwuomgebzurojh.exe	105
PID 1172 wrote to memory of 5416	1172	trmjhbzwrm.exe	108
PID 996 wrote to memory of 2960	996	msedge.exe	111
PID 996 wrote to memory of 2040	996	msedge.exe	112
PID 996 wrote to memory of 2960	996	msedge.exe	111
PID 996 wrote to memory of 2040	996	msedge.exe	112
PID 996 wrote to memory of 5800	996	msedge.exe	114
PID 996 wrote to memory of 3448	996	msedge.exe	115
PID 996 wrote to memory of 3448	996	msedge.exe	115
PID 996 wrote to memory of 3220	996	msedge.exe	116
PID 996 wrote to memory of 3220	996	msedge.exe	116
PID 1380 wrote to memory of 2356	1380	rpbwuomgebzurojh.exe	119
PID 1380 wrote to memory of 4364	1380	rpbwuomgebzurojh.exe	123
PID 6012 wrote to memory of 5556	6012	mgeywqojgb.exe	125
PID 1380 wrote to memory of 2080	1380	rpbwuomgebzurojh.exe	128
PID 1380 wrote to memory of 3128	1380	rpbwuomgebzurojh.exe	132
PID 4564 wrote to memory of 1516	4564	rlgeywqoig.exe	134
PID 1380 wrote to memory of 4832	1380	rpbwuomgebzurojh.exe	137
PID 1380 wrote to memory of 4896	1380	rpbwuomgebzurojh.exe	142
PID 5064 wrote to memory of 1736	5064	nlgdyvqoig.exe	144
PID 1380 wrote to memory of 2568	1380	rpbwuomgebzurojh.exe	147
PID 996 wrote to memory of 1004	996	msedge.exe	149
PID 996 wrote to memory of 3472	996	msedge.exe	150
PID 996 wrote to memory of 4524	996	msedge.exe	151
PID 1380 wrote to memory of 4920	1380	rpbwuomgebzurojh.exe	154
PID 5484 wrote to memory of 1376	5484	aysnlidxvq.exe	156
PID 1380 wrote to memory of 1496	1380	rpbwuomgebzurojh.exe	159
PID 1380 wrote to memory of 4296	1380	rpbwuomgebzurojh.exe	163
PID 1544 wrote to memory of 1164	1544	nkicausnkf.exe	165
PID 1380 wrote to memory of 2524	1380	rpbwuomgebzurojh.exe	168
PID 1380 wrote to memory of 872	1380	rpbwuomgebzurojh.exe	172
PID 2872 wrote to memory of 5948	2872	faxsqkicau.exe	174
PID 1380 wrote to memory of 2764	1380	rpbwuomgebzurojh.exe	177
PID 1380 wrote to memory of 1440	1380	rpbwuomgebzurojh.exe	181
PID 3320 wrote to memory of 5380	3320	uspkhfcaus.exe	183
PID 1380 wrote to memory of 4524	1380	rpbwuomgebzurojh.exe	186
PID 996 wrote to memory of 4556	996	msedge.exe	188
PID 996 wrote to memory of 4556	996	msedge.exe	188
PID 1380 wrote to memory of 4288	1380	rpbwuomgebzurojh.exe	194
PID 5836 wrote to memory of 4308	5836	khczurmkec.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-08-20_d31fa251096abccfdf422c999a933e52_amadey_darkgate_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_d31fa251096abccfdf422c999a933e52_amadey_darkgate_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3184
- C:\Temp\rpbwuomgebzurojh.exe
  C:\Temp\rpbwuomgebzurojh.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1380
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\trmjhbzwrm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1932
  - - C:\Temp\trmjhbzwrm.exe
      C:\Temp\trmjhbzwrm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1172
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5416
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4688
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_trmjhbzwrm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2356
  - - C:\Temp\i_trmjhbzwrm.exe
      C:\Temp\i_trmjhbzwrm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5856
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mgeywqojgb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4364
  - - C:\Temp\mgeywqojgb.exe
      C:\Temp\mgeywqojgb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6012
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5556
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4976
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mgeywqojgb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2080
  - - C:\Temp\i_mgeywqojgb.exe
      C:\Temp\i_mgeywqojgb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2952
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rlgeywqoig.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3128
  - - C:\Temp\rlgeywqoig.exe
      C:\Temp\rlgeywqoig.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4564
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1516
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5768
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rlgeywqoig.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4832
  - - C:\Temp\i_rlgeywqoig.exe
      C:\Temp\i_rlgeywqoig.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2864
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nlgdyvqoig.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4896
  - - C:\Temp\nlgdyvqoig.exe
      C:\Temp\nlgdyvqoig.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5064
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1736
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5528
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nlgdyvqoig.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2568
  - - C:\Temp\i_nlgdyvqoig.exe
      C:\Temp\i_nlgdyvqoig.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5856
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\aysnlidxvq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4920
  - - C:\Temp\aysnlidxvq.exe
      C:\Temp\aysnlidxvq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5484
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1376
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5300
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_aysnlidxvq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1496
  - - C:\Temp\i_aysnlidxvq.exe
      C:\Temp\i_aysnlidxvq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:928
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nkicausnkf.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4296
  - - C:\Temp\nkicausnkf.exe
      C:\Temp\nkicausnkf.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1544
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1164
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2780
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nkicausnkf.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2524
  - - C:\Temp\i_nkicausnkf.exe
      C:\Temp\i_nkicausnkf.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:200
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\faxsqkicau.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:872
  - - C:\Temp\faxsqkicau.exe
      C:\Temp\faxsqkicau.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2872
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5948
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4216
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_faxsqkicau.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2764
  - - C:\Temp\i_faxsqkicau.exe
      C:\Temp\i_faxsqkicau.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3148
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\uspkhfcaus.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1440
  - - C:\Temp\uspkhfcaus.exe
      C:\Temp\uspkhfcaus.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3320
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5380
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1004
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_uspkhfcaus.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4524
  - - C:\Temp\i_uspkhfcaus.exe
      C:\Temp\i_uspkhfcaus.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2536
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\khczurmkec.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4288
  - - C:\Temp\khczurmkec.exe
      C:\Temp\khczurmkec.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5836
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4308
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3520
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_khczurmkec.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3408
  - - C:\Temp\i_khczurmkec.exe
      C:\Temp\i_khczurmkec.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4792
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tromgebztr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5816
  - - C:\Temp\tromgebztr.exe
      C:\Temp\tromgebztr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4972
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5312
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5248
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tromgebztr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2440
  - - C:\Temp\i_tromgebztr.exe
      C:\Temp\i_tromgebztr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4668
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bywqojgeyw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4260
  - - C:\Temp\bywqojgeyw.exe
      C:\Temp\bywqojgeyw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2424
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1428
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4616
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bywqojgeyw.exe ups_ins
    3⤵
    PID:4628
  - - C:\Temp\i_bywqojgeyw.exe
      C:\Temp\i_bywqojgeyw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4340
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bvtrlgdywq.exe ups_run
    3⤵
    PID:4388
  - - C:\Temp\bvtrlgdywq.exe
      C:\Temp\bvtrlgdywq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1588
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4848
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5340
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bvtrlgdywq.exe ups_ins
    3⤵
    PID:4612
  - - C:\Temp\i_bvtrlgdywq.exe
      C:\Temp\i_bvtrlgdywq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2084
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qnlfdbvtqn.exe ups_run
    3⤵
    PID:4876
  - - C:\Temp\qnlfdbvtqn.exe
      C:\Temp\qnlfdbvtqn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4216
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5704
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:8
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qnlfdbvtqn.exe ups_ins
    3⤵
    PID:2740
  - - C:\Temp\i_qnlfdbvtqn.exe
      C:\Temp\i_qnlfdbvtqn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5220
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\usnkfdxvsq.exe ups_run
    3⤵
    PID:4808
  - - C:\Temp\usnkfdxvsq.exe
      C:\Temp\usnkfdxvsq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2936
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4336
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4400
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_usnkfdxvsq.exe ups_ins
    3⤵
    PID:5168
  - - C:\Temp\i_usnkfdxvsq.exe
      C:\Temp\i_usnkfdxvsq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4784
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\avsmkfcaxv.exe ups_run
    3⤵
    PID:5324
  - - C:\Temp\avsmkfcaxv.exe
      C:\Temp\avsmkfcaxv.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3432
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4768
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2716
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_avsmkfcaxv.exe ups_ins
    3⤵
    PID:1100
  - - C:\Temp\i_avsmkfcaxv.exe
      C:\Temp\i_avsmkfcaxv.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1108
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\upnhfzxvpn.exe ups_run
    3⤵
    PID:4968
  - - C:\Temp\upnhfzxvpn.exe
      C:\Temp\upnhfzxvpn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5788
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:480
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1828
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_upnhfzxvpn.exe ups_ins
    3⤵
    PID:2628
  - - C:\Temp\i_upnhfzxvpn.exe
      C:\Temp\i_upnhfzxvpn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1048
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\smkecwurmj.exe ups_run
    3⤵
    PID:2736
  - - C:\Temp\smkecwurmj.exe
      C:\Temp\smkecwurmj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5956
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:900
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:260
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_smkecwurmj.exe ups_ins
    3⤵
    PID:4936
  - - C:\Temp\i_smkecwurmj.exe
      C:\Temp\i_smkecwurmj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3428
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gebwuomgey.exe ups_run
    3⤵
    PID:1004
  - - C:\Temp\gebwuomgey.exe
      C:\Temp\gebwuomgey.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2348
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2496
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3400
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gebwuomgey.exe ups_ins
    3⤵
    PID:2560
  - - C:\Temp\i_gebwuomgey.exe
      C:\Temp\i_gebwuomgey.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4480
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljgebwuomg.exe ups_run
    3⤵
    PID:5880
  - - C:\Temp\ljgebwuomg.exe
      C:\Temp\ljgebwuomg.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2600
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4552
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:928
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljgebwuomg.exe ups_ins
    3⤵
    PID:3560
  - - C:\Temp\i_ljgebwuomg.exe
      C:\Temp\i_ljgebwuomg.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1084
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x2c4,0x7ff9024bc188,0x7ff9024bc194,0x7ff9024bc1a0
      4⤵
      PID:1972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2000,i,6440684894344335720,6038906295685903118,262144 --field-trial-handle=2464,i,12482527158690874687,11611892591714218027,262144 --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:2
      4⤵
      PID:4276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2184,i,733607621545887281,2584987314253902343,524288 --field-trial-handle=2464,i,12482527158690874687,11611892591714218027,262144 --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:11
      4⤵
      System Time Discovery
      PID:4660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2640,i,5414050207646635618,12115066026550074610,524288 --field-trial-handle=2464,i,12482527158690874687,11611892591714218027,262144 --variations-seed-version --mojo-platform-channel-handle=3328 /prefetch:13
      4⤵
      PID:3264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3608,i,9106390567470041387,13846059723259250273,2097152 --field-trial-handle=2464,i,12482527158690874687,11611892591714218027,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:1
      4⤵
      PID:3564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3612,i,1046742344325683033,3920309758725171137,2097152 --field-trial-handle=2464,i,12482527158690874687,11611892591714218027,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:1
      4⤵
      PID:4104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4268,i,9801083082778561697,16074288592354423107,2097152 --field-trial-handle=2464,i,12482527158690874687,11611892591714218027,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:1
      4⤵
      PID:3088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4340,i,13558172712672547537,9459474186602690721,2097152 --field-trial-handle=2464,i,12482527158690874687,11611892591714218027,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:9
      4⤵
      PID:3440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3800,i,7813938472743231431,8420249639243440362,524288 --field-trial-handle=2464,i,12482527158690874687,11611892591714218027,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:14
      4⤵
      PID:3892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,4561450360185797620,16512887088112669141,524288 --field-trial-handle=2464,i,12482527158690874687,11611892591714218027,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
      4⤵
      PID:2960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5508,i,4912148141592465972,775063833818797629,524288 --field-trial-handle=2464,i,12482527158690874687,11611892591714218027,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:14
      4⤵
      PID:2040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,12259277628979451887,12668088678673423465,524288 --field-trial-handle=2464,i,12482527158690874687,11611892591714218027,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:14
      4⤵
      PID:1588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,12259277628979451887,12668088678673423465,524288 --field-trial-handle=2464,i,12482527158690874687,11611892591714218027,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:14
      4⤵
      PID:5800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,5544466198240124893,553875332031315086,524288 --field-trial-handle=2464,i,12482527158690874687,11611892591714218027,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:14
      4⤵
      PID:3448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6556,i,11499487475673502542,12578128745381637529,524288 --field-trial-handle=2464,i,12482527158690874687,11611892591714218027,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:14
      4⤵
      PID:3220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4712,i,15667407516327085363,10514655269365318213,524288 --field-trial-handle=2464,i,12482527158690874687,11611892591714218027,262144 --variations-seed-version --mojo-platform-channel-handle=1304 /prefetch:14
      4⤵
      PID:1004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,12876348631423306580,3580931948511959653,524288 --field-trial-handle=2464,i,12482527158690874687,11611892591714218027,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:14
      4⤵
      PID:3472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,967763827891063877,3252222435301432938,524288 --field-trial-handle=2464,i,12482527158690874687,11611892591714218027,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:14
      4⤵
      PID:4524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,5467466571080587835,2835765389733998267,524288 --field-trial-handle=2464,i,12482527158690874687,11611892591714218027,262144 --variations-seed-version --mojo-platform-channel-handle=316 /prefetch:14
      4⤵
      PID:4556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=920,i,11873095919669875297,17396855840430740762,524288 --field-trial-handle=2464,i,12482527158690874687,11611892591714218027,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:14
      4⤵
      PID:1788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6028,i,15253181972879462757,8169831872196780014,262144 --field-trial-handle=2464,i,12482527158690874687,11611892591714218027,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:10
      4⤵
      PID:3564

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2356

C:\Temp\rpbwuomgebzurojh.sys
C:\Temp\rpbwuomgebzurojh.sys
1⤵
- Executes dropped EXE
PID:2372

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5816

C:\Temp\cwuomgezwr.sys
C:\Temp\cwuomgezwr.sys
1⤵
- Executes dropped EXE
PID:1524

C:\Temp\zwrljgbztr.sys
C:\Temp\zwrljgbztr.sys
1⤵
- Executes dropped EXE
PID:5912

C:\Temp\ligayvtnlj.sys
C:\Temp\ligayvtnlj.sys
1⤵
- Executes dropped EXE
PID:5372

C:\Temp\kigaysqlid.sys
C:\Temp\kigaysqlid.sys
1⤵
- Executes dropped EXE
PID:4076

C:\Temp\ysqkifaxvq.sys
C:\Temp\ysqkifaxvq.sys
1⤵
- Executes dropped EXE
PID:4680

C:\Temp\faxspkicau.sys
C:\Temp\faxspkicau.sys
1⤵
- Executes dropped EXE
PID:4772

C:\Temp\xrpjhczusp.sys
C:\Temp\xrpjhczusp.sys
1⤵
- Executes dropped EXE
PID:5736

C:\Temp\urmkecwuom.sys
C:\Temp\urmkecwuom.sys
1⤵
- Executes dropped EXE
PID:2896

C:\Temp\jhbzurmjeb.sys
C:\Temp\jhbzurmjeb.sys
1⤵
- Executes dropped EXE
PID:4924

C:\Temp\bztrljdbwt.sys
C:\Temp\bztrljdbwt.sys
1⤵
- Executes dropped EXE
PID:3428

C:\Temp\oigbytqolg.sys
C:\Temp\oigbytqolg.sys
1⤵
PID:1268

C:\Temp\ytqlidbvtn.sys
C:\Temp\ytqlidbvtn.sys
1⤵
PID:4264

C:\Temp\lidavtnlfd.sys
C:\Temp\lidavtnlfd.sys
1⤵
PID:4112

C:\Temp\axsqkifaxs.sys
C:\Temp\axsqkifaxs.sys
1⤵
PID:3852

C:\Temp\ausmkhcaus.sys
C:\Temp\ausmkhcaus.sys
1⤵
PID:256

C:\Temp\usmkecwuom.sys
C:\Temp\usmkecwuom.sys
1⤵
PID:5760

C:\Temp\pjhecwurpj.sys
C:\Temp\pjhecwurpj.sys
1⤵
PID:2500

C:\Temp\rljebwtomg.sys
C:\Temp\rljebwtomg.sys
1⤵
PID:5772

C:\Temp\idbvtolgdy.sys
C:\Temp\idbvtolgdy.sys
1⤵
PID:2880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aysnlidxvq.exe

Path C:\Temp\aysnlidxvq.exe
Size 384KB
SHA256 ff217af7e45d56bfb742674da6140360c6048cdbf900cfac26ac55514318f2d7
MD5 22ba43870391c9e6f28cf3a2ef1f1b1d
SHA1 b0181c4a7725401fdd6b622891d7fc654a8676f6
SHA512 f877abceccc332afb89deca11f4d208fa1d897223447697e85dab9b146d9b4297162310616a39b8b7b687433e8df3efe0e367309ee32693a38943396edb65183
SSDEEP 3072:/9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:FctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T173847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cwuomgezwr.sys

Path C:\Temp\cwuomgezwr.sys
Size 293KB
SHA256 436bc3fdabbc874100bf9b3d74bfddda953c9e28adff2be131a9ff2bc66fe005
MD5 5af5452c84b0c8ce455e0649eddd2719
SHA1 15a7bcd2aaa31eb65a289e34191dd96f8df15b9e
SHA512 be1e84aff9f1d5063c1559ecd4eb898730b201a8df3c2c8381a68184e91dbf64ecca294ffb366f86a37d2f9a036b5e0ac2ca951d4648cb4583a5a5b34136e3d1
SSDEEP 3072:KtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:KIJjiJcbI03GBc3ucY5DCSj
TLSH
T142545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_aysnlidxvq.exe

Path C:\Temp\i_aysnlidxvq.exe
Size 384KB
SHA256 ed89d35ac2fd21772158d605cc825d053d8671c5b5267d56221bd1e7dac852bc
MD5 3c8632762dc393d784350ea39a724af2
SHA1 f735e59e856e53445e36383b98154ab9a602dc7f
SHA512 4d228b76d4eb4bb4b6486b62312796d299a939e02de970d8cebd75e7988e607ab9c639bbe2df6b5961baa099c3ec5509438f35a3023756aca0212744f9ea4e08
SSDEEP 3072:f9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:lctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T17A847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mgeywqojgb.exe

Path C:\Temp\i_mgeywqojgb.exe
Size 384KB
SHA256 1f586711c1db348c7b12715b5f9100e302d2cdc0aebe4929fc38d9f2957956bb
MD5 b824a63a8ba4be1c0667945effcdf838
SHA1 0f7f7454237c673001a07b22826dbd5f1febb423
SHA512 920f1f804711a90cb9c4a863e954a4f700627360118f3813338ea57cfc59146c59bed68a3d29fcec8411d285873519c0b3f96b08ce139b7b38c87d68c64d04ef
SSDEEP 3072:s9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:2ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T10A847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nlgdyvqoig.exe

Path C:\Temp\i_nlgdyvqoig.exe
Size 384KB
SHA256 08e07fcf2d8da55fcab084a78e8ad6fb93ac97d3a5d8452527a1592025084d02
MD5 8eeb5837a8e562f0060256c0cca04ce3
SHA1 b98f555033fab560d913a43ddb3dd4519f967c9c
SHA512 d53facab4bf308e8541884ce8d6cc4982029c3fd5567bf00561afe01c204b348302be0a732a7e795ec30abd04bd1891bf49801d4201eaf92d400f253be3282bd
SSDEEP 3072:29ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:kctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T120847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rlgeywqoig.exe

Path C:\Temp\i_rlgeywqoig.exe
Size 384KB
SHA256 a9df21f70955515083abcac4287685aeb7ae36128bf79a02496db968d911a5db
MD5 33bb204a9e658212af233b10c789c047
SHA1 9c2f1604b5707f46863704b0001b7e026114f4af
SHA512 03dead963e9ca72e92448ffe4b411ffa9df3bed49b6422a8e69b71d3d3f244e659ee271851fb27cab4e5ed666a0d251354e155cfd26eb104cc0d52a6fabc24f4
SSDEEP 3072:49ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:6ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T172847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_trmjhbzwrm.exe

Path C:\Temp\i_trmjhbzwrm.exe
Size 384KB
SHA256 3ec87a7818145313ed70df10ff3f34d6320df52a7cd822522cf9bee6116a1972
MD5 d44608bc344a4702e139222881449b2c
SHA1 e9b81eaf6a0fcb187d0794e84073b2c5c8a9393f
SHA512 2324f64b8a85dbeb54db8c6d61deb650af508d7141979fb6546dd2c6100ecdb99e160d732fe3d1f12af8c4d8198b5347a9d8b25fe43c598909198bf4651358e5
SSDEEP 3072:b9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:JctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T12E847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kigaysqlid.sys

Path C:\Temp\kigaysqlid.sys
Size 293KB
SHA256 4e3130c65fa4b84a5e1d1702ddaf25f665f06b39056f1e700adcc466d4b2c634
MD5 18866bcaa78a87eefef225a52d134a89
SHA1 b44c4f0d5d6669bbd180b4c852d2c5f659823604
SHA512 c1b8a2dcbe1c27aef928627ebba3240c90fd205526ff3f4842fc2ce22ac33b8cbb1d4445f48b50dcd8d415dea16e2adc7dfa3a4f5402f27f21be88b374974dbd
SSDEEP 3072:NtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:NIJjiJcbI03GBc3ucY5DCSj
TLSH
T163545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ligayvtnlj.sys

Path C:\Temp\ligayvtnlj.sys
Size 293KB
SHA256 b19b3a41f207a2a39ae52a918dbb497c59e77b6ec8c85a878e85e68abd3e6af4
MD5 d57d87c6ae920ebc9f3c9f512c4d966e
SHA1 b7289fdc7c90a3a43bc1ce3097027b14530ace10
SHA512 75f22587ff20cfd7178bc5e882929d1c01b1057179970f0b466169ad69cf57d4a29047f0d7215edea069b5636dec847e3fb9e853e399552983733df745b80db4
SSDEEP 3072:/tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:/IJjiJcbI03GBc3ucY5DCSj
TLSH
T12F545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mgeywqojgb.exe

Path C:\Temp\mgeywqojgb.exe
Size 384KB
SHA256 210b202d15ac73e0b0fc021af92a880a3baf59d69d3ff73333e400eae3373256
MD5 0f7ff4d6c8888180fde9c9a806e2c954
SHA1 cd8e03824c1e86e0fe9596552bd9a47e0fcb52f2
SHA512 a84ad9fe117768ff723f51e9d55d44ebd1bedb825ab3e6971064a87b4fa0e1688e7b8b1526ea4d4f7e61c9c4e653655d7b5999ad79b5371b042400a677812f70
SSDEEP 3072:J9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:jctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T128847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nkicausnkf.exe

Path C:\Temp\nkicausnkf.exe
Size 384KB
SHA256 f23bd9dcaeed7fcd62d6ecbf07a4d98c9a5f42d9be33247061414b58442f3dbb
MD5 58bc1b4f80dbb3ba14d89c361d3098aa
SHA1 efc4c5f37244a25419da2bbd44e410cbe446c9ee
SHA512 05decf9ec5d3976d064dbcdb684cafec889059a8d129fc5aa163bc772ccc76a82bcd8656250679349fc710b3b628f4f6b40a9ac8de7748e1b32f19c126ed04f2
SSDEEP 3072:89ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:GctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T13F847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlgdyvqoig.exe

Path C:\Temp\nlgdyvqoig.exe
Size 384KB
SHA256 e2d52adf9f10cfe71b374bfd6a71ba088f0507486ea20b055352757d424e3bd7
MD5 df88bafdcbcbeae2766e396afdc63ef7
SHA1 ece4bc931d2b3019dfe878a33c0a354c39b93d6e
SHA512 e030b8b51dadd310cf4d501b284d1068b94906db93df7ab39fcad6ee8e2cbd1054b7b2dde50a1032f01c4c2f4b7eda8c7f5ffb38e2bad44b1a92b699d5c7e817
SSDEEP 3072:+9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:cctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T16C847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rlgeywqoig.exe

Path C:\Temp\rlgeywqoig.exe
Size 384KB
SHA256 59807d5291cf5a170be7d492dd0a83e8c81aac38554786d05e237437de826ce5
MD5 a81e9793c3de39ea8a1ab58fc71cfbab
SHA1 4238e1256c74ac918eb33ddfcf0f898271d4dd2a
SHA512 ee14e61ccc1de1d84a7cc6c51cbf4325abd00ee220b3e619c59798613f52daf51a33ec06b01851663d8b3e7c06b242cc1741f1bc538c64f618b00ab4fae5f9e4
SSDEEP 3072:d9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:vctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E7847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpbwuomgebzurojh.exe

Path C:\Temp\rpbwuomgebzurojh.exe
Size 384KB
SHA256 c2d85fdd861eef9b1c2fff5203e8f09f03eba96cb30bfbff18cd7e4e0d20dc99
MD5 aca15a47d81e9ea270ed044b332dd1f0
SHA1 87c718bd84ba66994ab3ed55e65f3829a8c829cf
SHA512 2b83de4f7fb370a07f7176bc3caca646c388b4e8e73028e6478fe52dd15d9af1ca2d6b451503eda76b8f72e45dbf92f8b64fa8df27630f0add29ef5f3e2f5e2e
SSDEEP 3072:69ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:gctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T173847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpbwuomgebzurojh.sys

Path C:\Temp\rpbwuomgebzurojh.sys
Size 293KB
SHA256 e438bb33eb17799b0e99ba7fc1a4793b98d2c47f4de501d90ca11f98b6f65a56
MD5 91db2999d185276edbd830f7485c86f3
SHA1 652e7c11801e11869a2a8f671a08401de35dcc9e
SHA512 bcd8b9c378058c90f103c38916a87e517ca65b4ff9446f073f3350e2d26c6a245cd41328fbb73c97c1fa8b02ca6b26df08bb54e92b8e9eb0daf15b2e73c45bbf
SSDEEP 3072:4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:4IJjiJcbI03GBc3ucY5DCSj
TLSH
T1B3545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trmjhbzwrm.exe

Path C:\Temp\trmjhbzwrm.exe
Size 384KB
SHA256 9d522e04b20b98073ff46a3c009c544dc814ede2c6d7178772bb5d0e399c3077
MD5 68713d16d98fb60c8626c8f905f46c10
SHA1 f85c41ac81c649425af2f89e41778c3faaf8421b
SHA512 3f4955a59229f0cf217e4af92b347f2c16ab6008982a1c6c51fce28a110617853b28c711658e4e9dc8e8b4fa7c41160ddb11cdfabe15a1de6fef440f69772d52
SSDEEP 3072:r9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:ZctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B3847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ysqkifaxvq.sys

Path C:\Temp\ysqkifaxvq.sys
Size 293KB
SHA256 d849e049d54dd97f9235e97285bded815cf10eb6b3590624aac2c38842d2d1b9
MD5 8343c27727da7cfe0afd77d9d709c307
SHA1 532731f1d97c745dbb5e51d580638b509697b447
SHA512 5aee52cd9cffc3f5db3827b00644f3994b895d8278421801b379b7de4d25f8fd1677361682e7c0448ebbea49dd727e5c108baaf9804d269fdbf44ca766e46e91
SSDEEP 3072:0tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:0IJjiJcbI03GBc3ucY5DCSj
TLSH
T151545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zwrljgbztr.sys

Path C:\Temp\zwrljgbztr.sys
Size 293KB
SHA256 17ebb138ffce8fc6ffc8b8511bc6d40630bf0d78f5bf928bf0c2832a8170cb21
MD5 9324c624adcdedb337229e9498acf610
SHA1 cccb644bd8adc5337dcab92fa446cd11054b336f
SHA512 5c47f41cef4603e0a57cf0be481a6378b1aa636e2bdb32e9d2cdb989014d131495df65c076504a45dcbf2f7c97073d2abea8dd4524fa8e9ec0b13cb3c6591b84
SSDEEP 3072:gtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:gIJjiJcbI03GBc3ucY5DCSj
TLSH
T17D545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 64114378c76465a4737e01d19b1c72f3963a928090a3e531f91bc98d3303948f
MD5 79534c3ee32e130bd34f09d1c55be1e1
SHA1 f20563ec7a1de3abcc3186f98e0581e6743098d7
SHA512 5f3ea0492a272318e1f49252ded6a5d87155b74c41264383923dd110756617f5fdd7e17e1aba03f9acb1bd25bb4577d702b4f7144bd3bcbf783a21ca9725c1a3
TLSH
T1AC513BF123E21AC2D32C69B697D28CD836F5A86F04872E107C94BFF09986F0791E1857
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5980fe.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5980fe.TMP
Size 3KB
SHA256 800e9c43f95d9056e20bdf0f8d1ccc890d687b1c96078f36dd89bf70c3f0480f
MD5 9fbf13476423c62fb288b13d9fc8888d
SHA1 cf3c9c35074036ecfc3f2a480e56f2fcb44daef9
SHA512 f3ca1bb154e8382247abb5ede088aa28a63161d60e5f25cd0ac9c222f4877703f7ec77d867d8641676fa4a8e7b60b6444c37aff8c8ef0a3b8a51071e0c3ed613
TLSH
T1B8512AF123E61AC2D32C69B697D28CD836F5A86F44831E107C94BFF05986F0790E1857
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 e4770b1e2451bf623399321d03a0302a2fd368bbeacd9096801f3af1ced11a90
MD5 8548f21035f903a366d30c8b37e78876
SHA1 be116b3313adf68db7d91edb375b19e52716ad4e
SHA512 fd082d80d0dcc3ed4cf6823a11a4922dd34a4726072cfc404d7ae61b7b2af9370214e1f81869bc1eb26c06c96e05e88a3ad2e98b0875b0195b53807c1a5a2966
TLSH
T105419FF783F4956E8A0196F0AA14AE1FCE1D0511431C7D9AC5E0EE2B93E3472E041A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 02a6a1d9b7c3a9acd9dea0e8b1145704201c79744791dbd00c39fbfaebae8579
MD5 7fdc0aa715208fcbcd93eea490245a82
SHA1 6a6d693443611a73cbfbe11fb4df7ac2ca570e46
SHA512 39e249bf61cac28c459a43ef13738547b26d09e10249669a89a7288bce578e27d780a5d4d193aa4b06e8e6d16a53de2e71658f18c3e0627c0728e9bbff416aea
TLSH
T1C941C0F783F4956E890156F0AA146E1FCE1D0515832C7C5AC9E0EF2B93E3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 7961baeb5837769c35fc7b3f3f43b840d530ff5824925a63f1a1f0fc6c141d38
MD5 c75c0454aeca8c97ebe8ff66acfacc22
SHA1 2689da541ce1790cc852b18fdc3323fcd431d4a2
SHA512 3a5ec8d00e3b2b0818ca2a2bb614fa2ff2e4e6397d672dbd04109651c35f915334395f6b217676dc1cce4d8a7a1283947c60fc30811a84fef2a8866d6e083f60
SSDEEP 192:sxRbREyM/jK1Ml8wCC/fksbSoYprQ53zoA8p9w/g6+WNCO1/YnwUhhaGbIgVYJ:sxRb68C/fksG3zm/5Z/pGVS
TLSH
T12D62E815AA34AD7B8CDBD208FA557F93D6F85573A1901E44AEFC8E1C00E66ED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 8e0d8e43e104c4343938fb61d27cd34351fba7c7cbaa7f991f5a30695ac8d75b
MD5 25e7fd5d051d352e26c83e55378aeb29
SHA1 d8f65ae7799bd9f93d772e81677e82a2b9de8a4e
SHA512 7c78f359a8ce2b301959f8959714c1d37617969026fb676aba904be92ecc26ef4de44347ca6b043093ee75610630cebc96be3183ba336629cef38cfd633796b2
SSDEEP 192:sxRoREyM/jK1Ml8wCC/fkssSoYprQ53zoA8p9w/g6+WNCO1/YnwUhhaGbIgDZYJ:sxRo68C/fksZ3zm/5Z/pGVC
TLSH
T1B062E815AA34AD7B8CDBD208FA45BF93D6F85573A1901E44AEFC8E1C00E66DD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 65805157bca27f81aafbc60adb4f9bd77e97f9713ba52889995f5af5f2b3ed9c
MD5 b8b4611b984003e1aed05108d49d1778
SHA1 a3eee4d02d396f6f770c3ef1cb8be8ce205df41b
SHA512 c65ca393fa77c4ea185bbdfa10d5590b799f8a396f558198552900fd3fc5434f0b0dca4b8bafee57b6234dd081fc3b9c7e931b7057f11d079cac0033b7ecca55
SSDEEP 192:sxRoREyM/jK1Ml8UQuCC/fkssSoK8ZczoA8prw/g6+WNCO1/Ynw+ZhaGbIgDzYJ:sxRo6qZC/fksZxCNc/5Z/pKV0
TLSH
T12362E815AA24AD778CDBE20CFA45BF93D6F85573A1901E44AEFC8E1C00E66DD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 2d3f63ec77a3f2fd6b0504d3406b95d30dbbae3375ae8e8295bb5a32920a69e7
MD5 7f97103ebb9323fb250f87d025b57f2d
SHA1 10303db6805b63f83bc3e4a92ecdba01db8e21bd
SHA512 8f3644951db31ed8873cd4bc6946f9c3a25043b2aa6db81e235ca845bd0a7a880861f749d90a4f57c253bb830f770e3b78b7286c4eeb1cd35e3a79b903d1d43c
SSDEEP 768:wGed1g7pLuL7X6WgoufDM8F1+UoAYDCx9Tuqh0VfUC9xbog/OVMIOu4YGroSn8wa:wGed1sE7X6WgoufDMu1jajIOVY9Qa
TLSH
T1D1E2DB7B680CCB7E4F804EDCEC29BE9FADA801CB56D8895447EA840C03C67EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 bb3f84d400ff2fa4d1018971aa228be6d3d66510e866f79e9b24e01f8890df9a
MD5 138467c5a61877a4a7d99ccba75f77fa
SHA1 0c5cf68c05370787760347f1425e6a596307c2d7
SHA512 8cf0cfc90081dea6af4e5d843d482410f96ab2aea8a453f0eeab0832bb9b36456abfb985fe7d019d078df14700d5587a1ef9478fdc6903d061cb8716bf86a72b
SSDEEP 96:KR4i4n4O4i4U404k4iW4s454Rg4S4iK44Hg4I4ic4y464h4A4i4LH4/4o4N4J4/I:Cr0xFzJZQNi5tPUgD6LTqN5eHyX+SkEH
TLSH
T17791890031BA02E43C3EB91D85F59C6A768175A6300AF86B3BBA15E51F66E02CDFD5CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a1d1e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a1d1e.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 9ffb523a5b201f7a6c312eea67ee55e3f9959e5dd0d760f736e80b8805a5cf7a
MD5 9b8bfdc2939100e75f2205ec759b36b0
SHA1 2598967ec39fc854a83f8287fe00ae6003146b7a
SHA512 c177ffa33a8cb995b06f2f975500b260bea9ffdbd4364a81ff98ba6cf71f95b12f5cb2cff3e27b52779d01d1f7564d72bb610378290ecf80d3bad11971bb0faa
SSDEEP 384:nHZcIf38N0MMQZkkH60vJDZNfNoXOVSUUA8UETRzcoXfK86sfxEZxxsIj4lBdfv6:vf3B0ouDZIO03Nzc4ReyIsPdfLe
TLSH
T143F2BE35AC24CC63ACFEA285B6423693BEF5512781CD6D44D9DD9F2C09076EE1B1B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 70b297155ec3c52f8bc232e9acc17fb6c6c08cc3cde037dd74fcc5f08507342e
MD5 404b60bceea0926d248135ff6c47d41b
SHA1 76387ae3703e8daa180bcd3a1e803be62c029495
SHA512 b5309c3d879c5af2cf143aed13abaf124db6b33dd62849ccd662871c005db2d3d82a805983540ae21f74755aee1edae922a4dced4c62e0f969f4ae324212c4bf
SSDEEP 768:6rv+4UNbds38GDZIO0ENzc4ReyIsXKeVH1S5D:6bsbS3vtc44bs6EH1Y
TLSH
T1F003CF32A8388A77ACF76686B54776537EF8912BC2981ED0C5DE6F0C064B1DD134B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 220534f0d63fdc6d6c419e290139cb6cd92abc0b707db0bbdca817bb3a016fdf
MD5 b1188261c8a91c888f899778f0ea18f4
SHA1 8b53d4139fe07033da482d3bf581c0bb3112e71f
SHA512 02dbec944490aff2ffe737110f2fb7d9b88511d0ae7c3c658e983f59f8edd66a42052dc88e4e063b20fbffcdb0f6eba88de88d15b91cf05795ada7999d1add06
SSDEEP 768:3rv+4UNbds3yYDZIO0MNzc4ReyIs2deVH1S5D:3bsbS3btc44bsaEH1Y
TLSH
T17203DF32A828CD73ACFB6686B44776937EF8216B80890E94D8DD5F4C0A071DD275F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 1fe4b925145bbf72ef53f620a3bb8bc7d473c6d1df4afe03e10f5666d44dedf2
MD5 682e237149615197e6265e0d05a513d2
SHA1 88b35cf183333325bdff93af207803e442db39a9
SHA512 edeb23561578a0809eebec834d5989fc573b393a416abada8c161354ed29feb2a173c324095fac875cf773eb03b439305fba04f71778f915518e80c9dadaf3dc
SSDEEP 384:nrZcIf38N0FMQZkks60vJDZNfNoXOVSUUA8qETRzcoXfK86sfxEZxxsIj4lBdfv6:zf3Q0juDZIO0JNzc4ReyIsPdfLe
TLSH
T1DCF2BE35AC28CC63ACFEA285B6423693BEF5502781CD2D44D9DD9F2C09076DE1B5B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 b9bc1321ab18814786d99c6595b92893656031d7880b8b934a5bdebe067a0f0f
MD5 48ae33d27a91276a96d76867badb1199
SHA1 6d89c0aaeabdd0edbc2dc641dc53bdbe21604393
SHA512 d5c2c9f19c8a2a0d450f83d8aff6cf7f8a618b9bea0c5039003e62eb5a9542a30d455026051a762fcaee5124b2c9d97b1a9fab98ccef331b10b7182ba0ed9e16
SSDEEP 384:n5iFiZcIQ38N88TUNTUlIlFMQZkksP0J2Z/fQxXOVSUUA8iETRzcoXfK86sfxEZp:QFQQ3vwgg0mvZw5O0ZNzc4ReyIsPdfLe
TLSH
T19C1318F598D78977E8AE5783A73D2E42AEBDD067B1885884B7C85E1CCC421BFC706811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

6e5a307d-f3e7-40da-b311-81600c9670b3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6e5a307d-f3e7-40da-b311-81600c9670b3.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir996_111087432\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 eb2bcaa79c1fe1738c8c944043338bce31a5751062062be87750d2b095502bd4
MD5 333fea280615b8de840fcda5c673f426
SHA1 aebc11e7e8d8c1547b753135446156a17cb09da9
SHA512 6afd86c17c7a9d9ca9e61dee056cc0f55a785c69102aa08b8c4e8d8b814ddbfb33851e5ca37bab0620878854b16e10177696c90fe45a12d3d21de69dcf6faa41
TLSH
T10D7100835BB9D6B2C19B5BF402835248F1BB2238072330744B555646AA30A7E28B8F08
MD5 SHA1 SHA512 TLSH

Submit Download

memory/256-403-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1268-374-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1524-189-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2372-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2500-429-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2500-451-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2880-455-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2896-333-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3428-362-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3852-399-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4076-276-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4112-391-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4264-387-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4680-297-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4772-314-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4924-337-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5372-264-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5736-318-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5760-424-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5760-438-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5772-450-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5912-236-0x0000000000010000-0x00000000000AB000-memory.dmp

Download