systex | d81c485a9826056095accd60323b93a5ad549fc4a234f829bc834f27f30b2cfa

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 03:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-30_aa2c316cf4cebf16483f0f2362f46a18_amadey_darkgate_elex_smoke-loader_stop.exe
Size 384KB
Sample260701-dye28adv8p
SHA256 d81c485a9826056095accd60323b93a5ad549fc4a234f829bc834f27f30b2cfa
MD5 aa2c316cf4cebf16483f0f2362f46a18
SHA1 b7cb14cef0171a95a76cff0ee46c8ea939393a19
SHA512 581a1f413edd1fbe3dc230f74c47d4ae92e1fdfc4ff6626a106b05a221cf61e7a65510f5db41e609e0e722dbd039e3aaa165cdf45263f9e2f7b678a65fd06274
SSDEEP 3072:4jtF1eNGL8tpdhJmaMOk4y3tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/09:ktf7ZIJjiJcbI03GBc3ucY5DCSjX
TLSH
T16F847B00BAA4F0F6D995047800EFAF36A67E74281726CBC3E754CE5D9A113C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
5392	ysqkigayvtnliday.exe
3116	ysqkigayvtnliday.sys
4212	CreateProcess.exe
6140	gaysqnlfdy.exe
764	CreateProcess.exe
4024	CreateProcess.exe
5108	i_gaysqnlfdy.exe
256	ausnkfdxvs.sys
3344	CreateProcess.exe
4872	lfdavsqkif.exe
1648	CreateProcess.exe
1280	CreateProcess.exe
1276	i_lfdavsqkif.exe
4332	fcaxspkica.sys
3372	CreateProcess.exe
5388	cxupmkfcau.exe
1448	CreateProcess.exe
4624	CreateProcess.exe
2760	i_cxupmkfcau.exe
4160	zxrpkhcaus.sys
4328	CreateProcess.exe
1332	zusmkecxrm.exe
4556	CreateProcess.exe
1716	CreateProcess.exe
5268	i_zusmkecxrm.exe
4320	wuomheczur.sys
3180	CreateProcess.exe
2848	mgecztrpjh.exe
5292	CreateProcess.exe
5496	CreateProcess.exe
4488	i_mgecztrpjh.exe
1036	mgezwrojhb.sys
4888	CreateProcess.exe
5700	jebwuomhbz.exe
1276	CreateProcess.exe
1800	CreateProcess.exe
696	i_jebwuomhbz.exe
2596	geywqojgby.sys
880	CreateProcess.exe
2376	geywqojgby.exe
3856	CreateProcess.exe
5340	CreateProcess.exe
3056	i_geywqojgby.exe
4800	jdbytqolgd.sys
4784	CreateProcess.exe
2000	jgbyvqoiga.exe
4832	CreateProcess.exe
2408	CreateProcess.exe
5628	i_jgbyvqoiga.exe
2012	qlidbvtnlg.sys
4380	CreateProcess.exe
4488	yvqnigaysq.exe
1152	CreateProcess.exe
3660	CreateProcess.exe
4892	i_yvqnigaysq.exe
3520	yvqnifaysq.sys
4480	CreateProcess.exe
2240	sqnifdavsq.exe
4268	CreateProcess.exe
5248	CreateProcess.exe
1072	i_sqnifdavsq.exe
5064	xsqkicausm.sys
3228	CreateProcess.exe
5180	vpnhfzxspk.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2816_1929409186\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2816_1929409186\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2816_1929409186\smart_switch_list.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2816_2005050777\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2816_2033833445\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2816_216070172\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2816_1929409186\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2816_2033833445\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2816_216070172\nav_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-30_aa2c316cf4cebf16483f0f2362f46a18_amadey_darkgate_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cxupmkfcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgbyvqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaysqnlfdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgecztrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jebwuomhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywqojgby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpnhfzxspk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jeczurmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lfdavsqkif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgecztrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvqnigaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spkhcausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkicavsnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jebwuomhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gaysqnlfdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywqojgby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvqnigaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqnifdavsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kecwuomhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ytrljdbytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqnifayvqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqnifdavsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpnhfzxspk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bywtomgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqlidaytql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zusmkecxrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zusmkecxrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgbyvqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bywtomgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqlidaytql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jeczurmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ytrljdbytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkicavsnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spkhcausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kecwuomhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqkigayvtnliday.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lfdavsqkif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxupmkfcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqnifayvqn.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3808	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3164	ipconfig.exe
2808	ipconfig.exe
5308	ipconfig.exe
1864	ipconfig.exe
5476	ipconfig.exe
2964	ipconfig.exe
4804	ipconfig.exe
2584	ipconfig.exe
4540	ipconfig.exe
2332	ipconfig.exe
2572	ipconfig.exe
2700	ipconfig.exe
4996	ipconfig.exe
2300	ipconfig.exe
4696	ipconfig.exe
2216	ipconfig.exe
3676	ipconfig.exe
5784	ipconfig.exe
3384	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134273498970174100"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2639994890-966400312-4246138405-1000\{30CA2160-AECE-47AB-A108-A03A725183D4}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5036	2026-06-30_aa2c316cf4cebf16483f0f2362f46a18_amadey_darkgate_elex_smoke-loader_stop.exe
5036	2026-06-30_aa2c316cf4cebf16483f0f2362f46a18_amadey_darkgate_elex_smoke-loader_stop.exe
5036	2026-06-30_aa2c316cf4cebf16483f0f2362f46a18_amadey_darkgate_elex_smoke-loader_stop.exe
5036	2026-06-30_aa2c316cf4cebf16483f0f2362f46a18_amadey_darkgate_elex_smoke-loader_stop.exe
5036	2026-06-30_aa2c316cf4cebf16483f0f2362f46a18_amadey_darkgate_elex_smoke-loader_stop.exe
5036	2026-06-30_aa2c316cf4cebf16483f0f2362f46a18_amadey_darkgate_elex_smoke-loader_stop.exe
5036	2026-06-30_aa2c316cf4cebf16483f0f2362f46a18_amadey_darkgate_elex_smoke-loader_stop.exe
5036	2026-06-30_aa2c316cf4cebf16483f0f2362f46a18_amadey_darkgate_elex_smoke-loader_stop.exe
5036	2026-06-30_aa2c316cf4cebf16483f0f2362f46a18_amadey_darkgate_elex_smoke-loader_stop.exe
5036	2026-06-30_aa2c316cf4cebf16483f0f2362f46a18_amadey_darkgate_elex_smoke-loader_stop.exe
5036	2026-06-30_aa2c316cf4cebf16483f0f2362f46a18_amadey_darkgate_elex_smoke-loader_stop.exe
5036	2026-06-30_aa2c316cf4cebf16483f0f2362f46a18_amadey_darkgate_elex_smoke-loader_stop.exe
5036	2026-06-30_aa2c316cf4cebf16483f0f2362f46a18_amadey_darkgate_elex_smoke-loader_stop.exe
5036	2026-06-30_aa2c316cf4cebf16483f0f2362f46a18_amadey_darkgate_elex_smoke-loader_stop.exe
5036	2026-06-30_aa2c316cf4cebf16483f0f2362f46a18_amadey_darkgate_elex_smoke-loader_stop.exe
5036	2026-06-30_aa2c316cf4cebf16483f0f2362f46a18_amadey_darkgate_elex_smoke-loader_stop.exe
5036	2026-06-30_aa2c316cf4cebf16483f0f2362f46a18_amadey_darkgate_elex_smoke-loader_stop.exe
5036	2026-06-30_aa2c316cf4cebf16483f0f2362f46a18_amadey_darkgate_elex_smoke-loader_stop.exe
5036	2026-06-30_aa2c316cf4cebf16483f0f2362f46a18_amadey_darkgate_elex_smoke-loader_stop.exe
5036	2026-06-30_aa2c316cf4cebf16483f0f2362f46a18_amadey_darkgate_elex_smoke-loader_stop.exe
5036	2026-06-30_aa2c316cf4cebf16483f0f2362f46a18_amadey_darkgate_elex_smoke-loader_stop.exe
5036	2026-06-30_aa2c316cf4cebf16483f0f2362f46a18_amadey_darkgate_elex_smoke-loader_stop.exe
5036	2026-06-30_aa2c316cf4cebf16483f0f2362f46a18_amadey_darkgate_elex_smoke-loader_stop.exe
5036	2026-06-30_aa2c316cf4cebf16483f0f2362f46a18_amadey_darkgate_elex_smoke-loader_stop.exe
5036	2026-06-30_aa2c316cf4cebf16483f0f2362f46a18_amadey_darkgate_elex_smoke-loader_stop.exe
5036	2026-06-30_aa2c316cf4cebf16483f0f2362f46a18_amadey_darkgate_elex_smoke-loader_stop.exe
5036	2026-06-30_aa2c316cf4cebf16483f0f2362f46a18_amadey_darkgate_elex_smoke-loader_stop.exe
5036	2026-06-30_aa2c316cf4cebf16483f0f2362f46a18_amadey_darkgate_elex_smoke-loader_stop.exe
5036	2026-06-30_aa2c316cf4cebf16483f0f2362f46a18_amadey_darkgate_elex_smoke-loader_stop.exe
5036	2026-06-30_aa2c316cf4cebf16483f0f2362f46a18_amadey_darkgate_elex_smoke-loader_stop.exe
5036	2026-06-30_aa2c316cf4cebf16483f0f2362f46a18_amadey_darkgate_elex_smoke-loader_stop.exe
5036	2026-06-30_aa2c316cf4cebf16483f0f2362f46a18_amadey_darkgate_elex_smoke-loader_stop.exe
5036	2026-06-30_aa2c316cf4cebf16483f0f2362f46a18_amadey_darkgate_elex_smoke-loader_stop.exe
5036	2026-06-30_aa2c316cf4cebf16483f0f2362f46a18_amadey_darkgate_elex_smoke-loader_stop.exe
5036	2026-06-30_aa2c316cf4cebf16483f0f2362f46a18_amadey_darkgate_elex_smoke-loader_stop.exe
5036	2026-06-30_aa2c316cf4cebf16483f0f2362f46a18_amadey_darkgate_elex_smoke-loader_stop.exe
5036	2026-06-30_aa2c316cf4cebf16483f0f2362f46a18_amadey_darkgate_elex_smoke-loader_stop.exe
5036	2026-06-30_aa2c316cf4cebf16483f0f2362f46a18_amadey_darkgate_elex_smoke-loader_stop.exe
5392	ysqkigayvtnliday.exe
5392	ysqkigayvtnliday.exe
5036	2026-06-30_aa2c316cf4cebf16483f0f2362f46a18_amadey_darkgate_elex_smoke-loader_stop.exe
5036	2026-06-30_aa2c316cf4cebf16483f0f2362f46a18_amadey_darkgate_elex_smoke-loader_stop.exe
5392	ysqkigayvtnliday.exe
5392	ysqkigayvtnliday.exe
5036	2026-06-30_aa2c316cf4cebf16483f0f2362f46a18_amadey_darkgate_elex_smoke-loader_stop.exe
5036	2026-06-30_aa2c316cf4cebf16483f0f2362f46a18_amadey_darkgate_elex_smoke-loader_stop.exe
5392	ysqkigayvtnliday.exe
5392	ysqkigayvtnliday.exe
5036	2026-06-30_aa2c316cf4cebf16483f0f2362f46a18_amadey_darkgate_elex_smoke-loader_stop.exe
5036	2026-06-30_aa2c316cf4cebf16483f0f2362f46a18_amadey_darkgate_elex_smoke-loader_stop.exe
5392	ysqkigayvtnliday.exe
5392	ysqkigayvtnliday.exe
5036	2026-06-30_aa2c316cf4cebf16483f0f2362f46a18_amadey_darkgate_elex_smoke-loader_stop.exe
5036	2026-06-30_aa2c316cf4cebf16483f0f2362f46a18_amadey_darkgate_elex_smoke-loader_stop.exe
5392	ysqkigayvtnliday.exe
5392	ysqkigayvtnliday.exe
5036	2026-06-30_aa2c316cf4cebf16483f0f2362f46a18_amadey_darkgate_elex_smoke-loader_stop.exe
5036	2026-06-30_aa2c316cf4cebf16483f0f2362f46a18_amadey_darkgate_elex_smoke-loader_stop.exe
5392	ysqkigayvtnliday.exe
5392	ysqkigayvtnliday.exe
5036	2026-06-30_aa2c316cf4cebf16483f0f2362f46a18_amadey_darkgate_elex_smoke-loader_stop.exe
5036	2026-06-30_aa2c316cf4cebf16483f0f2362f46a18_amadey_darkgate_elex_smoke-loader_stop.exe
5392	ysqkigayvtnliday.exe
5392	ysqkigayvtnliday.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	5108	i_gaysqnlfdy.exe
Token: SeDebugPrivilege	1276	i_lfdavsqkif.exe
Token: SeDebugPrivilege	2760	i_cxupmkfcau.exe
Token: SeDebugPrivilege	5268	i_zusmkecxrm.exe
Token: SeDebugPrivilege	4488	i_mgecztrpjh.exe
Token: SeDebugPrivilege	696	i_jebwuomhbz.exe
Token: SeDebugPrivilege	3056	i_geywqojgby.exe
Token: SeDebugPrivilege	5628	i_jgbyvqoiga.exe
Token: SeDebugPrivilege	4892	i_yvqnigaysq.exe
Token: SeDebugPrivilege	1072	i_sqnifdavsq.exe
Token: SeDebugPrivilege	3628	i_vpnhfzxspk.exe
Token: SeDebugPrivilege	4048	i_spkhcausmk.exe
Token: SeDebugPrivilege	204	i_kecwuomhez.exe
Token: SeDebugPrivilege	2012	i_jeczurmkec.exe
Token: SeDebugPrivilege	3824	i_bywtomgeyw.exe
Token: SeDebugPrivilege	3584	i_ytrljdbytq.exe
Token: SeDebugPrivilege	4408	i_sqlidaytql.exe
Token: SeDebugPrivilege	2548	i_tqnifayvqn.exe
Token: SeDebugPrivilege	2148	i_sqkicavsnk.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2816	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5036 wrote to memory of 5392	5036	2026-06-30_aa2c316cf4cebf16483f0f2362f46a18_amadey_darkgate_elex_smoke-loader_stop.exe	88
PID 5036 wrote to memory of 552	5036	2026-06-30_aa2c316cf4cebf16483f0f2362f46a18_amadey_darkgate_elex_smoke-loader_stop.exe	89
PID 552 wrote to memory of 2816	552	iexplore.exe	90
PID 2816 wrote to memory of 5348	2816	msedge.exe	91
PID 2816 wrote to memory of 3780	2816	msedge.exe	92
PID 2816 wrote to memory of 3808	2816	msedge.exe	94
PID 2816 wrote to memory of 3780	2816	msedge.exe	92
PID 2816 wrote to memory of 3780	2816	msedge.exe	92
PID 2816 wrote to memory of 1008	2816	msedge.exe	95
PID 2816 wrote to memory of 1008	2816	msedge.exe	95
PID 2816 wrote to memory of 3836	2816	msedge.exe	96
PID 2816 wrote to memory of 4772	2816	msedge.exe	97
PID 2816 wrote to memory of 3836	2816	msedge.exe	96
PID 2816 wrote to memory of 3836	2816	msedge.exe	96
PID 2816 wrote to memory of 4772	2816	msedge.exe	97
PID 2816 wrote to memory of 4772	2816	msedge.exe	97
PID 2816 wrote to memory of 5700	2816	msedge.exe	98
PID 2816 wrote to memory of 4496	2816	msedge.exe	99
PID 2816 wrote to memory of 5700	2816	msedge.exe	98
PID 2816 wrote to memory of 5700	2816	msedge.exe	98
PID 2816 wrote to memory of 4496	2816	msedge.exe	99
PID 2816 wrote to memory of 4496	2816	msedge.exe	99
PID 2816 wrote to memory of 4896	2816	msedge.exe	101
PID 2816 wrote to memory of 4896	2816	msedge.exe	101
PID 5392 wrote to memory of 4212	5392	ysqkigayvtnliday.exe	104
PID 6140 wrote to memory of 764	6140	gaysqnlfdy.exe	107
PID 2816 wrote to memory of 896	2816	msedge.exe	110
PID 2816 wrote to memory of 2332	2816	msedge.exe	111
PID 2816 wrote to memory of 896	2816	msedge.exe	110
PID 2816 wrote to memory of 2332	2816	msedge.exe	111
PID 2816 wrote to memory of 3012	2816	msedge.exe	113
PID 2816 wrote to memory of 996	2816	msedge.exe	114
PID 2816 wrote to memory of 996	2816	msedge.exe	114
PID 2816 wrote to memory of 1424	2816	msedge.exe	117
PID 2816 wrote to memory of 1424	2816	msedge.exe	117
PID 5392 wrote to memory of 4024	5392	ysqkigayvtnliday.exe	118
PID 2816 wrote to memory of 1296	2816	msedge.exe	122
PID 2816 wrote to memory of 1296	2816	msedge.exe	122
PID 2816 wrote to memory of 1296	2816	msedge.exe	122
PID 5392 wrote to memory of 3344	5392	ysqkigayvtnliday.exe	123
PID 4872 wrote to memory of 1648	4872	lfdavsqkif.exe	125
PID 2816 wrote to memory of 5720	2816	msedge.exe	128
PID 2816 wrote to memory of 5720	2816	msedge.exe	128
PID 2816 wrote to memory of 5720	2816	msedge.exe	128
PID 5392 wrote to memory of 1280	5392	ysqkigayvtnliday.exe	129
PID 5392 wrote to memory of 3372	5392	ysqkigayvtnliday.exe	133
PID 5388 wrote to memory of 1448	5388	cxupmkfcau.exe	135
PID 5392 wrote to memory of 4624	5392	ysqkigayvtnliday.exe	138
PID 5392 wrote to memory of 4328	5392	ysqkigayvtnliday.exe	143
PID 1332 wrote to memory of 4556	1332	zusmkecxrm.exe	145
PID 5392 wrote to memory of 1716	5392	ysqkigayvtnliday.exe	148
PID 2816 wrote to memory of 5680	2816	msedge.exe	150
PID 2816 wrote to memory of 5444	2816	msedge.exe	151
PID 2816 wrote to memory of 256	2816	msedge.exe	152
PID 5392 wrote to memory of 3180	5392	ysqkigayvtnliday.exe	155
PID 2848 wrote to memory of 5292	2848	mgecztrpjh.exe	157
PID 5392 wrote to memory of 5496	5392	ysqkigayvtnliday.exe	160
PID 5392 wrote to memory of 4888	5392	ysqkigayvtnliday.exe	164
PID 5700 wrote to memory of 1276	5700	jebwuomhbz.exe	166
PID 5392 wrote to memory of 1800	5392	ysqkigayvtnliday.exe	169
PID 5392 wrote to memory of 880	5392	ysqkigayvtnliday.exe	173
PID 2376 wrote to memory of 3856	2376	geywqojgby.exe	175
PID 5392 wrote to memory of 5340	5392	ysqkigayvtnliday.exe	178
PID 5392 wrote to memory of 4784	5392	ysqkigayvtnliday.exe	182

C:\Users\Admin\AppData\Local\Temp\2026-06-30_aa2c316cf4cebf16483f0f2362f46a18_amadey_darkgate_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-30_aa2c316cf4cebf16483f0f2362f46a18_amadey_darkgate_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Temp\ysqkigayvtnliday.exe
  C:\Temp\ysqkigayvtnliday.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5392
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gaysqnlfdy.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4212
  - - C:\Temp\gaysqnlfdy.exe
      C:\Temp\gaysqnlfdy.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6140
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:764
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2572
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gaysqnlfdy.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4024
  - - C:\Temp\i_gaysqnlfdy.exe
      C:\Temp\i_gaysqnlfdy.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5108
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lfdavsqkif.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3344
  - - C:\Temp\lfdavsqkif.exe
      C:\Temp\lfdavsqkif.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4872
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1648
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4804
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lfdavsqkif.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1280
  - - C:\Temp\i_lfdavsqkif.exe
      C:\Temp\i_lfdavsqkif.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1276
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cxupmkfcau.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3372
  - - C:\Temp\cxupmkfcau.exe
      C:\Temp\cxupmkfcau.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5388
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1448
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2300
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cxupmkfcau.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4624
  - - C:\Temp\i_cxupmkfcau.exe
      C:\Temp\i_cxupmkfcau.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2760
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zusmkecxrm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4328
  - - C:\Temp\zusmkecxrm.exe
      C:\Temp\zusmkecxrm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1332
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4556
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4696
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zusmkecxrm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1716
  - - C:\Temp\i_zusmkecxrm.exe
      C:\Temp\i_zusmkecxrm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5268
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mgecztrpjh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3180
  - - C:\Temp\mgecztrpjh.exe
      C:\Temp\mgecztrpjh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2848
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5292
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2216
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mgecztrpjh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5496
  - - C:\Temp\i_mgecztrpjh.exe
      C:\Temp\i_mgecztrpjh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4488
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jebwuomhbz.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4888
  - - C:\Temp\jebwuomhbz.exe
      C:\Temp\jebwuomhbz.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5700
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1276
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2584
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jebwuomhbz.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1800
  - - C:\Temp\i_jebwuomhbz.exe
      C:\Temp\i_jebwuomhbz.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:696
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\geywqojgby.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:880
  - - C:\Temp\geywqojgby.exe
      C:\Temp\geywqojgby.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2376
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3856
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3676
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_geywqojgby.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5340
  - - C:\Temp\i_geywqojgby.exe
      C:\Temp\i_geywqojgby.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3056
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jgbyvqoiga.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4784
  - - C:\Temp\jgbyvqoiga.exe
      C:\Temp\jgbyvqoiga.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2000
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4832
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5784
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jgbyvqoiga.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2408
  - - C:\Temp\i_jgbyvqoiga.exe
      C:\Temp\i_jgbyvqoiga.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5628
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\yvqnigaysq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4380
  - - C:\Temp\yvqnigaysq.exe
      C:\Temp\yvqnigaysq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4488
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1152
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4540
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_yvqnigaysq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3660
  - - C:\Temp\i_yvqnigaysq.exe
      C:\Temp\i_yvqnigaysq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4892
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqnifdavsq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4480
  - - C:\Temp\sqnifdavsq.exe
      C:\Temp\sqnifdavsq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2240
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4268
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1864
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqnifdavsq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5248
  - - C:\Temp\i_sqnifdavsq.exe
      C:\Temp\i_sqnifdavsq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1072
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vpnhfzxspk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3228
  - - C:\Temp\vpnhfzxspk.exe
      C:\Temp\vpnhfzxspk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5180
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3112
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2700
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vpnhfzxspk.exe ups_ins
    3⤵
    PID:2608
  - - C:\Temp\i_vpnhfzxspk.exe
      C:\Temp\i_vpnhfzxspk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3628
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\spkhcausmk.exe ups_run
    3⤵
    PID:3388
  - - C:\Temp\spkhcausmk.exe
      C:\Temp\spkhcausmk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2572
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4928
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5476
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_spkhcausmk.exe ups_ins
    3⤵
    PID:3748
  - - C:\Temp\i_spkhcausmk.exe
      C:\Temp\i_spkhcausmk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4048
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kecwuomhez.exe ups_run
    3⤵
    PID:5964
  - - C:\Temp\kecwuomhez.exe
      C:\Temp\kecwuomhez.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5512
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4056
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2964
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kecwuomhez.exe ups_ins
    3⤵
    PID:5904
  - - C:\Temp\i_kecwuomhez.exe
      C:\Temp\i_kecwuomhez.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:204
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jeczurmkec.exe ups_run
    3⤵
    PID:2472
  - - C:\Temp\jeczurmkec.exe
      C:\Temp\jeczurmkec.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5636
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:800
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3164
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jeczurmkec.exe ups_ins
    3⤵
    PID:248
  - - C:\Temp\i_jeczurmkec.exe
      C:\Temp\i_jeczurmkec.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2012
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bywtomgeyw.exe ups_run
    3⤵
    PID:1556
  - - C:\Temp\bywtomgeyw.exe
      C:\Temp\bywtomgeyw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5476
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1108
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2808
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bywtomgeyw.exe ups_ins
    3⤵
    PID:1912
  - - C:\Temp\i_bywtomgeyw.exe
      C:\Temp\i_bywtomgeyw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3824
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ytrljdbytq.exe ups_run
    3⤵
    PID:2692
  - - C:\Temp\ytrljdbytq.exe
      C:\Temp\ytrljdbytq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1540
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5764
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2332
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ytrljdbytq.exe ups_ins
    3⤵
    PID:2968
  - - C:\Temp\i_ytrljdbytq.exe
      C:\Temp\i_ytrljdbytq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3584
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqlidaytql.exe ups_run
    3⤵
    PID:3528
  - - C:\Temp\sqlidaytql.exe
      C:\Temp\sqlidaytql.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2444
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1068
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4996
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqlidaytql.exe ups_ins
    3⤵
    PID:6136
  - - C:\Temp\i_sqlidaytql.exe
      C:\Temp\i_sqlidaytql.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4408
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tqnifayvqn.exe ups_run
    3⤵
    PID:5012
  - - C:\Temp\tqnifayvqn.exe
      C:\Temp\tqnifayvqn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5208
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1340
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3384
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tqnifayvqn.exe ups_ins
    3⤵
    PID:4652
  - - C:\Temp\i_tqnifayvqn.exe
      C:\Temp\i_tqnifayvqn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2548
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqkicavsnk.exe ups_run
    3⤵
    PID:4116
  - - C:\Temp\sqkicavsnk.exe
      C:\Temp\sqkicavsnk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4452
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2532
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5308
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqkicavsnk.exe ups_ins
    3⤵
    PID:3584
  - - C:\Temp\i_sqkicavsnk.exe
      C:\Temp\i_sqkicavsnk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2148
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffba56fc188,0x7ffba56fc194,0x7ffba56fc1a0
      4⤵
      PID:5348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,7042894009742026779,9600219732818054918,262144 --field-trial-handle=3016,i,727144942315749122,16583568991829562642,262144 --variations-seed-version --mojo-platform-channel-handle=3012 /prefetch:2
      4⤵
      PID:3780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,16349282969923482742,7676618806763257500,524288 --field-trial-handle=3016,i,727144942315749122,16583568991829562642,262144 --variations-seed-version --mojo-platform-channel-handle=3176 /prefetch:11
      4⤵
      System Time Discovery
      PID:3808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2292,i,13265057893597072965,2485042502683352967,524288 --field-trial-handle=3016,i,727144942315749122,16583568991829562642,262144 --variations-seed-version --mojo-platform-channel-handle=3152 /prefetch:13
      4⤵
      PID:1008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3608,i,10310939239498913543,12428260834754128749,2097152 --field-trial-handle=3016,i,727144942315749122,16583568991829562642,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
      4⤵
      PID:3836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3624,i,2945782028726509856,9076225042890941907,2097152 --field-trial-handle=3016,i,727144942315749122,16583568991829562642,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
      4⤵
      PID:4772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,17532906159493764181,15912624137649610596,2097152 --field-trial-handle=3016,i,727144942315749122,16583568991829562642,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:1
      4⤵
      PID:5700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,5334761459287998276,12450345022726484015,2097152 --field-trial-handle=3016,i,727144942315749122,16583568991829562642,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:9
      4⤵
      PID:4496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,7049290846195467889,13532525669852434876,524288 --field-trial-handle=3016,i,727144942315749122,16583568991829562642,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:14
      4⤵
      PID:4896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,5600406925660781448,3499978649674768443,524288 --field-trial-handle=3016,i,727144942315749122,16583568991829562642,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:14
      4⤵
      PID:896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,3398224727758714654,18312976731316649482,524288 --field-trial-handle=3016,i,727144942315749122,16583568991829562642,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
      4⤵
      PID:2332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,4843134528614202750,9528963143990248193,524288 --field-trial-handle=3016,i,727144942315749122,16583568991829562642,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:14
      4⤵
      PID:1912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,4843134528614202750,9528963143990248193,524288 --field-trial-handle=3016,i,727144942315749122,16583568991829562642,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:14
      4⤵
      PID:3012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,10975410860206036085,2011608688424733831,524288 --field-trial-handle=3016,i,727144942315749122,16583568991829562642,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:14
      4⤵
      PID:996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,2863283425644400602,15236900879957895578,524288 --field-trial-handle=3016,i,727144942315749122,16583568991829562642,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:14
      4⤵
      PID:1424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6688,i,14477000277848464383,13668877109445008429,2097152 --field-trial-handle=3016,i,727144942315749122,16583568991829562642,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:1
      4⤵
      PID:1296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5092,i,11091384296379813873,10392211714564801210,2097152 --field-trial-handle=3016,i,727144942315749122,16583568991829562642,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:1
      4⤵
      PID:5720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4804,i,6185425494626394890,7680520951203892717,524288 --field-trial-handle=3016,i,727144942315749122,16583568991829562642,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:14
      4⤵
      PID:5680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,8359385726194172927,2003601306939542083,524288 --field-trial-handle=3016,i,727144942315749122,16583568991829562642,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:14
      4⤵
      PID:5444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3808,i,14222025221078911202,12646088898656268055,524288 --field-trial-handle=3016,i,727144942315749122,16583568991829562642,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:14
      4⤵
      PID:256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3748,i,15596070507510603812,3127128258783854218,524288 --field-trial-handle=3016,i,727144942315749122,16583568991829562642,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:14
      4⤵
      PID:1328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5668,i,12361564942960091631,15013388377010609495,524288 --field-trial-handle=3016,i,727144942315749122,16583568991829562642,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:14
      4⤵
      PID:2968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=944,i,8855079646418275912,384397492817707976,524288 --field-trial-handle=3016,i,727144942315749122,16583568991829562642,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:14
      4⤵
      PID:1956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2660,i,9814840334860091807,6590575480513600959,524288 --field-trial-handle=3016,i,727144942315749122,16583568991829562642,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:14
      4⤵
      PID:708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3760,i,11923279006956944233,16650013743858311604,262144 --field-trial-handle=3016,i,727144942315749122,16583568991829562642,262144 --variations-seed-version --mojo-platform-channel-handle=2664 /prefetch:10
      4⤵
      PID:1764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3412,i,3398291921898811281,12454816129348882638,524288 --field-trial-handle=3016,i,727144942315749122,16583568991829562642,262144 --variations-seed-version --mojo-platform-channel-handle=3056 /prefetch:14
      4⤵
      PID:2016

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2116

C:\Temp\ysqkigayvtnliday.sys
C:\Temp\ysqkigayvtnliday.sys
1⤵
- Executes dropped EXE
PID:3116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5956

C:\Temp\ausnkfdxvs.sys
C:\Temp\ausnkfdxvs.sys
1⤵
- Executes dropped EXE
PID:256

C:\Temp\fcaxspkica.sys
C:\Temp\fcaxspkica.sys
1⤵
- Executes dropped EXE
PID:4332

C:\Temp\zxrpkhcaus.sys
C:\Temp\zxrpkhcaus.sys
1⤵
- Executes dropped EXE
PID:4160

C:\Temp\wuomheczur.sys
C:\Temp\wuomheczur.sys
1⤵
- Executes dropped EXE
PID:4320

C:\Temp\mgezwrojhb.sys
C:\Temp\mgezwrojhb.sys
1⤵
- Executes dropped EXE
PID:1036

C:\Temp\geywqojgby.sys
C:\Temp\geywqojgby.sys
1⤵
- Executes dropped EXE
PID:2596

C:\Temp\jdbytqolgd.sys
C:\Temp\jdbytqolgd.sys
1⤵
- Executes dropped EXE
PID:4800

C:\Temp\qlidbvtnlg.sys
C:\Temp\qlidbvtnlg.sys
1⤵
- Executes dropped EXE
PID:2012

C:\Temp\yvqnifaysq.sys
C:\Temp\yvqnifaysq.sys
1⤵
- Executes dropped EXE
PID:3520

C:\Temp\xsqkicausm.sys
C:\Temp\xsqkicausm.sys
1⤵
- Executes dropped EXE
PID:5064

C:\Temp\upnhfcausp.sys
C:\Temp\upnhfcausp.sys
1⤵
PID:2012

C:\Temp\upmkhcausm.sys
C:\Temp\upmkhcausm.sys
1⤵
PID:2692

C:\Temp\jhbzwrpjhe.sys
C:\Temp\jhbzwrpjhe.sys
1⤵
PID:4724

C:\Temp\bztromjebw.sys
C:\Temp\bztromjebw.sys
1⤵
PID:2616

C:\Temp\ojytrljdbw.sys
C:\Temp\ojytrljdbw.sys
1⤵
PID:3120

C:\Temp\igaytqljdb.sys
C:\Temp\igaytqljdb.sys
1⤵
PID:2620

C:\Temp\avtnlfdxvq.sys
C:\Temp\avtnlfdxvq.sys
1⤵
PID:3000

C:\Temp\vpnkfcaysq.sys
C:\Temp\vpnkfcaysq.sys
1⤵
PID:5656

C:\Temp\vpnhfaxspk.sys
C:\Temp\vpnhfaxspk.sys
1⤵
PID:676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ausnkfdxvs.sys

Path C:\Temp\ausnkfdxvs.sys
Size 293KB
SHA256 2f1d3fe5a85399e6a2173871940f02188b1ab87f8a205daff5b90a0aebdd401a
MD5 6655cd224c651cd76b145c84b603de71
SHA1 0ae312002ed8db9afa464479125ff9a45d732c7a
SHA512 40cd374df422c1763cc51ef917f9a973968dfeefbb9a426598072d120383784affecae876f07a84e9a81f56aee76ddfa4ce03517d8df55302dc5f9a76f8fdcb3
SSDEEP 3072:YtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:YIJjiJcbI03GBc3ucY5DCSj
TLSH
T14D545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cxupmkfcau.exe

Path C:\Temp\cxupmkfcau.exe
Size 384KB
SHA256 af6f00c7c0520d166b3c6680ed41418c09cd8c0b2dda738e8267ebc9039d3715
MD5 46bcf562e2a6cc1b8c3a1beadc498556
SHA1 a299f9006c3220570c9433b6c3bf889bd335a505
SHA512 ca42dc93db8a2a8b87197ca0de65b9931051fe5cdd85834494a09f67cfcfd7c60a88cfa7b3b73733e2b9fdd167a8601b9509a6068101e1c3cd341a052af22464
SSDEEP 3072:ujtF1eNGL8tpdhJmaMOk4y3tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/09:mtf7ZIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B9847B00BAA4F0F6D995047800EFAF36A67E74281726CBC3E754CE5D9A113C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fcaxspkica.sys

Path C:\Temp\fcaxspkica.sys
Size 293KB
SHA256 b919dfc9db08f445ee1906228be59cf29fb8ddab5d86d70c0fecb64e898c15dc
MD5 07488f30a3b44cfbb3d97e202a2ecb19
SHA1 b7636ff5fcba1a4249307debfbde39e64e2753e1
SHA512 9bfc417eccbd0aacea3d302e8b4c55815a93f055c89208705aac2aa0622569876d1f751429389a1526f98e8531d157c3040019dadcfdb98a9d084d74aa74f917
SSDEEP 3072:9tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:9IJjiJcbI03GBc3ucY5DCSj
TLSH
T10E545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gaysqnlfdy.exe

Path C:\Temp\gaysqnlfdy.exe
Size 384KB
SHA256 00cfe15b162d8cde8c4804583c6f99f324f9cca1de6cfba907c8fb6912d5f55b
MD5 791e0fd2973cca2ed66d0fa5bb952f11
SHA1 ec18a7a96dba5f66a4c207f66eda334ce90d96e0
SHA512 50fa230f58e354880d3cdfb56ed48e19fe1a8444f8b5613e8cf6a3a30910f40126c1c9e5d5ee7b088496c19b8031f0f8adfcbb3a448fc6c9ff47bbc2408e9ace
SSDEEP 3072:WjtF1eNGL8tpdhJmaMOk4y3tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/09:Otf7ZIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C5847B00BAA4F0F6D995047800EFAF36A67E74281726CBC3E754CE5D9A113C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_cxupmkfcau.exe

Path C:\Temp\i_cxupmkfcau.exe
Size 384KB
SHA256 23f3dc6a3dff431a88b783c014358e55b27fb828587c864b5e0615a9bdfc212a
MD5 1516fc52ad855a4c6df82b1a8909909a
SHA1 04a8fe49c52ec389cb5d5b395815f277ad5db3fe
SHA512 5638ee20b099cdf49ab5ef98219d9868af4dde1471e78f6f86c25d3b633cef92edc23f32467dcc7887716deab04f2b26886d5c35923b9f3fca5be22755f6beee
SSDEEP 3072:jjtF1eNGL8tpdhJmaMOk4y3tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/09:ntf7ZIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1BE847B00BAA4F0F6D995047800EFAF36A67E74281726CBC3E754CE5D9A113C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gaysqnlfdy.exe

Path C:\Temp\i_gaysqnlfdy.exe
Size 384KB
SHA256 807ae66ab1fa0425f805d32c0a435d13f54e6b22cdf815fb8c2280f4f29117cb
MD5 a89874209eca9a8aea80deb5089f2d5e
SHA1 b3e9f2fc4e9ca7daae9f8fc20f9e3d405dce4b2f
SHA512 e64deea000acbeda765365abefa7d863f3085723591ae41dd60ad09d116968edd07aab6b4080dfeadb44347e751287b7e9442fed8ec659813d7591e148c6fd9e
SSDEEP 3072:2jtF1eNGL8tpdhJmaMOk4y3tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/09:utf7ZIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D8847B00BAA4F0F6D995047800EFAF36A67E74281726CBC3E754CE5D9A113C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lfdavsqkif.exe

Path C:\Temp\i_lfdavsqkif.exe
Size 384KB
SHA256 8e3e8da83b43d33a881f6444aeb9985099a98fac2825e42de8cb4fc61f828254
MD5 2632b779ce326de1f5881ecb45493ea0
SHA1 7e28daad4e4a85f8b07b3c589dda38fc2ee8f503
SHA512 59c57bcc2aa2d369ce5c7a8db6b501318c2ce1e668ec66c2c432a7262f01e170d4feb9a0df9b3763240eadbc308dde7843cecfe5d813f0952a6b1cb0c7ca880f
SSDEEP 3072:CjtF1eNGL8tpdhJmaMOk4y3tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/09:Stf7ZIJjiJcbI03GBc3ucY5DCSjX
TLSH
T116847B00BAA4F0F6D995047800EFAF36A67E74281726CBC3E754CE5D9A113C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mgecztrpjh.exe

Path C:\Temp\i_mgecztrpjh.exe
Size 384KB
SHA256 edabd22cb928c92dc1b59719a168e6ca03d0735b27bc7654fc1ed1e2c0bd60bc
MD5 7500ddb9d6b2bd13e7c94941c7f0d4ec
SHA1 59a82ed7de156b1609891c58164dc12e58837c5f
SHA512 2446e2a7dbbec1ffb013112fbd926d13d29627bae887306f77e12122eeaac44844338e145a296cabd909507ae73441605e7fc71a7c1ad70d171bedc967385d2b
SSDEEP 3072:BjtF1eNGL8tpdhJmaMOk4y3tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/09:5tf7ZIJjiJcbI03GBc3ucY5DCSjX
TLSH
T154847B00BAA4F0F6D995047800EFAF36A67E74281726CBC3E754CE5D9A113C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zusmkecxrm.exe

Path C:\Temp\i_zusmkecxrm.exe
Size 384KB
SHA256 6bbb69ce0a5e63c47909f63c83f0af58368893b2b505c3fd1f45e533ba74f2e6
MD5 e8fa21ba1ccdfc86372e47ffaedb8eb9
SHA1 55eb40c9c31de8a2ca65904272f5331994a2ec0c
SHA512 b24bc1b12462f9f8813c059ac7126a17c57df65f54303ff59146b1468f574d0bd0291c2a46952e3c5d94361cfdfe70a58d37f15336c71690f1945ef6c6ecdd18
SSDEEP 3072:ajtF1eNGL8tpdhJmaMOk4y3tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/09:Ktf7ZIJjiJcbI03GBc3ucY5DCSjX
TLSH
T13E847B00BAA4F0F6D995047800EFAF36A67E74281726CBC3E754CE5D9A113C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jebwuomhbz.exe

Path C:\Temp\jebwuomhbz.exe
Size 384KB
SHA256 2f2f7db2b0af1e48e72da9f8bf79fb89610304dde9b53d4a5be7bacb2e1c667c
MD5 e202027937eb205777053129f12360ef
SHA1 3932736b3c3b4839d9b7eb058a4ea3dd9857452f
SHA512 42ce1fbaf3efc0482e344b1d20761551bc8e843a82b85bad65c65fa3ef8acc8c385b37c741a9074495e56c81d1aafba9710f68ec32fe2cb4244cb8344e7f1016
SSDEEP 3072:/jtF1eNGL8tpdhJmaMOk4y3tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/09:btf7ZIJjiJcbI03GBc3ucY5DCSjX
TLSH
T196847B00BAA4F0F6D995047800EFAF36A67E74281726CBC3E754CE5D9A113C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lfdavsqkif.exe

Path C:\Temp\lfdavsqkif.exe
Size 384KB
SHA256 5568bc616eb17b33f778f70eaa57affd938c83929e6f22db516b1b26a28f6166
MD5 26b104206922b59337da8ae7eae51fcc
SHA1 72bb243a8e41553bf20957708a2abdf98895bcf2
SHA512 0b5437fffe26c396969c8f91809c7277f99f133b4de2cdc5097a42de8e92762c362f74d5c40d60afe039d340c3efc3809fe3de7457011bab2e7302ca5d334cca
SSDEEP 3072:gjtF1eNGL8tpdhJmaMOk4y3tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/09:Mtf7ZIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F2847B00BAA4F0F6D995047800EFAF36A67E74281726CBC3E754CE5D9A113C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mgecztrpjh.exe

Path C:\Temp\mgecztrpjh.exe
Size 384KB
SHA256 37eea02f6634684be280cf9487408b31492e6c7581a206775178aa2631d7bda4
MD5 432d7ab6a570e66c06446147058feac8
SHA1 9a6a29a7fa1275ff8a1e8393029327998b0f49a2
SHA512 5ba7b1b21afb775b874cd5ae1e04356172379c252aa66eafe52933a60bfff13e5421b34d2d9f5276c44f554f95e6affeba1164bf7f216fdf91891bd0377037bf
SSDEEP 3072:FjtF1eNGL8tpdhJmaMOk4y3tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/09:1tf7ZIJjiJcbI03GBc3ucY5DCSjX
TLSH
T127847B00BAA4F0F6D995047800EFAF36A67E74281726CBC3E754CE5D9A113C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mgezwrojhb.sys

Path C:\Temp\mgezwrojhb.sys
Size 293KB
SHA256 880987cafbb1e78e14ee28af75e899ab8c3f6d629dd9dc6b1f5d6c1fa56b540f
MD5 d1b4a0233e2a3bbbdbc4ad6f4374ecc5
SHA1 57357228b957e552fed4f8fd68ba606503353cad
SHA512 28dc3b4c799d19cdb20c1cea09f192195ff61f01a605f223838cc260c3dc84162888a0223323c4aeb0f445bf7fffd4bb04e84097cf375b42b1a4313958b58784
SSDEEP 3072:6tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:6IJjiJcbI03GBc3ucY5DCSj
TLSH
T194545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wuomheczur.sys

Path C:\Temp\wuomheczur.sys
Size 293KB
SHA256 10f6638e0ae25761bf4a141f1c354ba6476db4ad05a599c9c2f75defc1aba933
MD5 1513ccfce42f99b4599301c35e53dd48
SHA1 2b1778737c85cb43f31b34fa533c2bb662e14435
SHA512 3c730c45a2fd1ab22839c5c63f8f5d9775ebc6a68dbcd56e281720cab6ca96ac4bd6e6e0708cda5631dff774e2271635effd437fa38509cbdbbec648a1a4527b
SSDEEP 3072:ntKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:nIJjiJcbI03GBc3ucY5DCSj
TLSH
T1AE545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ysqkigayvtnliday.exe

Path C:\Temp\ysqkigayvtnliday.exe
Size 384KB
SHA256 7b3704160fbe36a61ce1c395f501c8ab6c9524a7de61f0f3a38ad8346a961e0c
MD5 5c7315e5b4e8a4643eeef842b6057593
SHA1 1c766cadd694accecaadb54d207350670ac53a00
SHA512 6e2105cf26d778e8702a179fb295191b27236a81b07169c9f68c529a2086d6eb2904e44712cbff1d07f8f329b0541751958584d7f188fd785ed1c4ef7dbc214c
SSDEEP 3072:fjtF1eNGL8tpdhJmaMOk4y3tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/09:7tf7ZIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1FE847B00BAA4F0F6D995047800EFAF36A67E74281726CBC3E754CE5D9A113C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ysqkigayvtnliday.sys

Path C:\Temp\ysqkigayvtnliday.sys
Size 293KB
SHA256 b77b6efb64bfc2cbc7f3c9da9261746b2e7b03bc2f1487d83e64ce27330d8ced
MD5 9b3f79f0fcf6e4ab18f5c1321050e89a
SHA1 582a24bd8b592be55727a083533c27c39781833a
SHA512 b6fc7c5d83704efdd90919da4c5c22f090614f9b5577102cc2eaa366239f3b03d4a6e536a7cfd164955ea508343db031b01a8b7814d6e034096c015a657a8944
SSDEEP 3072:qtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:qIJjiJcbI03GBc3ucY5DCSj
TLSH
T1A8545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zusmkecxrm.exe

Path C:\Temp\zusmkecxrm.exe
Size 384KB
SHA256 62fe7162fe22ac56b573109ea5e5285e02138ab6bf5219d4cd3a1a582ba82d5e
MD5 fb34f50fddade2fe31bb1515c4e13869
SHA1 fb39ed49a1f89b187e24db79689cefebca7b53ec
SHA512 175644b7835a1bb26ba61249c2aa272ea7b087e3d44b34174dd09c58bb2d4938a531338b1d108291194bd7edc3db2b176abd40a4d07e7e6d8585998cc9b4a1e9
SSDEEP 3072:mjtF1eNGL8tpdhJmaMOk4y3tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/09:+tf7ZIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1BF847B00BAA4F0F6D995047800EFAF36A67E74281726CBC3E754CE5D9A113C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxrpkhcaus.sys

Path C:\Temp\zxrpkhcaus.sys
Size 293KB
SHA256 0825caeffbd5e16f309c50393c7207b92ac26fdd6ae4c2856fad43092d5cf113
MD5 733bdd786d155046898759e219043faf
SHA1 91dd31c578b64aff31ae2fcd572ec59530b5c0bb
SHA512 300af98fb2a60279d56fb6d05efb34aa38eb6e82d14032e19290f4ea63fd19e48dbc6b26606c030bf28d05fc652778f881c6970bccc6b6ec3facad23a7201f99
SSDEEP 3072:ItKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:IIJjiJcbI03GBc3ucY5DCSj
TLSH
T1E8545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5e1a5fea1006889b9c3bcf0a470a6a4256d5300a4b7036038ddce5fd042c424c
MD5 e9af81b8f1175d007e2c699939cb3df6
SHA1 696178bffe86e4e363a26747d6a5cb80e28621ce
SHA512 38174d529846c50b0af9a056e65ca491645c3cbf1fb867ef22a3b7c7ee4287ba29c3a28d736bc2e9c562faa24bb671db3b9cc40507a467140e47eaa4aeae6d51
TLSH
T145D0C0343E38F408C540207AE4514310E3138131302B8242B010F03DEC581810BDE0CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 674d24008448b140a9b320032b4ed333cf5a592b073bf375c453c816d33c703b
MD5 b989ec4e221bd567659492bc1ad7ab3b
SHA1 372670805b3060960e77e6ba32a3b9edd0241cf0
SHA512 f6934e6a831bcac97110107a79389dae0e669b743e0d62e5b411c19471bf237f4d61c7cee27d9fcacbd7045cbe27e78b4e6c38f6e76ca789a7760295558b0bb3
TLSH
T1CBD0C0383E28F508C5402076E4504310E3238131742B8242B010F02DEC581810BDF0DF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 06b54b074a879e17afa03ca823839d491ee2f23fd1f2b9dd42f91ce15ddfa54b
MD5 935d48578664d7dbecd250e34870633c
SHA1 0763539f820aa96998625f3a8f90a13dfd459f88
SHA512 55a6be56b70299b1ad28fb09d3316482dd440bd2259190d8cce0984ecaf7ae2a388f65881f8cc5126a7a57d790a6a32f697ba884d39dfb67a95e002f5f904d52
TLSH
T17D61930AE8C30981D72742F427E201E43738EA9E69C31D27005CE57DB6E57D6AE52839
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe590219.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe590219.TMP
Size 3KB
SHA256 0366120f36e295bbdd040934a774ed191e72e76c105f28223a8e0bee3c1a8d75
MD5 71c324e9c7a49fd51a031afe58435dea
SHA1 1dda141e804b4387da1b7fd13a4682abc92793ea
SHA512 0836452bbc13c5536c521e809dc5a23b95fb2c51de7985a5f09d21899e7b7179033adbb29ad66cf50d3af75fc7a0022446872d879f9d6d5270977d561abb8228
TLSH
T1BF61940AE9C30981D72702F027E201E43738EA9E69C31D27004CE57DB6F67D6AE52839
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

58628297-0f6a-4cbc-9bc3-685068fe460c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\58628297-0f6a-4cbc-9bc3-685068fe460c.tmp
Size 2KB
SHA256 3da93fa12e1a73221280e8204dd9cf51a5017e0336f1d96c1882efbb71078352
MD5 94a2314f2e51eee9ec5d47de63fd0eb3
SHA1 8b633763cf653958c92cb3f284bac7a07cd227b2
SHA512 544be93e0a0e464236882574a1b05e9deaa532e2aaef442531bb8aea13b7035ba1f5468b2efe27089230091e1a4b6308d68cffa4b77b7d3d882a3c343ed66d60
TLSH
T19A41BDF7C7E4866E890195F0BA186E2BCE1D0915832C3D5A89E4AF1B93E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 582be2250949cccb5f00b4174f1a2b29c551a48ce3cf4dac152d02665bf8c211
MD5 ab647d1ccfd211bcf0ff9bab933bf204
SHA1 f7afff1cbffa26b021698998eb90c481497f7c81
SHA512 6d4c9752702bd1ef518f458179c0d53c9c7082d8a2eb5d65a99ab25dea326c79c8e23de4e3e3b6ecf57a1b428dfd539d900a218344938552de4a3f554a8c8ac1
SSDEEP 192:sxRV3RRIayM/jK1Ml8UQYHcYp/f4eujsYxRxjtZo31WZBKYWzoA8prV4/g6+WNCN:sxRDdqXK/f4eUs8jDo3U/S/5d/gF0K
TLSH
T1E862D916AA3459778CDBD20DFA51BF53D6F91473A2500E44AAFCCA0C01E76DD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 0869a4848f270b16081967188d77750c0664b0a80487bcc91984588906accf59
MD5 c31860a500a0e1c22fca5eefcef02834
SHA1 e8467a8d7d87ad13f5f0e9e1b90ee230d007e34b
SHA512 9fc8ce04fac34753238c813a3936681d13e924f30a519bcf8e5d26467db88aa701e8e498bc5a62926ec9257edf25fa958eda80bec26a2bd31176926511a79dce
SSDEEP 192:sxRV3RRIayM/jK1Ml8wcYp/f4eujsYxR8tZo31WZBKYWzoA8p9V4/g6+WNCVzq/E:sxRDdCK/f4eUs8aDo3U/U/5d/0F0c
TLSH
T19762EA16AA34593B8CDBD20DFA55BF53D6F91473E2500E44AAFC8A1C01E76ED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 2769e619ab3c1c1bdf1a367880b1f91dcaff3d050e1944abe703c89767f79362
MD5 5fe9ee2fa97cc2e8e0e9f0b055be11c0
SHA1 f9921bb3ea1c356fb3258a29342e03d2608bd4ca
SHA512 cac2b902d41bc2b0b8495ddf5c931735acb37bd249f4b9ece1b8bddd6c2070fb9f20be8472f696cb39490782949c6bd2035793b2397b06e9330666ac1743d8c9
SSDEEP 192:sxRVCRRIayM/jK1Ml8wcYp/f4eujssR8tZo31WZtKYWzoA8pi/g6+WNIY+8uFwZV:sxRATCK/f4eUssaDo3U3i/5IzF03
TLSH
T11452D9156A38593BCCDBD20DFA55BF53D6F91423A2900E44AAFCCA1C05E76ED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 a6f9d28a9f61dbd6d04eb2b62594d18bf90405238e60b159b3f2b5713cb2faa1
MD5 d279cd2f20e5a231d3ca47e6738a4383
SHA1 fb7eb613e252be789e87e73c23b732142bbff2c0
SHA512 31f29509cab94b6f93095c6680332e0418bd60727d62f1716be08c37ba3d9ffc3a8682a9617494fe1be47e8ed9c83fcee0fa5fedd889fb975c5c02d880bf95cd
SSDEEP 768:7dUhBR7pLuL7tgWgEyf3w8F1+UoAYDCx9Tuqh0VfUC9xbog/OV76Ge0GdroddLH:7dUhBHE7tgWgEyf3wu1jak6GRGWd9H
TLSH
T1B7E2FC3B680CCB7F4F404ADCE829BD9A6DA901CF9698CD5447EA840C03C6BEF551A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a80e56f7-f646-4096-9a97-32a1bffa2da1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\a80e56f7-f646-4096-9a97-32a1bffa2da1.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 3dc40423389ee2517610a63e8d00236cd2c9db8543958cbe22f01ec128624254
MD5 782e166436a8ff1709037e3f8488a462
SHA1 f74e78a0c78d5216590a921225bae32af30396a3
SHA512 95fc86d2138903f834e7065483254fa665ca5e3b2cf9b52bb0323d6be757bed903b0e6c605bff37b91a0c6dbf33dc36d99eb52a428604ee580137c221963f86a
SSDEEP 768:Orv+4UNbdp3yj5ztwMcvnWgWWR+2SrXH78tRkTY+8rr6F:Obsb/3jJPWg1bSroEYDr6
TLSH
T10D03BF32A8689D73DCF2D685B20A76437FF44183D6C91B88C4D91B4E429F9DE270BC66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 6850a1335f5346935374649a86cee43885303240c9ec9007894c74c1e3a9d5ac
MD5 04e4eb68f0cc88c9e2a25ec4e5306445
SHA1 e43c1b9c9719add63ac1de3701bd0bdec40c2723
SHA512 613a8d0060649d09c2ba40c0fb191ed7a46ff397ef30555be97e040bd89b907c66303c77aa9c02aa961a6faeaedfe876b448375a922f996c5bf9e62547362261
SSDEEP 768:8hj+9A3K4l5ztAMcvnWgWWR+2SrXH78tRM/c8KzdJ5:B9A3KJPWg1bSroactzdJ5
TLSH
T1E6F2BF31BC568DB38CE6D2C8B206B793BFF04193D5895E48D0D95F0D458B69D2B0BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 250573fd96a7ea3dd8481ab2ed87c47267f69c1875f3dc60039517d34c70dbf6
MD5 fd0504e153e9996cab208d7969977b12
SHA1 9c47df117451e7e72af57668ec9d1a5cd8948219
SHA512 f6311937a29ddefb164807aa0ff5e2f06ebf234045dccfb7e1ccff4cf3ec53fef22f50e50959f6cbda1d93c42aecf3a568ae5608b243d44e4fc6c660f7694a20
SSDEEP 768:Mj+9A3p3sl5ztYMcvnWgWWR+2SrXH78tRM/c8KzdJ5:L9A3x/JPWg1bSroactzdJ5
TLSH
T161F2BF31BC568DB38CE6D6C9B206B793BFF04193D5895E48D0D95F0D058BA9D2B0BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 c7acd11c9da60f08e50ba41756a613c8268074fa05b740c85800baa6715c54d0
MD5 81d30030246547e5669f74c1e1a1c4d6
SHA1 c619dde4fc9498448ebece7a9881e337b4e01689
SHA512 dae90e6a05f5594f4d67fabd107ad9a791dfebf5b6ba885ee2b1a56351ec5129291f9cbbbe3a8028a49d59fe3fe61839d00e05701972972bf983ece396b1ad78
SSDEEP 768:Hj+9A3K4l5ztBMcvnWgWWR+2SrXH78tRM/c8KzdJ5:q9A37JPWg1bSroactzdJ5
TLSH
T1C9F2BF31AC568DB38CF6D6C8B206B793BFF04193D5895E48D0D96F0D458BA9D2B07C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 6b91a66780d16f58fac223d2c52379a53f1cf30d116a2d0d10254fac7e487bc2
MD5 78660160385911b5522f576867cb1740
SHA1 8467fc86229a8f33fd4c3a96f0bce0b9862b9756
SHA512 8392c28120cf9607269cded70051eadf5a09c6dbd5f0be56dd628a9c59910d93d765b64db4b8596e377143d2674966d1affc92fad7b2bf1d88bff3ed89603d58
SSDEEP 768:RFKj+9g3nwgx3OnPtKMcvnWgWWR+2SrXH78tRM/c8KzdJ5:Z9g3DBJPWg1bSroactzdJ5
TLSH
T1121328F698D38976D8EE8787A33D6E429EBCC193B5885984B3C81D0CCC865BFD706815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

76d70755-a6f4-4b6a-a23d-c95a2a95adb4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\76d70755-a6f4-4b6a-a23d-c95a2a95adb4.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2816_2105371470\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 d582a2a757cf731ccd95b50cb98327c052ad8ee314fe2362bd708f4db2d8ca3b
MD5 05b646386d7bdc0a1be039b77c009660
SHA1 28144f55c95df9bb6cc92766a105fc347a2e4870
SHA512 8a22edbdc96210fea67d1a7c884a1e1130655bc8df7bac813de31bcfde26fe7009c376db6fd524ea9f73adfe8ad8d3aa608e522f43aef7578b1a4dc1ff4cb80d
TLSH
T18871239396B9CAB2C1DE5FF102835244F2FB22380763302407955587AB70F3A54B8F08
MD5 SHA1 SHA512 TLSH

Submit Download

memory/256-197-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/676-499-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1036-296-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2012-360-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2012-389-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2012-410-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2596-321-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2616-433-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2620-466-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2692-409-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3000-470-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3116-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3120-445-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3520-343-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4160-272-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4320-284-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4332-244-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4724-435-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4800-325-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5064-369-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5656-495-0x0000000000010000-0x00000000000AB000-memory.dmp

Download