systex | b2db756cceb1d6d9679a5914640d80d7d6fd9d91fb481285a11251217a0202ca

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 17:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_c950b8ec28ea5f5818ee599e004db995_amadey_darkgate_elex_smoke-loader_stop.exe
Size 384KB
Sample260706-v81kcaet3m
SHA256 b2db756cceb1d6d9679a5914640d80d7d6fd9d91fb481285a11251217a0202ca
MD5 c950b8ec28ea5f5818ee599e004db995
SHA1 8fe38957b1ff94058ec4e5bb086626f02cd66ceb
SHA512 2b3755967c750199479a53d6d6ebc5fce01df4c4ebc557a53cbdac3660b86699a6ac488feed9c30cec43211e26d84803b3d0623bb9b0f5da421353c8a389aa55
SSDEEP 3072:fbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:fbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T11B847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC3F754CE5D9A517C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
4580	jhbzurmkecwuomhe.exe
2652	jhbzurmkecwuomhe.sys
3444	CreateProcess.exe
2704	khbzurmhez.exe
4472	CreateProcess.exe
2016	CreateProcess.exe
3688	i_khbzurmhez.exe
5616	cztrljecwu.sys
4328	CreateProcess.exe
2656	uojezwromg.exe
1056	CreateProcess.exe
3520	CreateProcess.exe
3200	i_uojezwromg.exe
1172	olgebztroi.sys
4092	CreateProcess.exe
4388	ljdbztolgd.exe
4392	CreateProcess.exe
3412	CreateProcess.exe
3268	i_ljdbztolgd.exe
5000	dyvqolgdyw.sys
1112	CreateProcess.exe
2932	dywqoigbyt.exe
3056	CreateProcess.exe
3456	CreateProcess.exe
1376	i_dywqoigbyt.exe
4596	yvtnlfdayt.sys
3744	CreateProcess.exe
1512	nifaysqkig.exe
5964	CreateProcess.exe
5868	CreateProcess.exe
2000	i_nifaysqkig.exe
3464	ysqnigaysq.sys
4936	CreateProcess.exe
3200	ysnlfdxvpn.exe
4584	CreateProcess.exe
4664	CreateProcess.exe
2468	i_ysnlfdxvpn.exe
5012	nkifzxvsqk.sys
4848	CreateProcess.exe
2500	spnhfcxusq.exe
1268	CreateProcess.exe
1064	CreateProcess.exe
1508	i_spnhfcxusq.exe
3596	upmkhcausm.sys
4536	CreateProcess.exe
6136	urpkhfzxrp.exe
2284	CreateProcess.exe
4156	CreateProcess.exe
1688	i_urpkhfzxrp.exe
2228	ezxrpjhczu.sys
2728	CreateProcess.exe
1100	uomkecztrp.exe
1108	CreateProcess.exe
5560	CreateProcess.exe
2732	i_uomkecztrp.exe
5844	zurpjhezwu.sys
200	CreateProcess.exe
2556	xrojgezwrp.exe
4984	CreateProcess.exe
940	CreateProcess.exe
2020	i_xrojgezwrp.exe
3896	ztrljebwuo.sys
2892	CreateProcess.exe
5476	trljebwtol.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1544_1224262049\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1544_1224262049\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1544_1040060761\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1544_1224262049\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1544_1224262049\office_endpoints_list.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1544_1590948477\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1544_671056677\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1544_671056677\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1544_1040060761\nav_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uojezwromg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysnlfdxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomkecztrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ytqoigaywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqnicaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axspkicaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbztolgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spnhfcxusq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urpkhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vqnlidavtq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezwuomkecz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_khbzurmhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysnlfdxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrojgezwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljebwtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	khbzurmhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrojgezwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqnicaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upmhezxupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-06_c950b8ec28ea5f5818ee599e004db995_amadey_darkgate_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhbzurmkecwuomhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nifaysqkig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spnhfcxusq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ytqoigaywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axspkicaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uojezwromg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dywqoigbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nifaysqkig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpnhfcaurp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbztolgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urpkhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomkecztrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljebwtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vqnlidavtq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezwuomkecz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhbzwrpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dywqoigbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpnhfcaurp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_upmhezxupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhbzwrpjhb.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3832	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4628	ipconfig.exe
5816	ipconfig.exe
3628	ipconfig.exe
4308	ipconfig.exe
5012	ipconfig.exe
4080	ipconfig.exe
4448	ipconfig.exe
2948	ipconfig.exe
2744	ipconfig.exe
1668	ipconfig.exe
5944	ipconfig.exe
1320	ipconfig.exe
2532	ipconfig.exe
3060	ipconfig.exe
4308	ipconfig.exe
5816	ipconfig.exe
4704	ipconfig.exe
4512	ipconfig.exe
2620	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2626306573-1585762579-411806764-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2626306573-1585762579-411806764-1000\{B7C56C11-9C8E-4D01-A743-DB980D0E8A94}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3812	2026-07-06_c950b8ec28ea5f5818ee599e004db995_amadey_darkgate_elex_smoke-loader_stop.exe
3812	2026-07-06_c950b8ec28ea5f5818ee599e004db995_amadey_darkgate_elex_smoke-loader_stop.exe
3812	2026-07-06_c950b8ec28ea5f5818ee599e004db995_amadey_darkgate_elex_smoke-loader_stop.exe
3812	2026-07-06_c950b8ec28ea5f5818ee599e004db995_amadey_darkgate_elex_smoke-loader_stop.exe
3812	2026-07-06_c950b8ec28ea5f5818ee599e004db995_amadey_darkgate_elex_smoke-loader_stop.exe
3812	2026-07-06_c950b8ec28ea5f5818ee599e004db995_amadey_darkgate_elex_smoke-loader_stop.exe
3812	2026-07-06_c950b8ec28ea5f5818ee599e004db995_amadey_darkgate_elex_smoke-loader_stop.exe
3812	2026-07-06_c950b8ec28ea5f5818ee599e004db995_amadey_darkgate_elex_smoke-loader_stop.exe
3812	2026-07-06_c950b8ec28ea5f5818ee599e004db995_amadey_darkgate_elex_smoke-loader_stop.exe
3812	2026-07-06_c950b8ec28ea5f5818ee599e004db995_amadey_darkgate_elex_smoke-loader_stop.exe
3812	2026-07-06_c950b8ec28ea5f5818ee599e004db995_amadey_darkgate_elex_smoke-loader_stop.exe
3812	2026-07-06_c950b8ec28ea5f5818ee599e004db995_amadey_darkgate_elex_smoke-loader_stop.exe
3812	2026-07-06_c950b8ec28ea5f5818ee599e004db995_amadey_darkgate_elex_smoke-loader_stop.exe
3812	2026-07-06_c950b8ec28ea5f5818ee599e004db995_amadey_darkgate_elex_smoke-loader_stop.exe
3812	2026-07-06_c950b8ec28ea5f5818ee599e004db995_amadey_darkgate_elex_smoke-loader_stop.exe
3812	2026-07-06_c950b8ec28ea5f5818ee599e004db995_amadey_darkgate_elex_smoke-loader_stop.exe
3812	2026-07-06_c950b8ec28ea5f5818ee599e004db995_amadey_darkgate_elex_smoke-loader_stop.exe
3812	2026-07-06_c950b8ec28ea5f5818ee599e004db995_amadey_darkgate_elex_smoke-loader_stop.exe
3812	2026-07-06_c950b8ec28ea5f5818ee599e004db995_amadey_darkgate_elex_smoke-loader_stop.exe
3812	2026-07-06_c950b8ec28ea5f5818ee599e004db995_amadey_darkgate_elex_smoke-loader_stop.exe
3812	2026-07-06_c950b8ec28ea5f5818ee599e004db995_amadey_darkgate_elex_smoke-loader_stop.exe
3812	2026-07-06_c950b8ec28ea5f5818ee599e004db995_amadey_darkgate_elex_smoke-loader_stop.exe
3812	2026-07-06_c950b8ec28ea5f5818ee599e004db995_amadey_darkgate_elex_smoke-loader_stop.exe
3812	2026-07-06_c950b8ec28ea5f5818ee599e004db995_amadey_darkgate_elex_smoke-loader_stop.exe
3812	2026-07-06_c950b8ec28ea5f5818ee599e004db995_amadey_darkgate_elex_smoke-loader_stop.exe
3812	2026-07-06_c950b8ec28ea5f5818ee599e004db995_amadey_darkgate_elex_smoke-loader_stop.exe
3812	2026-07-06_c950b8ec28ea5f5818ee599e004db995_amadey_darkgate_elex_smoke-loader_stop.exe
3812	2026-07-06_c950b8ec28ea5f5818ee599e004db995_amadey_darkgate_elex_smoke-loader_stop.exe
3812	2026-07-06_c950b8ec28ea5f5818ee599e004db995_amadey_darkgate_elex_smoke-loader_stop.exe
3812	2026-07-06_c950b8ec28ea5f5818ee599e004db995_amadey_darkgate_elex_smoke-loader_stop.exe
3812	2026-07-06_c950b8ec28ea5f5818ee599e004db995_amadey_darkgate_elex_smoke-loader_stop.exe
3812	2026-07-06_c950b8ec28ea5f5818ee599e004db995_amadey_darkgate_elex_smoke-loader_stop.exe
3812	2026-07-06_c950b8ec28ea5f5818ee599e004db995_amadey_darkgate_elex_smoke-loader_stop.exe
3812	2026-07-06_c950b8ec28ea5f5818ee599e004db995_amadey_darkgate_elex_smoke-loader_stop.exe
3812	2026-07-06_c950b8ec28ea5f5818ee599e004db995_amadey_darkgate_elex_smoke-loader_stop.exe
3812	2026-07-06_c950b8ec28ea5f5818ee599e004db995_amadey_darkgate_elex_smoke-loader_stop.exe
3812	2026-07-06_c950b8ec28ea5f5818ee599e004db995_amadey_darkgate_elex_smoke-loader_stop.exe
3812	2026-07-06_c950b8ec28ea5f5818ee599e004db995_amadey_darkgate_elex_smoke-loader_stop.exe
3812	2026-07-06_c950b8ec28ea5f5818ee599e004db995_amadey_darkgate_elex_smoke-loader_stop.exe
3812	2026-07-06_c950b8ec28ea5f5818ee599e004db995_amadey_darkgate_elex_smoke-loader_stop.exe
3812	2026-07-06_c950b8ec28ea5f5818ee599e004db995_amadey_darkgate_elex_smoke-loader_stop.exe
3812	2026-07-06_c950b8ec28ea5f5818ee599e004db995_amadey_darkgate_elex_smoke-loader_stop.exe
3812	2026-07-06_c950b8ec28ea5f5818ee599e004db995_amadey_darkgate_elex_smoke-loader_stop.exe
3812	2026-07-06_c950b8ec28ea5f5818ee599e004db995_amadey_darkgate_elex_smoke-loader_stop.exe
3812	2026-07-06_c950b8ec28ea5f5818ee599e004db995_amadey_darkgate_elex_smoke-loader_stop.exe
3812	2026-07-06_c950b8ec28ea5f5818ee599e004db995_amadey_darkgate_elex_smoke-loader_stop.exe
3812	2026-07-06_c950b8ec28ea5f5818ee599e004db995_amadey_darkgate_elex_smoke-loader_stop.exe
3812	2026-07-06_c950b8ec28ea5f5818ee599e004db995_amadey_darkgate_elex_smoke-loader_stop.exe
3812	2026-07-06_c950b8ec28ea5f5818ee599e004db995_amadey_darkgate_elex_smoke-loader_stop.exe
3812	2026-07-06_c950b8ec28ea5f5818ee599e004db995_amadey_darkgate_elex_smoke-loader_stop.exe
3812	2026-07-06_c950b8ec28ea5f5818ee599e004db995_amadey_darkgate_elex_smoke-loader_stop.exe
3812	2026-07-06_c950b8ec28ea5f5818ee599e004db995_amadey_darkgate_elex_smoke-loader_stop.exe
4580	jhbzurmkecwuomhe.exe
4580	jhbzurmkecwuomhe.exe
3812	2026-07-06_c950b8ec28ea5f5818ee599e004db995_amadey_darkgate_elex_smoke-loader_stop.exe
3812	2026-07-06_c950b8ec28ea5f5818ee599e004db995_amadey_darkgate_elex_smoke-loader_stop.exe
4580	jhbzurmkecwuomhe.exe
4580	jhbzurmkecwuomhe.exe
3812	2026-07-06_c950b8ec28ea5f5818ee599e004db995_amadey_darkgate_elex_smoke-loader_stop.exe
3812	2026-07-06_c950b8ec28ea5f5818ee599e004db995_amadey_darkgate_elex_smoke-loader_stop.exe
4580	jhbzurmkecwuomhe.exe
4580	jhbzurmkecwuomhe.exe
4580	jhbzurmkecwuomhe.exe
4580	jhbzurmkecwuomhe.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	3688	i_khbzurmhez.exe
Token: SeDebugPrivilege	3200	i_uojezwromg.exe
Token: SeDebugPrivilege	3268	i_ljdbztolgd.exe
Token: SeDebugPrivilege	1376	i_dywqoigbyt.exe
Token: SeDebugPrivilege	2000	i_nifaysqkig.exe
Token: SeDebugPrivilege	2468	i_ysnlfdxvpn.exe
Token: SeDebugPrivilege	1508	i_spnhfcxusq.exe
Token: SeDebugPrivilege	1688	i_urpkhfzxrp.exe
Token: SeDebugPrivilege	2732	i_uomkecztrp.exe
Token: SeDebugPrivilege	2020	i_xrojgezwrp.exe
Token: SeDebugPrivilege	4404	i_trljebwtol.exe
Token: SeDebugPrivilege	2708	i_ytqoigaywq.exe
Token: SeDebugPrivilege	2620	i_vqnlidavtq.exe
Token: SeDebugPrivilege	6112	i_ysqnicaysq.exe
Token: SeDebugPrivilege	4332	i_axspkicaus.exe
Token: SeDebugPrivilege	2936	i_rpnhfcaurp.exe
Token: SeDebugPrivilege	6028	i_upmhezxupm.exe
Token: SeDebugPrivilege	1572	i_ezwuomkecz.exe
Token: SeDebugPrivilege	5440	i_jhbzwrpjhb.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1544	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3812 wrote to memory of 4580	3812	2026-07-06_c950b8ec28ea5f5818ee599e004db995_amadey_darkgate_elex_smoke-loader_stop.exe	87
PID 3812 wrote to memory of 4160	3812	2026-07-06_c950b8ec28ea5f5818ee599e004db995_amadey_darkgate_elex_smoke-loader_stop.exe	88
PID 4160 wrote to memory of 1544	4160	iexplore.exe	89
PID 1544 wrote to memory of 1080	1544	msedge.exe	90
PID 1544 wrote to memory of 1132	1544	msedge.exe	91
PID 1544 wrote to memory of 3832	1544	msedge.exe	92
PID 1544 wrote to memory of 1132	1544	msedge.exe	91
PID 1544 wrote to memory of 1132	1544	msedge.exe	91
PID 1544 wrote to memory of 1540	1544	msedge.exe	93
PID 1544 wrote to memory of 1540	1544	msedge.exe	93
PID 1544 wrote to memory of 2140	1544	msedge.exe	95
PID 1544 wrote to memory of 1988	1544	msedge.exe	94
PID 1544 wrote to memory of 2140	1544	msedge.exe	95
PID 1544 wrote to memory of 2140	1544	msedge.exe	95
PID 1544 wrote to memory of 1988	1544	msedge.exe	94
PID 1544 wrote to memory of 1988	1544	msedge.exe	94
PID 1544 wrote to memory of 2068	1544	msedge.exe	97
PID 1544 wrote to memory of 2068	1544	msedge.exe	97
PID 1544 wrote to memory of 2068	1544	msedge.exe	97
PID 1544 wrote to memory of 4936	1544	msedge.exe	98
PID 1544 wrote to memory of 4936	1544	msedge.exe	98
PID 1544 wrote to memory of 4936	1544	msedge.exe	98
PID 1544 wrote to memory of 5864	1544	msedge.exe	99
PID 1544 wrote to memory of 5864	1544	msedge.exe	99
PID 1544 wrote to memory of 780	1544	msedge.exe	103
PID 1544 wrote to memory of 4548	1544	msedge.exe	104
PID 1544 wrote to memory of 780	1544	msedge.exe	103
PID 1544 wrote to memory of 4548	1544	msedge.exe	104
PID 4580 wrote to memory of 3444	4580	jhbzurmkecwuomhe.exe	105
PID 2704 wrote to memory of 4472	2704	khbzurmhez.exe	109
PID 1544 wrote to memory of 2848	1544	msedge.exe	110
PID 1544 wrote to memory of 5220	1544	msedge.exe	115
PID 1544 wrote to memory of 5220	1544	msedge.exe	115
PID 1544 wrote to memory of 5828	1544	msedge.exe	116
PID 1544 wrote to memory of 5828	1544	msedge.exe	116
PID 4580 wrote to memory of 2016	4580	jhbzurmkecwuomhe.exe	117
PID 1544 wrote to memory of 5984	1544	msedge.exe	121
PID 1544 wrote to memory of 5984	1544	msedge.exe	121
PID 1544 wrote to memory of 5984	1544	msedge.exe	121
PID 1544 wrote to memory of 5728	1544	msedge.exe	122
PID 1544 wrote to memory of 5728	1544	msedge.exe	122
PID 1544 wrote to memory of 5728	1544	msedge.exe	122
PID 4580 wrote to memory of 4328	4580	jhbzurmkecwuomhe.exe	123
PID 2656 wrote to memory of 1056	2656	uojezwromg.exe	125
PID 4580 wrote to memory of 3520	4580	jhbzurmkecwuomhe.exe	128
PID 4580 wrote to memory of 4092	4580	jhbzurmkecwuomhe.exe	132
PID 4388 wrote to memory of 4392	4388	ljdbztolgd.exe	134
PID 4580 wrote to memory of 3412	4580	jhbzurmkecwuomhe.exe	137
PID 4580 wrote to memory of 1112	4580	jhbzurmkecwuomhe.exe	141
PID 2932 wrote to memory of 3056	2932	dywqoigbyt.exe	143
PID 4580 wrote to memory of 3456	4580	jhbzurmkecwuomhe.exe	146
PID 1544 wrote to memory of 2712	1544	msedge.exe	148
PID 1544 wrote to memory of 2828	1544	msedge.exe	149
PID 1544 wrote to memory of 1832	1544	msedge.exe	150
PID 4580 wrote to memory of 3744	4580	jhbzurmkecwuomhe.exe	153
PID 1512 wrote to memory of 5964	1512	nifaysqkig.exe	155
PID 4580 wrote to memory of 5868	4580	jhbzurmkecwuomhe.exe	158
PID 4580 wrote to memory of 4936	4580	jhbzurmkecwuomhe.exe	162
PID 3200 wrote to memory of 4584	3200	ysnlfdxvpn.exe	164
PID 4580 wrote to memory of 4664	4580	jhbzurmkecwuomhe.exe	167
PID 4580 wrote to memory of 4848	4580	jhbzurmkecwuomhe.exe	171
PID 2500 wrote to memory of 1268	2500	spnhfcxusq.exe	173
PID 4580 wrote to memory of 1064	4580	jhbzurmkecwuomhe.exe	176
PID 4580 wrote to memory of 4536	4580	jhbzurmkecwuomhe.exe	180

C:\Users\Admin\AppData\Local\Temp\2026-07-06_c950b8ec28ea5f5818ee599e004db995_amadey_darkgate_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_c950b8ec28ea5f5818ee599e004db995_amadey_darkgate_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3812
- C:\Temp\jhbzurmkecwuomhe.exe
  C:\Temp\jhbzurmkecwuomhe.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4580
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\khbzurmhez.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3444
  - - C:\Temp\khbzurmhez.exe
      C:\Temp\khbzurmhez.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2704
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4472
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2532
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_khbzurmhez.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2016
  - - C:\Temp\i_khbzurmhez.exe
      C:\Temp\i_khbzurmhez.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3688
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\uojezwromg.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4328
  - - C:\Temp\uojezwromg.exe
      C:\Temp\uojezwromg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2656
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1056
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3060
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_uojezwromg.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3520
  - - C:\Temp\i_uojezwromg.exe
      C:\Temp\i_uojezwromg.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3200
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljdbztolgd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4092
  - - C:\Temp\ljdbztolgd.exe
      C:\Temp\ljdbztolgd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4388
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4392
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4448
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljdbztolgd.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3412
  - - C:\Temp\i_ljdbztolgd.exe
      C:\Temp\i_ljdbztolgd.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3268
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dywqoigbyt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1112
  - - C:\Temp\dywqoigbyt.exe
      C:\Temp\dywqoigbyt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2932
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3056
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2948
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dywqoigbyt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3456
  - - C:\Temp\i_dywqoigbyt.exe
      C:\Temp\i_dywqoigbyt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1376
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nifaysqkig.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3744
  - - C:\Temp\nifaysqkig.exe
      C:\Temp\nifaysqkig.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1512
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5964
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2744
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nifaysqkig.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5868
  - - C:\Temp\i_nifaysqkig.exe
      C:\Temp\i_nifaysqkig.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2000
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ysnlfdxvpn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4936
  - - C:\Temp\ysnlfdxvpn.exe
      C:\Temp\ysnlfdxvpn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3200
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4584
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4512
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ysnlfdxvpn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4664
  - - C:\Temp\i_ysnlfdxvpn.exe
      C:\Temp\i_ysnlfdxvpn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2468
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\spnhfcxusq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4848
  - - C:\Temp\spnhfcxusq.exe
      C:\Temp\spnhfcxusq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2500
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1268
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2620
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_spnhfcxusq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1064
  - - C:\Temp\i_spnhfcxusq.exe
      C:\Temp\i_spnhfcxusq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1508
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\urpkhfzxrp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4536
  - - C:\Temp\urpkhfzxrp.exe
      C:\Temp\urpkhfzxrp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:6136
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2284
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5816
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_urpkhfzxrp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4156
  - - C:\Temp\i_urpkhfzxrp.exe
      C:\Temp\i_urpkhfzxrp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1688
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\uomkecztrp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2728
  - - C:\Temp\uomkecztrp.exe
      C:\Temp\uomkecztrp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1100
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1108
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4308
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_uomkecztrp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5560
  - - C:\Temp\i_uomkecztrp.exe
      C:\Temp\i_uomkecztrp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2732
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xrojgezwrp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:200
  - - C:\Temp\xrojgezwrp.exe
      C:\Temp\xrojgezwrp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2556
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4984
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4628
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xrojgezwrp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:940
  - - C:\Temp\i_xrojgezwrp.exe
      C:\Temp\i_xrojgezwrp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2020
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\trljebwtol.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2892
  - - C:\Temp\trljebwtol.exe
      C:\Temp\trljebwtol.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5476
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3732
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5816
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_trljebwtol.exe ups_ins
    3⤵
    PID:4256
  - - C:\Temp\i_trljebwtol.exe
      C:\Temp\i_trljebwtol.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4404
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ytqoigaywq.exe ups_run
    3⤵
    PID:5328
  - - C:\Temp\ytqoigaywq.exe
      C:\Temp\ytqoigaywq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6096
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5148
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3628
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ytqoigaywq.exe ups_ins
    3⤵
    PID:1684
  - - C:\Temp\i_ytqoigaywq.exe
      C:\Temp\i_ytqoigaywq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2708
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vqnlidavtq.exe ups_run
    3⤵
    PID:2532
  - - C:\Temp\vqnlidavtq.exe
      C:\Temp\vqnlidavtq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3032
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3424
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1668
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vqnlidavtq.exe ups_ins
    3⤵
    PID:4780
  - - C:\Temp\i_vqnlidavtq.exe
      C:\Temp\i_vqnlidavtq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2620
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ysqnicaysq.exe ups_run
    3⤵
    PID:4528
  - - C:\Temp\ysqnicaysq.exe
      C:\Temp\ysqnicaysq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4312
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5816
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4704
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ysqnicaysq.exe ups_ins
    3⤵
    PID:3140
  - - C:\Temp\i_ysqnicaysq.exe
      C:\Temp\i_ysqnicaysq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6112
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\axspkicaus.exe ups_run
    3⤵
    PID:4508
  - - C:\Temp\axspkicaus.exe
      C:\Temp\axspkicaus.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4872
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1412
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4308
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_axspkicaus.exe ups_ins
    3⤵
    PID:6032
  - - C:\Temp\i_axspkicaus.exe
      C:\Temp\i_axspkicaus.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4332
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rpnhfcaurp.exe ups_run
    3⤵
    PID:3148
  - - C:\Temp\rpnhfcaurp.exe
      C:\Temp\rpnhfcaurp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2792
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4532
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5012
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rpnhfcaurp.exe ups_ins
    3⤵
    PID:4804
  - - C:\Temp\i_rpnhfcaurp.exe
      C:\Temp\i_rpnhfcaurp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2936
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\upmhezxupm.exe ups_run
    3⤵
    PID:2308
  - - C:\Temp\upmhezxupm.exe
      C:\Temp\upmhezxupm.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4556
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5108
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5944
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_upmhezxupm.exe ups_ins
    3⤵
    PID:5836
  - - C:\Temp\i_upmhezxupm.exe
      C:\Temp\i_upmhezxupm.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6028
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ezwuomkecz.exe ups_run
    3⤵
    PID:4808
  - - C:\Temp\ezwuomkecz.exe
      C:\Temp\ezwuomkecz.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5820
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2784
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1320
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ezwuomkecz.exe ups_ins
    3⤵
    PID:1664
  - - C:\Temp\i_ezwuomkecz.exe
      C:\Temp\i_ezwuomkecz.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1572
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jhbzwrpjhb.exe ups_run
    3⤵
    PID:3320
  - - C:\Temp\jhbzwrpjhb.exe
      C:\Temp\jhbzwrpjhb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2228
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3736
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4080
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jhbzwrpjhb.exe ups_ins
    3⤵
    PID:4776
  - - C:\Temp\i_jhbzwrpjhb.exe
      C:\Temp\i_jhbzwrpjhb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5440
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffa837bc188,0x7ffa837bc194,0x7ffa837bc1a0
      4⤵
      PID:1080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,10577147941235788080,5690695213895526292,262144 --field-trial-handle=2320,i,8459316336753054547,5381955218907970064,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:2
      4⤵
      PID:1132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,12553372414875032216,9737257782920934426,524288 --field-trial-handle=2320,i,8459316336753054547,5381955218907970064,262144 --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:11
      4⤵
      System Time Discovery
      PID:3832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=316,i,14112176523377199261,11635621501499612986,524288 --field-trial-handle=2320,i,8459316336753054547,5381955218907970064,262144 --variations-seed-version --mojo-platform-channel-handle=3164 /prefetch:13
      4⤵
      PID:1540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3568,i,16928037050375506517,7912817067971861744,2097152 --field-trial-handle=2320,i,8459316336753054547,5381955218907970064,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
      4⤵
      PID:1988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3576,i,2512168665382585317,9958921497076186278,2097152 --field-trial-handle=2320,i,8459316336753054547,5381955218907970064,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
      4⤵
      PID:2140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,1436021264510778900,7683012532152373058,2097152 --field-trial-handle=2320,i,8459316336753054547,5381955218907970064,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:1
      4⤵
      PID:2068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,10800280541363959550,5133220757613910389,2097152 --field-trial-handle=2320,i,8459316336753054547,5381955218907970064,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:9
      4⤵
      PID:4936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,7756162305148471610,4869946619984740635,524288 --field-trial-handle=2320,i,8459316336753054547,5381955218907970064,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:14
      4⤵
      PID:5864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3652,i,3501592396708548825,12036110918644744927,524288 --field-trial-handle=2320,i,8459316336753054547,5381955218907970064,262144 --variations-seed-version --mojo-platform-channel-handle=3820 /prefetch:14
      4⤵
      PID:780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3796,i,17088199805813921200,1686210429705919162,524288 --field-trial-handle=2320,i,8459316336753054547,5381955218907970064,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:14
      4⤵
      PID:4548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,10444043979527978880,5836401723098461749,524288 --field-trial-handle=2320,i,8459316336753054547,5381955218907970064,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:14
      4⤵
      PID:4336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,10444043979527978880,5836401723098461749,524288 --field-trial-handle=2320,i,8459316336753054547,5381955218907970064,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:14
      4⤵
      PID:2848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,10945602560863059919,2793869498836518026,524288 --field-trial-handle=2320,i,8459316336753054547,5381955218907970064,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
      4⤵
      PID:5220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6660,i,6055737785346917915,7788882512629176959,524288 --field-trial-handle=2320,i,8459316336753054547,5381955218907970064,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:14
      4⤵
      PID:5828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6624,i,9268678379887074176,14972535584272991853,2097152 --field-trial-handle=2320,i,8459316336753054547,5381955218907970064,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:1
      4⤵
      PID:5984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3776,i,10812964927703339877,11185281313968681949,2097152 --field-trial-handle=2320,i,8459316336753054547,5381955218907970064,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
      4⤵
      PID:5728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,3917433662225078275,7940818788724731032,524288 --field-trial-handle=2320,i,8459316336753054547,5381955218907970064,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:14
      4⤵
      PID:2712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,8637059620068243197,11207039893389270433,524288 --field-trial-handle=2320,i,8459316336753054547,5381955218907970064,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:14
      4⤵
      PID:2828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,3708446531422867896,14864641429310630719,524288 --field-trial-handle=2320,i,8459316336753054547,5381955218907970064,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:14
      4⤵
      PID:1832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,6142687550573628439,5962643303939966616,524288 --field-trial-handle=2320,i,8459316336753054547,5381955218907970064,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:14
      4⤵
      PID:3524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,14939996432940425541,2398064323086903971,524288 --field-trial-handle=2320,i,8459316336753054547,5381955218907970064,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:14
      4⤵
      PID:1872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,15752237415761332716,6613511424142721925,524288 --field-trial-handle=2320,i,8459316336753054547,5381955218907970064,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:14
      4⤵
      PID:52
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,9678517727023912957,3627222177100628179,524288 --field-trial-handle=2320,i,8459316336753054547,5381955218907970064,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:14
      4⤵
      PID:2952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4780,i,12434312634016061570,14294290669677531290,262144 --field-trial-handle=2320,i,8459316336753054547,5381955218907970064,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:10
      4⤵
      PID:4920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,3701967407983458400,4526038536477803995,524288 --field-trial-handle=2320,i,8459316336753054547,5381955218907970064,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
      4⤵
      PID:4264

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5940

C:\Temp\jhbzurmkecwuomhe.sys
C:\Temp\jhbzurmkecwuomhe.sys
1⤵
- Executes dropped EXE
PID:2652

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3756

C:\Temp\cztrljecwu.sys
C:\Temp\cztrljecwu.sys
1⤵
- Executes dropped EXE
PID:5616

C:\Temp\olgebztroi.sys
C:\Temp\olgebztroi.sys
1⤵
- Executes dropped EXE
PID:1172

C:\Temp\dyvqolgdyw.sys
C:\Temp\dyvqolgdyw.sys
1⤵
- Executes dropped EXE
PID:5000

C:\Temp\yvtnlfdayt.sys
C:\Temp\yvtnlfdayt.sys
1⤵
- Executes dropped EXE
PID:4596

C:\Temp\ysqnigaysq.sys
C:\Temp\ysqnigaysq.sys
1⤵
- Executes dropped EXE
PID:3464

C:\Temp\nkifzxvsqk.sys
C:\Temp\nkifzxvsqk.sys
1⤵
- Executes dropped EXE
PID:5012

C:\Temp\upmkhcausm.sys
C:\Temp\upmkhcausm.sys
1⤵
- Executes dropped EXE
PID:3596

C:\Temp\ezxrpjhczu.sys
C:\Temp\ezxrpjhczu.sys
1⤵
- Executes dropped EXE
PID:2228

C:\Temp\zurpjhezwu.sys
C:\Temp\zurpjhezwu.sys
1⤵
- Executes dropped EXE
PID:5844

C:\Temp\ztrljebwuo.sys
C:\Temp\ztrljebwuo.sys
1⤵
- Executes dropped EXE
PID:3896

C:\Temp\ywtolgeywq.sys
C:\Temp\ywtolgeywq.sys
1⤵
PID:5824

C:\Temp\igbvtnlgdy.sys
C:\Temp\igbvtnlgdy.sys
1⤵
PID:5400

C:\Temp\ysqnigdyvt.sys
C:\Temp\ysqnigdyvt.sys
1⤵
PID:1908

C:\Temp\aysqkhfaxs.sys
C:\Temp\aysqkhfaxs.sys
1⤵
PID:5824

C:\Temp\rpkhfcxvsm.sys
C:\Temp\rpkhfcxvsm.sys
1⤵
PID:2280

C:\Temp\hfzxupnhfz.sys
C:\Temp\hfzxupnhfz.sys
1⤵
PID:3552

C:\Temp\czurmkeczu.sys
C:\Temp\czurmkeczu.sys
1⤵
PID:5792

C:\Temp\gebwtrpjge.sys
C:\Temp\gebwtrpjge.sys
1⤵
PID:356

C:\Temp\ljgbztrljg.sys
C:\Temp\ljgbztrljg.sys
1⤵
PID:5900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cztrljecwu.sys

Path C:\Temp\cztrljecwu.sys
Size 293KB
SHA256 1a34990cbeadf0b3a8832f2029d8328d542799a8dffedd830e9555da7233e506
MD5 eb0f4b08ff66e960eeeaeee8c06e99b5
SHA1 d79b8b4cbaa6355dbac7cc394691fc56e7e062d3
SHA512 bd997a19c114fb65f59ffe9ad964b3e44b9479af854570735de7d354dc6f7539bfcda1475e4974bc11bd8d9886ad0396653b6ca671c100cf6c17d749a7041706
SSDEEP 3072:ntKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:nIJjiJcbI03GBc3ucY5DCSj
TLSH
T126545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dyvqolgdyw.sys

Path C:\Temp\dyvqolgdyw.sys
Size 293KB
SHA256 545bcee4c8f1e69021bbe491596f025cf526b9fc9f40cfa55a3c0dbc8df33ccd
MD5 284288a2827fdb7f1bc0940d4923856b
SHA1 e18965651d652e51766f191d9da736b8b77ee0b9
SHA512 cc21094a42fa937a20dc020b455b28b706a9fbcdc10b83ee9485f2e87ad19e6743ec804ad30b7d34137811f08dc8f5d2b9ca6335e0b1f6bd83ddf4788213cdb5
SSDEEP 3072:6tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:6IJjiJcbI03GBc3ucY5DCSj
TLSH
T18A545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dywqoigbyt.exe

Path C:\Temp\dywqoigbyt.exe
Size 384KB
SHA256 0a24ba513ca124b3983d6064d37e02a132faf992e8199903a58ae93f807df6e2
MD5 97a2dadb3ec35c11db53a3871983f4ac
SHA1 74ac920c8cf5bda118822e4c7e55aa51bb0c8f46
SHA512 90df789daa427879028d5b936be8505e782158eb561ede9ea79f6a44c349676ca245fb6e2c961d579fee09942b8e71f4c19a895fbc9f8e8d8f453fdb7d718a1f
SSDEEP 3072:TbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:Tbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T14A847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F354CE5D9A517C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dywqoigbyt.exe

Path C:\Temp\i_dywqoigbyt.exe
Size 384KB
SHA256 b7ccf220f4fca99a105869ae50386989c802899c6ee354e1f2fe09ccf28196ea
MD5 540ac3cd559d9d228374317e2e0a55aa
SHA1 adba24edbbbdeddb9d499c141b0e4eece637a340
SHA512 b78ff1e328700706086bffaf041278b894f9138bf96b803091383664ed1ac3f55f55e6e5f88126d41e164ef4c23f8a4e5ed297e3e7fcff2a9ed4612ab80ddd46
SSDEEP 3072:RbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:Rbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T197847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_khbzurmhez.exe

Path C:\Temp\i_khbzurmhez.exe
Size 384KB
SHA256 e8aa5efbbddf1154d5eb3d17c6ce06710da4bf6f6901871f5963b5745dda915f
MD5 e30d434ab1b2dc2fe0b8911147c91481
SHA1 fc0bc46ee87ff7bc14eae47101666ce175fcf31f
SHA512 2520a678cd20cd9439e73c6163c9b383c8911b3e27aef774d6926c8a342654b01d9f0231f9b2d12795d5c43918744366138c337edf759430525a00c9364a4dac
SSDEEP 3072:IbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:Ibtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T13F847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ljdbztolgd.exe

Path C:\Temp\i_ljdbztolgd.exe
Size 384KB
SHA256 6d1f4a3ed23cee155f08a8e2358e723bd4f129a63d8f5a71aa6c1a45957acbfc
MD5 2401cf9d9f65e8ac3c6bf18089cf5c78
SHA1 7cb1653d56b570a57f3c2717a0902e0e2f500e14
SHA512 3ed9b05a842b39ba125fe73556352c0e3d5ea6ce0da660b508e5f68e6c6d5df740e9ffb5a135edc9bcade6be422c5d85c3deb703ae304654f7c89e864e732504
SSDEEP 3072:FbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:Fbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T17A847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nifaysqkig.exe

Path C:\Temp\i_nifaysqkig.exe
Size 384KB
SHA256 9528df55485b78fd1a401e2634e35013deb724dfb96c88b018e06cd343c9a881
MD5 c46c7149ee8ccb70405af4c7e53621ae
SHA1 c0f7e76645c9059b3afcab01be311cf538337938
SHA512 33526a9b6e70825c81d18aeefc48c0d380503f53baadcb277efd9d074db484867fd4f19f8d1129d123c64cb84391cc370f36a01ed9f648d9ce2e7b93d3fea0a1
SSDEEP 3072:rbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:rbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T165847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC3F354CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_uojezwromg.exe

Path C:\Temp\i_uojezwromg.exe
Size 384KB
SHA256 2c830dfbde15beee5ec9954bb61cb0fe5fb9286ef856e79733f6ad39d62aa98d
MD5 1f3bda00c5c842cb12f1ebfbee0f6529
SHA1 1e43ada3dd25d71a7e3ce24dbb7c73bcbf82436d
SHA512 8fbb532c3a1a0de573f18c607fa58565f625c13f96ae3af10a14c40c2e1348ed08db95c432abdbafcbf25a34c718883c3294ed9ca905451e0fddca38b3f57727
SSDEEP 3072:cbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:cbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T169847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhbzurmkecwuomhe.exe

Path C:\Temp\jhbzurmkecwuomhe.exe
Size 384KB
SHA256 29148bf7fab1ec79796e250fe6f8664e93a00b8c11207f608cd911b9dc5274e6
MD5 f353ee68b28ffe59f9392e43bb670403
SHA1 c61b5b1b61110622d5819256f2e5cd5d96687a85
SHA512 c713f2d60723e7776222bebe68376a4bd914852f00416ad3f64abd23515b9a98ee55b52a2b15c1880a958facda9a9f00807becb680ce5dd6be845d83f9a0fe76
SSDEEP 3072:RbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:Rbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1DE847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC3F754CE5D9A517C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhbzurmkecwuomhe.sys

Path C:\Temp\jhbzurmkecwuomhe.sys
Size 293KB
SHA256 1357b31b487e90376a8c116e360db5bca1c1b6dcfdf4c52d4c7e2e57e92d0ce7
MD5 06a6653c4ce684000fe9a80f622afba3
SHA1 5f7eb1499d338508e89eb855bc73998a0d0ce333
SHA512 f61584df55ed5aea9e7954936e3b6e94cc59d093517f08d73ea1f449f01f877a54ca1da110fdcc1e903994296466e5d6b14635a457547a95b54224f798e50233
SSDEEP 3072:mtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:mIJjiJcbI03GBc3ucY5DCSj
TLSH
T1B0545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

khbzurmhez.exe

Path C:\Temp\khbzurmhez.exe
Size 384KB
SHA256 a1ea31753f9524aadc25392a35de088de5686d0878a3b71d5f1a96e147dab837
MD5 f1ed29bb01abe972b31ec98a4b7776da
SHA1 d93cd4c5ffae6aa107744e8e9bafe4db2ae92bb9
SHA512 832813394260e30b3474af4015dcce97b95d9af0296d6840c61d27c4173e5b9e6022b409f98688b7d3a5401cb4cbe5f6eb587a9a784a01d4aa37fe58a7abb894
SSDEEP 3072:6btF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:6btt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T10F847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC3F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljdbztolgd.exe

Path C:\Temp\ljdbztolgd.exe
Size 384KB
SHA256 e1cf343a0af6f77384b4b1cf9777062098ca2ca16394deafa684d3a03b8d9512
MD5 9daf23320bfdd4f603331efca03128b9
SHA1 f76cfa83800260fbd05c81d248c1752e001ca4e8
SHA512 46496443ca68767dfdf18ae3125942a98a8f6c8d359815e205689cb3c23191c001e05b5964daf82179f350d58908f79657efeb349d08a003b3000b77e4f5fc04
SSDEEP 3072:nbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:nbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T163847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nifaysqkig.exe

Path C:\Temp\nifaysqkig.exe
Size 384KB
SHA256 97ef565e3b8a975eacd23e8eab1c30cc51a6f6d4100827d24bbb7466f33208e4
MD5 112b31246f229778e512c5f84e8acc83
SHA1 971223669d63a10c2cddfdda44e31c6057c4ba88
SHA512 1f41c7ce16de79e6234fa0b857c0820ccbd4b0585821d55ed88db9403dd77f0a0546c5422a54da4e1e271283283170940aea9250314d0674340f93df63aa2015
SSDEEP 3072:kbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:kbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T159847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC3F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

olgebztroi.sys

Path C:\Temp\olgebztroi.sys
Size 293KB
SHA256 23113290abab1faab33706887a88b01ccc3a1e111e3893bee141536eaec7a73b
MD5 a2c074ce49795f1a338804171c0c9334
SHA1 34e87d4d95537bdecd09ac2f9e4746c92a9b62c5
SHA512 cefd0a9867a8a8039aa600b2deabd17baa1e65431298881d59e3c3afb7e8b3d3eca135572df10cc085aff0e53190da9cbe6fb2c3cfce715d79e9da26c0db9341
SSDEEP 3072:2tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:2IJjiJcbI03GBc3ucY5DCSj
TLSH
T1B7545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uojezwromg.exe

Path C:\Temp\uojezwromg.exe
Size 384KB
SHA256 28ca890f7a2f3296406aefaf010f86e74f8adaf273c90c4dfa3415fb783a63a7
MD5 d141d3f8971ee86ef557d29d8980569b
SHA1 7bd8216b229e691646a64d084d761c3fe2278a9b
SHA512 57d1812f31e8b61ce6e9d69c39fd113336c445890fb889f527b1bf60337f674aa0d665f6563e6a990568269667f47ffcd714949a467c9fb516de10b5ec6de6fd
SSDEEP 3072:ZbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:Zbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T122847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ysnlfdxvpn.exe

Path C:\Temp\ysnlfdxvpn.exe
Size 384KB
SHA256 88c552a382636594c576838fb17e9ac7b0db3db17ed13c1045d42f6e54737299
MD5 974ef6cdddcf9aba0b45dcae422a0021
SHA1 9abc043cf8e0835cbddff11af1aa8d81c572ea63
SHA512 725899d82fe2ca7bd8468717e1e14e782ba51621b2bbcdf8e46d09e16677bb252751234f9e6379b545a6bdce2972a3515c4f402bb99d49101a4cea614dcec47e
SSDEEP 3072:SbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:Sbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T12D847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC3F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ysqnigaysq.sys

Path C:\Temp\ysqnigaysq.sys
Size 293KB
SHA256 9b7003a75b48ab6a825ed0f336c0474393c7fc91010c1caa0282c512ad7800b9
MD5 bac1bf3eedd7407f2cb6e7a0f49623cd
SHA1 e7a213bd734d77b131076c710585f1e8cd16b114
SHA512 957070a695b669d01a17dc55cece5de93275c620f7e8ff51743feb467d83d38c692137612622181416129ede9dc6077b671fc58386e6c891d27e3904c9873d69
SSDEEP 3072:RtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:RIJjiJcbI03GBc3ucY5DCSj
TLSH
T105545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yvtnlfdayt.sys

Path C:\Temp\yvtnlfdayt.sys
Size 293KB
SHA256 dd2db8b6e2befe563d12f513b1cc137b60b2500d2e5ddf28d40fecd4be1a14e1
MD5 f8d73e8612784c98fb273ad999046a89
SHA1 7dd446b91f43da24191cd9e2ec7d58c316c4e15e
SHA512 dfeb8bafe46143f69b756c15702812f740f1f1e86bf462310c990374f093957555d436526477b465ef59eed0401d6126d2ac2e2381508a3468850bb4e29d131d
SSDEEP 3072:BtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:BIJjiJcbI03GBc3ucY5DCSj
TLSH
T19B545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3f51b0e24e52d8511f72e348c132f84b6b8edb54027a5c8c4fbe2a976322a690
MD5 e32f775acc5ed08adf9d5f6678c2bc4d
SHA1 bd5f4d60c6c8f97a1fed276a8c02ca345e30bb2a
SHA512 2b2fef021516ee5e90b192840780767fff5c147cfb2dfe5b900a8b298d542111707f16c28e265447d090c61e8e091b3529eb29ff376abe03cd34315206805eba
TLSH
T1DAD09B996686AD54DD80343534A1E34B9A18F522102C46488117B064CCA464246561FF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a54d1be6da491be16ecc22dac3ad8cfbe4eabb017451e32c26f2904977fde58e
MD5 9daa45ac0383b3b978ad8da2d5000b62
SHA1 f52083ce5d095366a6fa9406b8b49000fcb53bc0
SHA512 ac55ccfd63460f712cd2ffb1ff656349475683b1ec07abd198254ac469a634f7129cf280de184340d8314fe2b8f7e955f7a112deb1511d52de882ae801a7c1af
TLSH
T17DD09B9D6686AE54DD80343134A1E34B9A18F522642C464880177054CCA464246571FF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 eb9c78bec38d833edc2a955a2e96586e9cd1a192c9d0acf52954aa19946168b1
MD5 cbaa7aa9768d444d28f2b961baf2347a
SHA1 ade21e9a034f2449dbefd31657178f585f3b8cda
SHA512 00eab538fa85779b3344940c09511b459e5a8442e9784082dc92f97f51c9be8585a8ca6be6b7842ac5b01cd7fb71ee75f97bbfb8c7840aa3dce3a0a66f23e94f
TLSH
T1A041B7580366C9C2C76EF2B351E1069F3F709EDA82C7EE1510E0B5B4BC3BB14A022022
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 5eb7e723e967b0d41f9393bcf3820d84db2e26250c7bb51592d15926dccc49f8
MD5 57d779ee09a2fbb3448001575b08ad66
SHA1 aed6b6dfc583c298a6dd3567f5c5192d49c468a9
SHA512 57f9ce01976e541b3d7c3ffc2aac1bcf9f6d07b7f049874695f75ebc5adb4e1a9f86c2ade2148b0c1acbfb2762de4d51b14ae1209cbc03e97e9c815d3fd1b84d
TLSH
T1F641ADF383E4866DC91196F0AB186E1BCE1D0A15832C3D5AC9E4EE1BA3E3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 75fba91955278a4a210c4323bce4fe794c42dc0b1a37b53594dcc61a5ff81ab9
MD5 3284ec6b987ca50f8028fbfbd817210a
SHA1 759bcd0fadac04b74108af7b2654683c9d5693c2
SHA512 40106b9c93de01763c32cd0c649ea521e1d8d3755e95270ff046c56e28a217036dce11a51b25ebc63e02e1e3ea721006e7a9433b5dd5a2163d01889a440a1441
SSDEEP 192:sxRZeRZC2/frs/iSeZ/c/8xlzoA8p9R/g6+WNIYDQKG7IgtJ:sxRZee2/frs/vY/o8xIz/5Ir3
TLSH
T11D3296166E28993B8CCBD21DBA15BF53D2F91432A1955F48BAFCCB0C05EB6DD520780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 74ecb675d1d3b6d3f3d1a6b63349734175f3e990481b6f8f76888fd9aeb49a1a
MD5 dba1f46b6502f5f0459b3c381a123c46
SHA1 cffcbb972e391b0478b9666bc05622e4422e255d
SHA512 a80711f0370cf4a70a79f38457cc9e13041c68710a0fc03012a9c2a5abe4fc8549cffb6ce8910eefeccc0c3504eab8935068886a64fe96faf2f5425cbac887a7
SSDEEP 192:sxR2eR5yM/jK1Ml8wC2/frsoiSeZ/c/8xlzoA8p9rR/g6+WNCGl/YD8KG7IgDCJ:sxR2e582/frsovY/o8xI1R/5B/7K
TLSH
T1AB62C9066A249977CCDBD209FA55BF53D6F81573A2901E44AAFCCA0C01E76ED6213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 e7acdffab5c64355d73e3d44cced09788b69c6be74d053ff1c1383687fd2c988
MD5 2f65e32e42e5acf4f628dd2404cd5817
SHA1 aae9db4144f6683f24340025772d6348730f7e5f
SHA512 0cb0f8d0bd193c2c8b00c57fb0093c7e064c01edf1667b8e33c783d5273265bda20ed166f507160a10b92849309a23f1a512c0bbe07fae5722ea8b70588abfaf
SSDEEP 192:sxReeRZC2/frsoiSeZ/c/8xlzoA8p9rR/g6+WNCGl/YDsKG7IgDCJ:sxReee2/frsovY/o8xI1R/5B/hK
TLSH
T17D42B7166E28993B8CC7D21DFA15BF53D2F91432A2951F48BAFC8B0C05EB6DD520780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 ed929d6660cba473cb8a550a5eaf0878dfdf6dea20505970305cb76ff418d66f
MD5 31b09d6306cf96c7f4fa7a685f6508e6
SHA1 6d67d080fea3799293d159a9df22ec1ad461b794
SHA512 d86d73b69e0a19f97a289cbb7b4ef3c1b6414ad16a2ab6ae090c65eaaa48a9b62371bf44ff62923abc41117b07fedd66c47ccb33fc9938d14732db101590052c
SSDEEP 768:fLe+ZH7pLuL7CDWgb/f2I8F1+UoAYDCx9Tuqh0VfUC9xbog/OVMVsInsXroZw+:fLe+ZBE7CDWgb/f2Iu1ja7VswsEZw+
TLSH
T1B8D2EB7B640CCA7F4F804ADDAC197E9E6DA802CB9698C94047FA991C03C7BEF51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 d94768f2f8ff23d59680849d0bb404f2f7947736f25a29fc9bab0dc0965b8d99
MD5 6274685e4f037b5ae6576db2bf914935
SHA1 27407e06796b7e524100cf7e90ce8c6a864f1752
SHA512 edcc424e82dd55bee8e6e16e1cc15f5f8617ca9c20cc2773c443ef2be5066a0e456e74b482b222a257bea4165dee2fae9d816dfa96a6c0e8d73da3293c9b643f
SSDEEP 768:f+4+zH7pLuL7eDWgb/fPI8F1+UoAYDCx9Tuqh0VfUC9xbog/OVMVkIn2Xro7XK:f+4+zBE7eDWgb/fPIu1ja7Vkw2E7XK
TLSH
T10FE2EB7B680CCB7E4F404A9DEC29BD9E6DE801CF9698C95447FA890C03C6AEB51174DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 f5b6b6babb5a7881e7f1b94a6068d577d4655ea49a7be46e3be0f1087a269e27
MD5 acc2d5f82f3f4a322a1d4e8880bd2e52
SHA1 6a46d4c31aaeac7d5ee1e357ac495fd46f553578
SHA512 c1d55693372a8e8b995ce22d96df65b2341729ce1d0fa7c495217a6129cd61173ef55c6b87aa9d79e9fa5cb2fc3077868b653ebc98e1ea991a0d282db7af6fa2
SSDEEP 96:KRv4xFzJZlWNiYgtlK4UgDlcLTqN5eHUuUDUSUOUoUwUgU2WUwU1U9gUOU2K4UTV:Cv4xFzJZQNi5tPUgD6LTqN5eHnwVRnlS
TLSH
T124918A4672370280387D244D92A88D6582C2B491342BBC7BB79952F56F27E438FFDDE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a1425.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a1425.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 fcfda0222d85147b36cef7ee1affc28355a7bdf27d2cbb121ce210336885c086
MD5 60fd3a3602bc9da4a8f9009f88ac9f10
SHA1 3c07f5b313d95d9105958042ecb883ebe79f7fd6
SHA512 103792547108e28857334594e5dbe91050673bc1b41ba508e01d1c769558066f756c6a0b821545b50b9c5f010361eb3245c48c22e69a40fb2725452c96bdefdf
SSDEEP 768:+rv+4UNbdx3aSaQwif/x16taHuVboPzkZLNx9OFQb9Mk:+bsbD3apCHOawZLNqOb+k
TLSH
T16313C031B464DD379CBBD298B14A7A87BFF42057C9840B88D9D86F4D096B4AD1B0BD23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 8be000b8cd81f55503499423b9533ee3628065a8595c6de54be4588b07df4e84
MD5 4d5e77ba640accc10d130410743062b4
SHA1 602bb44ba9964540fc37ed0adf8bb17564f7b7bc
SHA512 2b9f5b497e656fa765e3a4699c2110636433ec8b9c21d001cf85e4915169a268bd3d7c2195d24010fc1e1f5d66dd9b3150d6151d453bb18e3dec12658ac76ca8
SSDEEP 768:Krv+4UNbdx3FFaQwif/x16taHuVboPzkZLNx9OFQoL:KbsbD3FWCHOawZLNqOoL
TLSH
T13C03BF717474DD379CBBD298B24A7687BFF4105389840B88D9D86F4D05AB4AE1B0BD23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 3984023d3a0a320d757d2892fdd4b935dfbf98cbc3ff4f24f9100dec84d18fff
MD5 1888d751f19e5e7f6d8184bf19505d7c
SHA1 a0e1a2c351365b23062f5f1015bbd14a5b158ddd
SHA512 3927d1a7a77245417bd6a3ad4ef3696cfc4594d99194b4ad0ad07f7f7870abc16d61bd44498c916e71f4dd42a59c8ff3e126169f560158a13f1a2e45ba41aa17
SSDEEP 768:0rv+4UNbdC3l2a+wif/xSaHuVboPzkZLNx9OZ6Uik4K:0bsbs3lfyHOawZLNqkUVr
TLSH
T11F03BF35A8649C37CDE7C289B28B7A477FF41113C5840B88C9EC2B4D46AB4AD170BE27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 50KB
SHA256 c57f36d7748261484bea6a37aefa7439680483a24f271e03c66d7f6737283faf
MD5 f191cd362c0d46f5b0bb3fb35c7c3664
SHA1 376adde899d0b12598d5b46e9349db4bd1009b54
SHA512 2ca1977b1b707613cd3bff750b117d7679bc28f594c81053ceb30712d794027fa938344a88f8efb5bde9267c07ec002f3705ddc76c4e795eed8d712bac1c235c
SSDEEP 768:MF0rv+4UNbdx35wg1pawcx16UaHuVboPzkZLNx9OFQb9Mk:JbsbD3dDHOawZLNqOb+k
TLSH
T1503339F1A4D78937D8AE8787A37D6D46AEBCD057B5880A84BBC45E4CCC560BFC70A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1544_1594367662\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 d4760602fd104f86d39c8471196bf23f6385a859f0caa3970c1926f884455acf
MD5 35041843bb10c440334953e1480a749b
SHA1 1308a6aa384b58347935da96bee2a069ec45a67b
SHA512 0bb615ad2c116cd15ccd98a68ca8f46554d80ef559817eeee62af922a70a66fe75e0c770aec639fff80cebfcf5ca9241ed03a28ba0651605d8b724d2e1be0051
TLSH
T1D071238356B9D9F2C1DB5BF002835248F5FF23380B2330214B655546AB30A7A28B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/356-495-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1172-230-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1908-429-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2228-337-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2280-453-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2652-62-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3464-311-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3552-471-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3596-322-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3896-370-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4596-291-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5000-263-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5012-317-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5400-418-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5616-181-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5792-475-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5824-433-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5824-397-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5844-345-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5900-499-0x0000000000010000-0x00000000000AB000-memory.dmp

Download