systex | f657a55eb5959d243d5048351b1fce812215ae3f0b21f5d758b85af8a6fec6d6

Analysis

max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 16:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-10_131c683e6a5042e5365a741dda94fa44_amadey_darkgate_elex_smoke-loader_stop.exe
Size 384KB
Sample260710-tva7vsfs3z
SHA256 f657a55eb5959d243d5048351b1fce812215ae3f0b21f5d758b85af8a6fec6d6
MD5 131c683e6a5042e5365a741dda94fa44
SHA1 c8c19ab49a1531061088de153eccf54ad5dd4435
SHA512 2450c00ba8ea3fec6caeb98e2edafbc49d4ca12482c9e8568a0dd933dfafdc0c33f00301eaf108debbf2b5d5ae09d3438f31bf6f00a27d935234ab35cadd1258
SSDEEP 3072:r9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:ZctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T136847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
4872	igbywqoljdbywqom.exe
3316	igbywqoljdbywqom.sys
3232	CreateProcess.exe
4868	trljgbwtld.exe
1108	CreateProcess.exe
4088	CreateProcess.exe
5880	i_trljgbwtld.exe
4304	gdbvtnlgdy.sys
852	CreateProcess.exe
4608	vtnigaytql.exe
5208	CreateProcess.exe
3160	CreateProcess.exe
5456	i_vtnigaytql.exe
5016	xvtnlfdyvq.sys
4624	CreateProcess.exe
1692	qnigayvqki.exe
4784	CreateProcess.exe
5388	CreateProcess.exe
124	i_qnigayvqki.exe
3504	CreateProcess.exe
2532	vpnifaxsqk.exe
2380	CreateProcess.exe
6124	CreateProcess.exe
4304	i_vpnifaxsqk.exe
1264	xvpnkicaxs.sys
4764	CreateProcess.exe
1460	xusmkicxvs.exe
4676	CreateProcess.exe
4940	CreateProcess.exe
2432	i_xusmkicxvs.exe
1936	upmhfzxupm.sys
3364	CreateProcess.exe
5244	uspnhczxrp.exe
4256	CreateProcess.exe
1752	CreateProcess.exe
240	i_uspnhczxrp.exe
4348	uomgecwuom.sys
2536	CreateProcess.exe
5344	rpmgeczxrp.exe
2692	CreateProcess.exe
4388	CreateProcess.exe
1168	i_rpmgeczxrp.exe
4084	zwurmjhbzt.sys
3872	CreateProcess.exe
5736	omgeywrojh.exe
5320	CreateProcess.exe
2136	CreateProcess.exe
3728	i_omgeywrojh.exe
3336	ljgbzwqomg.sys
2288	CreateProcess.exe
4316	lgeywqoljd.exe
4988	CreateProcess.exe
4832	CreateProcess.exe
2240	i_lgeywqoljd.exe
2408	eyvtolgdyw.sys
4264	CreateProcess.exe
3420	gdbvtqigdb.exe
4348	CreateProcess.exe
2996	CreateProcess.exe
5628	i_gdbvtqigdb.exe
5144	gdyvqnigay.sys
4556	CreateProcess.exe
4716	gdyvqoifdb.exe
3664	CreateProcess.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1184_250696332\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1184_250696332\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1184_1575325306\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1184_1575325306\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1184_340359230\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1184_797186205\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1184_797186205\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1184_1575325306\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1184_1575325306\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgeywqoljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdbvtqigdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upkhcausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztrmjztrmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbztrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnigayvqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uspnhczxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgeywrojh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkfcaxsnki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlidbvsqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpnifaxsqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgeywqoljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdbvtqigdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urmkecwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igbywqoljdbywqom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnigaytql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xusmkicxvs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpmgeczxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urmkecwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljgbwtld.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnigayvqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpnifaxsqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdyvqoifdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_upkhcausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uspnhczxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpmgeczxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgeywrojh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdyvqoifdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dyvtqligdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljgbwtld.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnigaytql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xusmkicxvs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifayvpnkfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztrmjztrmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomjebwtr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifayvpnkfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkfcaxsnki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomjebwtr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbztrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dyvtqligdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-10_131c683e6a5042e5365a741dda94fa44_amadey_darkgate_elex_smoke-loader_stop.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3816	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4328	ipconfig.exe
2592	ipconfig.exe
5484	ipconfig.exe
2276	ipconfig.exe
5228	ipconfig.exe
4080	ipconfig.exe
716	ipconfig.exe
1772	ipconfig.exe
3384	ipconfig.exe
4716	ipconfig.exe
5632	ipconfig.exe
2924	ipconfig.exe
3340	ipconfig.exe
2476	ipconfig.exe
4764	ipconfig.exe
3944	ipconfig.exe
5228	ipconfig.exe
4724	ipconfig.exe
4384	ipconfig.exe
4312	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134281741445815569"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{FB335617-A61A-4AEB-A16E-C7E47AE59BF3}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2412	2026-07-10_131c683e6a5042e5365a741dda94fa44_amadey_darkgate_elex_smoke-loader_stop.exe
2412	2026-07-10_131c683e6a5042e5365a741dda94fa44_amadey_darkgate_elex_smoke-loader_stop.exe
2412	2026-07-10_131c683e6a5042e5365a741dda94fa44_amadey_darkgate_elex_smoke-loader_stop.exe
2412	2026-07-10_131c683e6a5042e5365a741dda94fa44_amadey_darkgate_elex_smoke-loader_stop.exe
2412	2026-07-10_131c683e6a5042e5365a741dda94fa44_amadey_darkgate_elex_smoke-loader_stop.exe
2412	2026-07-10_131c683e6a5042e5365a741dda94fa44_amadey_darkgate_elex_smoke-loader_stop.exe
2412	2026-07-10_131c683e6a5042e5365a741dda94fa44_amadey_darkgate_elex_smoke-loader_stop.exe
2412	2026-07-10_131c683e6a5042e5365a741dda94fa44_amadey_darkgate_elex_smoke-loader_stop.exe
2412	2026-07-10_131c683e6a5042e5365a741dda94fa44_amadey_darkgate_elex_smoke-loader_stop.exe
2412	2026-07-10_131c683e6a5042e5365a741dda94fa44_amadey_darkgate_elex_smoke-loader_stop.exe
2412	2026-07-10_131c683e6a5042e5365a741dda94fa44_amadey_darkgate_elex_smoke-loader_stop.exe
2412	2026-07-10_131c683e6a5042e5365a741dda94fa44_amadey_darkgate_elex_smoke-loader_stop.exe
2412	2026-07-10_131c683e6a5042e5365a741dda94fa44_amadey_darkgate_elex_smoke-loader_stop.exe
2412	2026-07-10_131c683e6a5042e5365a741dda94fa44_amadey_darkgate_elex_smoke-loader_stop.exe
2412	2026-07-10_131c683e6a5042e5365a741dda94fa44_amadey_darkgate_elex_smoke-loader_stop.exe
2412	2026-07-10_131c683e6a5042e5365a741dda94fa44_amadey_darkgate_elex_smoke-loader_stop.exe
2412	2026-07-10_131c683e6a5042e5365a741dda94fa44_amadey_darkgate_elex_smoke-loader_stop.exe
2412	2026-07-10_131c683e6a5042e5365a741dda94fa44_amadey_darkgate_elex_smoke-loader_stop.exe
2412	2026-07-10_131c683e6a5042e5365a741dda94fa44_amadey_darkgate_elex_smoke-loader_stop.exe
2412	2026-07-10_131c683e6a5042e5365a741dda94fa44_amadey_darkgate_elex_smoke-loader_stop.exe
2412	2026-07-10_131c683e6a5042e5365a741dda94fa44_amadey_darkgate_elex_smoke-loader_stop.exe
2412	2026-07-10_131c683e6a5042e5365a741dda94fa44_amadey_darkgate_elex_smoke-loader_stop.exe
2412	2026-07-10_131c683e6a5042e5365a741dda94fa44_amadey_darkgate_elex_smoke-loader_stop.exe
2412	2026-07-10_131c683e6a5042e5365a741dda94fa44_amadey_darkgate_elex_smoke-loader_stop.exe
2412	2026-07-10_131c683e6a5042e5365a741dda94fa44_amadey_darkgate_elex_smoke-loader_stop.exe
2412	2026-07-10_131c683e6a5042e5365a741dda94fa44_amadey_darkgate_elex_smoke-loader_stop.exe
2412	2026-07-10_131c683e6a5042e5365a741dda94fa44_amadey_darkgate_elex_smoke-loader_stop.exe
2412	2026-07-10_131c683e6a5042e5365a741dda94fa44_amadey_darkgate_elex_smoke-loader_stop.exe
2412	2026-07-10_131c683e6a5042e5365a741dda94fa44_amadey_darkgate_elex_smoke-loader_stop.exe
2412	2026-07-10_131c683e6a5042e5365a741dda94fa44_amadey_darkgate_elex_smoke-loader_stop.exe
2412	2026-07-10_131c683e6a5042e5365a741dda94fa44_amadey_darkgate_elex_smoke-loader_stop.exe
2412	2026-07-10_131c683e6a5042e5365a741dda94fa44_amadey_darkgate_elex_smoke-loader_stop.exe
2412	2026-07-10_131c683e6a5042e5365a741dda94fa44_amadey_darkgate_elex_smoke-loader_stop.exe
2412	2026-07-10_131c683e6a5042e5365a741dda94fa44_amadey_darkgate_elex_smoke-loader_stop.exe
2412	2026-07-10_131c683e6a5042e5365a741dda94fa44_amadey_darkgate_elex_smoke-loader_stop.exe
2412	2026-07-10_131c683e6a5042e5365a741dda94fa44_amadey_darkgate_elex_smoke-loader_stop.exe
2412	2026-07-10_131c683e6a5042e5365a741dda94fa44_amadey_darkgate_elex_smoke-loader_stop.exe
2412	2026-07-10_131c683e6a5042e5365a741dda94fa44_amadey_darkgate_elex_smoke-loader_stop.exe
2412	2026-07-10_131c683e6a5042e5365a741dda94fa44_amadey_darkgate_elex_smoke-loader_stop.exe
2412	2026-07-10_131c683e6a5042e5365a741dda94fa44_amadey_darkgate_elex_smoke-loader_stop.exe
2412	2026-07-10_131c683e6a5042e5365a741dda94fa44_amadey_darkgate_elex_smoke-loader_stop.exe
2412	2026-07-10_131c683e6a5042e5365a741dda94fa44_amadey_darkgate_elex_smoke-loader_stop.exe
2412	2026-07-10_131c683e6a5042e5365a741dda94fa44_amadey_darkgate_elex_smoke-loader_stop.exe
2412	2026-07-10_131c683e6a5042e5365a741dda94fa44_amadey_darkgate_elex_smoke-loader_stop.exe
2412	2026-07-10_131c683e6a5042e5365a741dda94fa44_amadey_darkgate_elex_smoke-loader_stop.exe
2412	2026-07-10_131c683e6a5042e5365a741dda94fa44_amadey_darkgate_elex_smoke-loader_stop.exe
2412	2026-07-10_131c683e6a5042e5365a741dda94fa44_amadey_darkgate_elex_smoke-loader_stop.exe
2412	2026-07-10_131c683e6a5042e5365a741dda94fa44_amadey_darkgate_elex_smoke-loader_stop.exe
2412	2026-07-10_131c683e6a5042e5365a741dda94fa44_amadey_darkgate_elex_smoke-loader_stop.exe
2412	2026-07-10_131c683e6a5042e5365a741dda94fa44_amadey_darkgate_elex_smoke-loader_stop.exe
2412	2026-07-10_131c683e6a5042e5365a741dda94fa44_amadey_darkgate_elex_smoke-loader_stop.exe
2412	2026-07-10_131c683e6a5042e5365a741dda94fa44_amadey_darkgate_elex_smoke-loader_stop.exe
2412	2026-07-10_131c683e6a5042e5365a741dda94fa44_amadey_darkgate_elex_smoke-loader_stop.exe
2412	2026-07-10_131c683e6a5042e5365a741dda94fa44_amadey_darkgate_elex_smoke-loader_stop.exe
2412	2026-07-10_131c683e6a5042e5365a741dda94fa44_amadey_darkgate_elex_smoke-loader_stop.exe
2412	2026-07-10_131c683e6a5042e5365a741dda94fa44_amadey_darkgate_elex_smoke-loader_stop.exe
4872	igbywqoljdbywqom.exe
4872	igbywqoljdbywqom.exe
4872	igbywqoljdbywqom.exe
4872	igbywqoljdbywqom.exe
4872	igbywqoljdbywqom.exe
4872	igbywqoljdbywqom.exe
4872	igbywqoljdbywqom.exe
4872	igbywqoljdbywqom.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	5880	i_trljgbwtld.exe
Token: SeDebugPrivilege	5456	i_vtnigaytql.exe
Token: SeDebugPrivilege	4304	i_vpnifaxsqk.exe
Token: SeDebugPrivilege	2432	i_xusmkicxvs.exe
Token: SeDebugPrivilege	240	i_uspnhczxrp.exe
Token: SeDebugPrivilege	1168	i_rpmgeczxrp.exe
Token: SeDebugPrivilege	3728	i_omgeywrojh.exe
Token: SeDebugPrivilege	2240	i_lgeywqoljd.exe
Token: SeDebugPrivilege	5628	i_gdbvtqigdb.exe
Token: SeDebugPrivilege	4080	i_gdyvqoifdb.exe
Token: SeDebugPrivilege	5588	i_ifayvpnkfd.exe
Token: SeDebugPrivilege	3492	i_nkfcaxsnki.exe
Token: SeDebugPrivilege	1204	i_upkhcausmk.exe
Token: SeDebugPrivilege	5972	i_urmkecwuom.exe
Token: SeDebugPrivilege	4972	i_ztrmjztrmj.exe
Token: SeDebugPrivilege	5188	i_wuomjebwtr.exe
Token: SeDebugPrivilege	5584	i_jdbztrljdb.exe
Token: SeDebugPrivilege	3284	i_dyvtqligdb.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1184	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 4872	2412	2026-07-10_131c683e6a5042e5365a741dda94fa44_amadey_darkgate_elex_smoke-loader_stop.exe	87
PID 2412 wrote to memory of 1820	2412	2026-07-10_131c683e6a5042e5365a741dda94fa44_amadey_darkgate_elex_smoke-loader_stop.exe	88
PID 1820 wrote to memory of 1184	1820	iexplore.exe	89
PID 1184 wrote to memory of 2936	1184	msedge.exe	90
PID 1184 wrote to memory of 2552	1184	msedge.exe	92
PID 1184 wrote to memory of 3816	1184	msedge.exe	93
PID 1184 wrote to memory of 2552	1184	msedge.exe	92
PID 1184 wrote to memory of 2552	1184	msedge.exe	92
PID 1184 wrote to memory of 624	1184	msedge.exe	94
PID 1184 wrote to memory of 624	1184	msedge.exe	94
PID 1184 wrote to memory of 2108	1184	msedge.exe	95
PID 1184 wrote to memory of 3024	1184	msedge.exe	96
PID 1184 wrote to memory of 2108	1184	msedge.exe	95
PID 1184 wrote to memory of 2108	1184	msedge.exe	95
PID 1184 wrote to memory of 3024	1184	msedge.exe	96
PID 1184 wrote to memory of 3024	1184	msedge.exe	96
PID 1184 wrote to memory of 4532	1184	msedge.exe	97
PID 1184 wrote to memory of 4532	1184	msedge.exe	97
PID 1184 wrote to memory of 4532	1184	msedge.exe	97
PID 1184 wrote to memory of 5068	1184	msedge.exe	98
PID 1184 wrote to memory of 5068	1184	msedge.exe	98
PID 1184 wrote to memory of 5068	1184	msedge.exe	98
PID 1184 wrote to memory of 1552	1184	msedge.exe	100
PID 1184 wrote to memory of 1552	1184	msedge.exe	100
PID 4872 wrote to memory of 3232	4872	igbywqoljdbywqom.exe	103
PID 4868 wrote to memory of 1108	4868	trljgbwtld.exe	106
PID 1184 wrote to memory of 2800	1184	msedge.exe	109
PID 1184 wrote to memory of 2800	1184	msedge.exe	109
PID 1184 wrote to memory of 5144	1184	msedge.exe	110
PID 1184 wrote to memory of 5144	1184	msedge.exe	110
PID 1184 wrote to memory of 5332	1184	msedge.exe	112
PID 1184 wrote to memory of 5860	1184	msedge.exe	113
PID 1184 wrote to memory of 5860	1184	msedge.exe	113
PID 1184 wrote to memory of 4248	1184	msedge.exe	116
PID 1184 wrote to memory of 4248	1184	msedge.exe	116
PID 4872 wrote to memory of 4088	4872	igbywqoljdbywqom.exe	117
PID 4872 wrote to memory of 852	4872	igbywqoljdbywqom.exe	121
PID 4608 wrote to memory of 5208	4608	vtnigaytql.exe	123
PID 4872 wrote to memory of 3160	4872	igbywqoljdbywqom.exe	126
PID 4872 wrote to memory of 4624	4872	igbywqoljdbywqom.exe	130
PID 1692 wrote to memory of 4784	1692	qnigayvqki.exe	132
PID 4872 wrote to memory of 5388	4872	igbywqoljdbywqom.exe	135
PID 1184 wrote to memory of 4820	1184	msedge.exe	137
PID 1184 wrote to memory of 4820	1184	msedge.exe	137
PID 1184 wrote to memory of 4820	1184	msedge.exe	137
PID 1184 wrote to memory of 3220	1184	msedge.exe	138
PID 1184 wrote to memory of 3220	1184	msedge.exe	138
PID 1184 wrote to memory of 3220	1184	msedge.exe	138
PID 4872 wrote to memory of 3504	4872	igbywqoljdbywqom.exe	140
PID 2532 wrote to memory of 2380	2532	vpnifaxsqk.exe	142
PID 4872 wrote to memory of 6124	4872	igbywqoljdbywqom.exe	145
PID 1184 wrote to memory of 772	1184	msedge.exe	147
PID 1184 wrote to memory of 4452	1184	msedge.exe	148
PID 1184 wrote to memory of 4260	1184	msedge.exe	149
PID 4872 wrote to memory of 4764	4872	igbywqoljdbywqom.exe	152
PID 1460 wrote to memory of 4676	1460	xusmkicxvs.exe	154
PID 4872 wrote to memory of 4940	4872	igbywqoljdbywqom.exe	157
PID 4872 wrote to memory of 3364	4872	igbywqoljdbywqom.exe	161
PID 5244 wrote to memory of 4256	5244	uspnhczxrp.exe	163
PID 4872 wrote to memory of 1752	4872	igbywqoljdbywqom.exe	166
PID 4872 wrote to memory of 2536	4872	igbywqoljdbywqom.exe	170
PID 5344 wrote to memory of 2692	5344	rpmgeczxrp.exe	172
PID 4872 wrote to memory of 4388	4872	igbywqoljdbywqom.exe	175
PID 4872 wrote to memory of 3872	4872	igbywqoljdbywqom.exe	179

C:\Users\Admin\AppData\Local\Temp\2026-07-10_131c683e6a5042e5365a741dda94fa44_amadey_darkgate_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_131c683e6a5042e5365a741dda94fa44_amadey_darkgate_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Temp\igbywqoljdbywqom.exe
  C:\Temp\igbywqoljdbywqom.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4872
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\trljgbwtld.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3232
  - - C:\Temp\trljgbwtld.exe
      C:\Temp\trljgbwtld.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4868
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1108
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4764
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_trljgbwtld.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4088
  - - C:\Temp\i_trljgbwtld.exe
      C:\Temp\i_trljgbwtld.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5880
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtnigaytql.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:852
  - - C:\Temp\vtnigaytql.exe
      C:\Temp\vtnigaytql.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4608
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5208
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4328
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtnigaytql.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3160
  - - C:\Temp\i_vtnigaytql.exe
      C:\Temp\i_vtnigaytql.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5456
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qnigayvqki.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4624
  - - C:\Temp\qnigayvqki.exe
      C:\Temp\qnigayvqki.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1692
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4784
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5228
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qnigayvqki.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5388
  - - C:\Temp\i_qnigayvqki.exe
      C:\Temp\i_qnigayvqki.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:124
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vpnifaxsqk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3504
  - - C:\Temp\vpnifaxsqk.exe
      C:\Temp\vpnifaxsqk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2532
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2380
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4716
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vpnifaxsqk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6124
  - - C:\Temp\i_vpnifaxsqk.exe
      C:\Temp\i_vpnifaxsqk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4304
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xusmkicxvs.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4764
  - - C:\Temp\xusmkicxvs.exe
      C:\Temp\xusmkicxvs.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1460
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4676
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3944
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xusmkicxvs.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4940
  - - C:\Temp\i_xusmkicxvs.exe
      C:\Temp\i_xusmkicxvs.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2432
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\uspnhczxrp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3364
  - - C:\Temp\uspnhczxrp.exe
      C:\Temp\uspnhczxrp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5244
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4256
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5228
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_uspnhczxrp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1752
  - - C:\Temp\i_uspnhczxrp.exe
      C:\Temp\i_uspnhczxrp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:240
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rpmgeczxrp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2536
  - - C:\Temp\rpmgeczxrp.exe
      C:\Temp\rpmgeczxrp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5344
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2692
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2592
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rpmgeczxrp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4388
  - - C:\Temp\i_rpmgeczxrp.exe
      C:\Temp\i_rpmgeczxrp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1168
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\omgeywrojh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3872
  - - C:\Temp\omgeywrojh.exe
      C:\Temp\omgeywrojh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5736
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5320
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4080
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_omgeywrojh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2136
  - - C:\Temp\i_omgeywrojh.exe
      C:\Temp\i_omgeywrojh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3728
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lgeywqoljd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2288
  - - C:\Temp\lgeywqoljd.exe
      C:\Temp\lgeywqoljd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4316
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4988
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5632
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lgeywqoljd.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4832
  - - C:\Temp\i_lgeywqoljd.exe
      C:\Temp\i_lgeywqoljd.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2240
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gdbvtqigdb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4264
  - - C:\Temp\gdbvtqigdb.exe
      C:\Temp\gdbvtqigdb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3420
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4348
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4724
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gdbvtqigdb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2996
  - - C:\Temp\i_gdbvtqigdb.exe
      C:\Temp\i_gdbvtqigdb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5628
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gdyvqoifdb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4556
  - - C:\Temp\gdyvqoifdb.exe
      C:\Temp\gdyvqoifdb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4716
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3664
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5484
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gdyvqoifdb.exe ups_ins
    3⤵
    PID:2916
  - - C:\Temp\i_gdyvqoifdb.exe
      C:\Temp\i_gdyvqoifdb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4080
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ifayvpnkfd.exe ups_run
    3⤵
    PID:696
  - - C:\Temp\ifayvpnkfd.exe
      C:\Temp\ifayvpnkfd.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4816
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5152
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2276
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ifayvpnkfd.exe ups_ins
    3⤵
    PID:3024
  - - C:\Temp\i_ifayvpnkfd.exe
      C:\Temp\i_ifayvpnkfd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5588
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nkfcaxsnki.exe ups_run
    3⤵
    PID:252
  - - C:\Temp\nkfcaxsnki.exe
      C:\Temp\nkfcaxsnki.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:240
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5436
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2924
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nkfcaxsnki.exe ups_ins
    3⤵
    PID:4552
  - - C:\Temp\i_nkfcaxsnki.exe
      C:\Temp\i_nkfcaxsnki.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3492
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\upkhcausmk.exe ups_run
    3⤵
    PID:2984
  - - C:\Temp\upkhcausmk.exe
      C:\Temp\upkhcausmk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4248
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5616
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:716
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_upkhcausmk.exe ups_ins
    3⤵
    PID:4204
  - - C:\Temp\i_upkhcausmk.exe
      C:\Temp\i_upkhcausmk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1204
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\urmkecwuom.exe ups_run
    3⤵
    PID:3428
  - - C:\Temp\urmkecwuom.exe
      C:\Temp\urmkecwuom.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2340
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4736
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1772
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_urmkecwuom.exe ups_ins
    3⤵
    PID:2904
  - - C:\Temp\i_urmkecwuom.exe
      C:\Temp\i_urmkecwuom.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5972
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ztrmjztrmj.exe ups_run
    3⤵
    PID:2628
  - - C:\Temp\ztrmjztrmj.exe
      C:\Temp\ztrmjztrmj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5068
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3464
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4384
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ztrmjztrmj.exe ups_ins
    3⤵
    PID:2520
  - - C:\Temp\i_ztrmjztrmj.exe
      C:\Temp\i_ztrmjztrmj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4972
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wuomjebwtr.exe ups_run
    3⤵
    PID:3372
  - - C:\Temp\wuomjebwtr.exe
      C:\Temp\wuomjebwtr.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1948
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4340
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3340
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wuomjebwtr.exe ups_ins
    3⤵
    PID:2924
  - - C:\Temp\i_wuomjebwtr.exe
      C:\Temp\i_wuomjebwtr.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5188
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jdbztrljdb.exe ups_run
    3⤵
    PID:4680
  - - C:\Temp\jdbztrljdb.exe
      C:\Temp\jdbztrljdb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2592
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3344
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3384
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jdbztrljdb.exe ups_ins
    3⤵
    PID:4292
  - - C:\Temp\i_jdbztrljdb.exe
      C:\Temp\i_jdbztrljdb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5584
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dyvtqligdb.exe ups_run
    3⤵
    PID:2852
  - - C:\Temp\dyvtqligdb.exe
      C:\Temp\dyvtqligdb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4632
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2376
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4312
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dyvtqligdb.exe ups_ins
    3⤵
    PID:3116
  - - C:\Temp\i_dyvtqligdb.exe
      C:\Temp\i_dyvtqligdb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3284
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nlidbvsqli.exe ups_run
    3⤵
    PID:2492
  - - C:\Temp\nlidbvsqli.exe
      C:\Temp\nlidbvsqli.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5888
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5408
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2476
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffd5f15c188,0x7ffd5f15c194,0x7ffd5f15c1a0
      4⤵
      PID:2936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1976,i,6449456410316764712,15775430143051670635,262144 --field-trial-handle=2500,i,486118974507311910,9912605311110577874,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:2
      4⤵
      PID:2552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2168,i,4001323904507000736,6957889425959136844,524288 --field-trial-handle=2500,i,486118974507311910,9912605311110577874,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:11
      4⤵
      System Time Discovery
      PID:3816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2676,i,8753315842042421206,10761226461365954087,524288 --field-trial-handle=2500,i,486118974507311910,9912605311110577874,262144 --variations-seed-version --mojo-platform-channel-handle=3184 /prefetch:13
      4⤵
      PID:624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3604,i,7930617094874356248,3855610582609927200,2097152 --field-trial-handle=2500,i,486118974507311910,9912605311110577874,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
      4⤵
      PID:2108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3612,i,1186121059690285886,9013176962821999813,2097152 --field-trial-handle=2500,i,486118974507311910,9912605311110577874,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
      4⤵
      PID:3024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4288,i,11467178645989626389,8572612888507917232,2097152 --field-trial-handle=2500,i,486118974507311910,9912605311110577874,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:1
      4⤵
      PID:4532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,9477673196708116669,10107059795195373097,2097152 --field-trial-handle=2500,i,486118974507311910,9912605311110577874,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:9
      4⤵
      PID:5068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3768,i,4397146648820853975,3620952173551214153,524288 --field-trial-handle=2500,i,486118974507311910,9912605311110577874,262144 --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:14
      4⤵
      PID:1552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,14544737384180121868,3340259569426577599,524288 --field-trial-handle=2500,i,486118974507311910,9912605311110577874,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
      4⤵
      PID:2800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,16655797012277406243,14963688245411476402,524288 --field-trial-handle=2500,i,486118974507311910,9912605311110577874,262144 --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:14
      4⤵
      PID:5144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,6529796766729633367,8309934097089703073,524288 --field-trial-handle=2500,i,486118974507311910,9912605311110577874,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
      4⤵
      PID:3156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,6529796766729633367,8309934097089703073,524288 --field-trial-handle=2500,i,486118974507311910,9912605311110577874,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
      4⤵
      PID:5332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,6713755423433765984,8462674688974971782,524288 --field-trial-handle=2500,i,486118974507311910,9912605311110577874,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:14
      4⤵
      PID:5860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6580,i,6230463597494023774,1638738271538900066,524288 --field-trial-handle=2500,i,486118974507311910,9912605311110577874,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:14
      4⤵
      PID:4248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4292,i,5366293040336674355,8791782624925958400,2097152 --field-trial-handle=2500,i,486118974507311910,9912605311110577874,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:1
      4⤵
      PID:4820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6272,i,13258867803402238978,16668332455312809849,2097152 --field-trial-handle=2500,i,486118974507311910,9912605311110577874,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:1
      4⤵
      PID:3220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=744,i,14616720888855733286,18293187580941879611,524288 --field-trial-handle=2500,i,486118974507311910,9912605311110577874,262144 --variations-seed-version --mojo-platform-channel-handle=1280 /prefetch:14
      4⤵
      PID:772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,376544095380193517,5701117956877515709,524288 --field-trial-handle=2500,i,486118974507311910,9912605311110577874,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:14
      4⤵
      PID:4452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,18353312204248038185,16226909157151293970,524288 --field-trial-handle=2500,i,486118974507311910,9912605311110577874,262144 --variations-seed-version --mojo-platform-channel-handle=1396 /prefetch:14
      4⤵
      PID:4260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1212,i,7224423488346980631,12266952141010382419,524288 --field-trial-handle=2500,i,486118974507311910,9912605311110577874,262144 --variations-seed-version --mojo-platform-channel-handle=2972 /prefetch:14
      4⤵
      PID:2192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6920,i,6342676184305104496,9092045576207782684,524288 --field-trial-handle=2500,i,486118974507311910,9912605311110577874,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
      4⤵
      PID:4308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=948,i,4066396911156294545,14689799897739095983,524288 --field-trial-handle=2500,i,486118974507311910,9912605311110577874,262144 --variations-seed-version --mojo-platform-channel-handle=7044 /prefetch:14
      4⤵
      PID:1980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=948,i,18434524061527483222,3813145693564850476,524288 --field-trial-handle=2500,i,486118974507311910,9912605311110577874,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
      4⤵
      PID:4312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6992,i,5733625109890609703,15977552666885916589,262144 --field-trial-handle=2500,i,486118974507311910,9912605311110577874,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:10
      4⤵
      PID:5720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,7048818657657380568,16653817118636943901,524288 --field-trial-handle=2500,i,486118974507311910,9912605311110577874,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:14
      4⤵
      PID:4128

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4204

C:\Temp\igbywqoljdbywqom.sys
C:\Temp\igbywqoljdbywqom.sys
1⤵
- Executes dropped EXE
PID:3316

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:264

C:\Temp\gdbvtnlgdy.sys
C:\Temp\gdbvtnlgdy.sys
1⤵
- Executes dropped EXE
PID:4304

C:\Temp\xvtnlfdyvq.sys
C:\Temp\xvtnlfdyvq.sys
1⤵
- Executes dropped EXE
PID:5016

C:\Temp\xvpnkicaxs.sys
C:\Temp\xvpnkicaxs.sys
1⤵
- Executes dropped EXE
PID:1264

C:\Temp\upmhfzxupm.sys
C:\Temp\upmhfzxupm.sys
1⤵
- Executes dropped EXE
PID:1936

C:\Temp\uomgecwuom.sys
C:\Temp\uomgecwuom.sys
1⤵
- Executes dropped EXE
PID:4348

C:\Temp\zwurmjhbzt.sys
C:\Temp\zwurmjhbzt.sys
1⤵
- Executes dropped EXE
PID:4084

C:\Temp\ljgbzwqomg.sys
C:\Temp\ljgbzwqomg.sys
1⤵
- Executes dropped EXE
PID:3336

C:\Temp\eyvtolgdyw.sys
C:\Temp\eyvtolgdyw.sys
1⤵
- Executes dropped EXE
PID:2408

C:\Temp\gdyvqnigay.sys
C:\Temp\gdyvqnigay.sys
1⤵
- Executes dropped EXE
PID:5144

C:\Temp\qnifdyvqnl.sys
C:\Temp\qnifdyvqnl.sys
1⤵
PID:2360

C:\Temp\pnifaxsqki.sys
C:\Temp\pnifaxsqki.sys
1⤵
PID:1360

C:\Temp\pnhfcxuspk.sys
C:\Temp\pnhfcxuspk.sys
1⤵
PID:5628

C:\Temp\caukecxuom.sys
C:\Temp\caukecxuom.sys
1⤵
PID:4520

C:\Temp\urmjhbzurm.sys
C:\Temp\urmjhbzurm.sys
1⤵
PID:5412

C:\Temp\wtrljhecwt.sys
C:\Temp\wtrljhecwt.sys
1⤵
PID:1248

C:\Temp\gbytrljdbv.sys
C:\Temp\gbytrljdbv.sys
1⤵
PID:2488

C:\Temp\olgdywtolj.sys
C:\Temp\olgdywtolj.sys
1⤵
PID:1056

C:\Temp\nigdyvqnlf.sys
C:\Temp\nigdyvqnlf.sys
1⤵
PID:2432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

gdbvtnlgdy.sys

Path C:\Temp\gdbvtnlgdy.sys
Size 293KB
SHA256 f8ceb2ec81ffaa363fa92a9f96d8108ad2f6a0e264b8d73379ae870d128fa8bc
MD5 6246f7dea562f4e13a681a4030766f9e
SHA1 10251f85a2494a5b8818a734e8dc0f6a469d69dd
SHA512 625b1da242f4c3595ae3cc48a7b48fc7f90a61f4e817b6aacee13f900d1706907a20ffbb5ad6015152b472f74eae5aadcdb840e1ed1d115ced217dcee653cf37
SSDEEP 3072:XtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:XIJjiJcbI03GBc3ucY5DCSj
TLSH
T163545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qnigayvqki.exe

Path C:\Temp\i_qnigayvqki.exe
Size 384KB
SHA256 45fd68d31571f2d1a3a05616ea5759ffcf9b38b87aa1ed2a0e63f721b0ae5bc4
MD5 9956067a75d8ab112f4ab7294b349543
SHA1 88412b8955fb37aeb528e2d19620306987b2d271
SHA512 aef737de25f427fca1439be92238bde53ba719628359d5eacf3cbf2ed7f42e469b57dfb47e88ad962c24816fd352d758db13e3c84214a9334dc3c61bf8bd9f1c
SSDEEP 3072:+9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:cctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T164846A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_trljgbwtld.exe

Path C:\Temp\i_trljgbwtld.exe
Size 384KB
SHA256 25102b351cb5495c4e53856932e1d06c6bfc5225ed05b33965029d83ae07c5cb
MD5 48cdd1c73bbd55c85c48f8ebd96078fa
SHA1 e637e633951ff1ce63a2a7da584f38b5dbadd46d
SHA512 e3f3ef4dc2e30bf7c0865f2f7f646be56816ab155bd6302664523c424f8d2727bd0a762f463ca59496f68f25f6522add12d0d06dc3d89bd7849c51d29b75fb66
SSDEEP 3072:09ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:OctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T125847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vpnifaxsqk.exe

Path C:\Temp\i_vpnifaxsqk.exe
Size 384KB
SHA256 648eaa311be732d6e4a0c5003c97741f1f26a24d8187ad3e0aee8b2cb8fde1e7
MD5 55d99de08920dde2cad5127d0a1c259d
SHA1 fd0e3110aa579de2469b1e5ee94202409946b7a0
SHA512 f56dff62099433a1e9162634ca0962ecb7962858c7aec582d6eaf15daa296b52ad93427f4a7fc16e880837c792471582abf5f41c02a64e36988a423005951593
SSDEEP 3072:T9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:xctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T155847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vtnigaytql.exe

Path C:\Temp\i_vtnigaytql.exe
Size 384KB
SHA256 a603377872d38d0d30e557aecaaaa3c291f6f4a040f10564550f35b3b683fa5a
MD5 4d77680acab99385e21b95dffcbdb261
SHA1 846ec585ca694968b751d71d4862c3ba4925e37a
SHA512 f5047c8b8d680b52f56a7fc6d730e4ac6f2242adacfa8b63a41e9da1a858fc131e84d0e5aa5dcd464a1a3e75c202a1b1942b135ccaf9cc03875881e781a8700f
SSDEEP 3072:09ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:OctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F6847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xusmkicxvs.exe

Path C:\Temp\i_xusmkicxvs.exe
Size 384KB
SHA256 0f2d7bbee342c6d666c9ef70d559f58e84267a93ede805c6099b49073edd9ea1
MD5 40304d1b5301247849a93f6c090f2242
SHA1 33745109ec5cf4e88e6beb603aa039fa56e20059
SHA512 428cc17666a0188d34c2646a69ac1dfe862eb2f4880d646eeb9c5e622dff7a7b5dbe4494307bdf8d66fe6792c9e7028c4bf3be2f299658cfb3d5423f23373864
SSDEEP 3072:N9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:fctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E7847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igbywqoljdbywqom.exe

Path C:\Temp\igbywqoljdbywqom.exe
Size 384KB
SHA256 54e73e8a631154372fcf6847846d98e7571919710305cd1b775575ff8caf2945
MD5 ec7cfa877643fa49767062762bbe6bc6
SHA1 55f4ceb2d3638cdddba9b41801fa4457337b5371
SHA512 da73493ae379a4ce24dcaa26cda8c3f0d837cdf60ac8b385933534802b4ca1cb58cbef6133a2f5328040a6f3e2410643711a4f40410d640a04b23026e0d1f80c
SSDEEP 3072:l9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:HctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1FD847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igbywqoljdbywqom.sys

Path C:\Temp\igbywqoljdbywqom.sys
Size 293KB
SHA256 b8ca79f9d10d4ec425046b8dc6b1d4c5ec620c1b7f69465cf50861d94203dab0
MD5 9589195b80d91ebc559e957941c61d7e
SHA1 b9f5a68c794a24460b7d2b45d10ba965aff07138
SHA512 f569681243ccc90b49bfa3f91edc1ffbda92f65f9b5a3b10dd6ad210845355cd106bbf1a2723b4b9778ea9cf2666d0e55268bbbde57c2456b7ec1c2e0a6e7a16
SSDEEP 3072:3tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:3IJjiJcbI03GBc3ucY5DCSj
TLSH
T128545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qnigayvqki.exe

Path C:\Temp\qnigayvqki.exe
Size 384KB
SHA256 69012855c6bc7c87bdced33b0af8a08d63bd654f18c49299f7e9018c121aaa13
MD5 3ad33c911273a0a97cfdb3297dfebcf4
SHA1 fd18deca179327f2dee2e34b41055a90631a4b8e
SHA512 392a36a9e23c18bd94ea2c6953e767549189374e3a002d4d1ac530e26151e218d9f14975ade05c0f1eee7d56768b190ee79e15673d2741ba750b2a8d7d61fa64
SSDEEP 3072:n9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:9ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T130847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trljgbwtld.exe

Path C:\Temp\trljgbwtld.exe
Size 384KB
SHA256 cbe4797c828c32476d1ec9140ced7f97b0ad43ff5fe8eb99d2bccc4268528889
MD5 51db7466911bd58d3b58531f840be31a
SHA1 1e7e3ee9f0afe2c775d76089f8c9af3900fdef76
SHA512 7c426b2c02aea82003c0894115400f0ef8359bc54345aa5bd0b8c660c36712580ec6ad275e0b2908fdf74cbf131c05fe2f348aee01f013d469db09339eb7d907
SSDEEP 3072:09ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:OctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E1847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

upmhfzxupm.sys

Path C:\Temp\upmhfzxupm.sys
Size 293KB
SHA256 6d15f4bfe81e2e064c0eec262d4746020381c559e0e4ca748b7623af6344fe03
MD5 2d62dede65a655d2bfc7e5641e3617e3
SHA1 0f25f14e4ec70bc9b02cdfbd474b92cb092e1404
SHA512 f4efd328de64234b4890d7d231131577edfc5673cf21928b51e69c6bed8c8e5bcfe02596300da5ef7d858b5f372295113da68bcf5d6d0e69560c1410a23a5641
SSDEEP 3072:+tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:+IJjiJcbI03GBc3ucY5DCSj
TLSH
T10E545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uspnhczxrp.exe

Path C:\Temp\uspnhczxrp.exe
Size 384KB
SHA256 7ed43771f4ccda9e50279b848e5924766a2b1d290ef54464fb8c445822876fc5
MD5 2080884b10759e8cc879227cf0db9032
SHA1 99329ee5b989aa9239c3448f7a06df09a5a04c6f
SHA512 f8345375564d934d7ef5657793774a90253c8fa59caa470f474ca53d1ecd4b9153482b762d0d70aa0ea790ef992a94dca59f0256c8afd3b793a993b26d782549
SSDEEP 3072:D9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:hctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T17C847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vpnifaxsqk.exe

Path C:\Temp\vpnifaxsqk.exe
Size 384KB
SHA256 03e2d7ad5d0b69729302a90c2635010e9b6261de702cdcab72ad498ca6301dbd
MD5 4e733113969d022c300be35c484ab91b
SHA1 7484af0ee8fdb6fdaa73780ed3a6379d4b0104ce
SHA512 8f18632c2119aae2ddd5000934b1492bb9ac941ee63f13636c3b51e023a25523b8f4a9aca1c270934a581cef2bf6125ce8befd882a7a35576e58056c24dd0cba
SSDEEP 3072:09ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:OctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T111847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtnigaytql.exe

Path C:\Temp\vtnigaytql.exe
Size 384KB
SHA256 dbcaaf66f5abfb0ff27281cb0f80a81e8a220bcec93141b3800919ee1f4b2898
MD5 19f6e33bfd2446a602e639a62be842c9
SHA1 9ca6d27236c531c5940b33d0575d5c4b825ecf78
SHA512 18cd6be7d1d404a36b299ebb836a4460d92cf52d1d22d9eb6c6d72e1b926781def5da598e76e50289ac7abfd61f7ba68f09c8827808b3c2f4122e5e78da34e33
SSDEEP 3072:E9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:ectFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C6846B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xusmkicxvs.exe

Path C:\Temp\xusmkicxvs.exe
Size 384KB
SHA256 0431a4aaa6830127f081572e35e4d7bd0b08f2025316c2c5846412e9dd5f9728
MD5 66e233cba303ef270abed0543f5290b1
SHA1 f2295e941425b3e8ba9004ebc612d4e302393459
SHA512 e0334f546397c6e0d5b0b00da60f5a68ce2eea29e2f6b58ef5cce7218dbcd0bc2c5aa61514ba5ed7e0af8ec84ef4cc2781ece4102439e92d75507554299a3daf
SSDEEP 3072:59ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:TctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1AC847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvpnkicaxs.sys

Path C:\Temp\xvpnkicaxs.sys
Size 293KB
SHA256 be82fcf4aea967a279e8ea20c46d7908ca09734b217b0c9336fa33b0ed0c12c3
MD5 6a18ddad06c106667e820ec125e99041
SHA1 7338bf8af7c4634198ad57fb6356ee0a4066453b
SHA512 c636ae198979f676395c2593c85c7d1e6e093fc584c41306a82dd293724ded73a85f69bdee63bc176e877abce66efcfbab815bd4cf3837d3e865c6305c743105
SSDEEP 3072:jtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:jIJjiJcbI03GBc3ucY5DCSj
TLSH
T124545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvtnlfdyvq.sys

Path C:\Temp\xvtnlfdyvq.sys
Size 293KB
SHA256 9ed1244133048caab093d29a61e17cd1adda2f8c29c8c303248332ced55db5f7
MD5 ed507411a522fe610d8028aaa6e069d6
SHA1 a109c0b874f117527e7c408481b51345a055f30b
SHA512 caff1ba329dfc26be38ee5a5c514c2bab87fc4616193b6d07c8568e3f9fdb3e89707e7706dead83f770a85a8b9db0276c2561e0671d4fc56d7ef15c1cfc0c479
SSDEEP 3072:4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:4IJjiJcbI03GBc3ucY5DCSj
TLSH
T147545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 914d602817d6913603fe23bba3a6586fe040fc689e38debd5920a71e39261d97
MD5 3ad14e4ab67a24616272b71f7f636898
SHA1 348392fccaae3bdda91d0033c4ab31f8e9fc51b3
SHA512 4797c31ec788315c7092ca07d6ff6ae0a33b7122814a3c80f4e956ced2155ad525285a78b138a6e3f70a630973aae451a5c4fac6e07a80b0415028a7865f6024
TLSH
T19651847953B64DD2DB29AA7AF0E9786B32F6806A43073E40F2852F345C05F745BE1113
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59bdb8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59bdb8.TMP
Size 3KB
SHA256 0c6f1a8e9d90a9a68cc5c86e402e928658dcade47760d4e028e4ab2ebfdc1ec8
MD5 481541164f00fa8fd47e738bb6cd5ade
SHA1 98fa39d233b54658396d490751c7209b8a8b0792
SHA512 e162ce76f2bda0484b169ce493ea59bcc4d79bc5925a840a842315b10f88567f94c6dbe57fb35cab0cceeb4f2430269c0d4a40f8a64052a06108369e4ed75c0e
TLSH
T16A51847553B64DD2DB29AA7AF0E9746B33F6806A43073E00E2852F345C05F755BE1113
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 82d62ccdc0cfb21c8552df3185e1cf2599cbcc3a510c57f7a0bcc5bbc084769a
MD5 566828fc3721e1f5f7cc108101693a65
SHA1 0abce13f9e35fcf627a2459ff1394ce9cf1ad68b
SHA512 99301377caf9424558db7260fc741725378362d3fd5e2fd3854e20440dd0b58653e1450c5ee3f9a4e4a6c6d754af2787f8f65c1a80438545176e1dc54c0468b0
TLSH
T12051FFF3C3E5862EC91156F0AA187E2BDE1D0915832C3C5AC9E4EF5BD3E2471E142A5E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 ee45c11f5f67acd0979a314abb960488bacae0f47f486432c66ad9c54b3b8124
MD5 614dd6c7e5221646b3cbfeec3806ec7a
SHA1 3a751a0a703cda779531bb75f06f5c146e44a4d7
SHA512 29163cf5150c863c2c9aa6390698050b9096f1408a15028f843a4275384b8462b51c239a94d598b5ec56e58184c9c2e73ceac1ec293449d46de20bf16f25bbd1
SSDEEP 192:sxRTd/yM/jK1Ml8wC3/fYsoEPA/AQZ0BH9uptzoA8pi/g6+WNIYnY3hJGiIgtJ:sxRx583/fYslI4O0zu2i/5I5RB3
TLSH
T11F52D915AA24597BCCDBD20DFA557F93D6F91563A2901E04EAFCCA0C04E7AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 7996fee72308eebad27b03d16cfecfe3749e56655617cbd7861f1ae66b07473e
MD5 31063fc9607bd8d0c00bcfa4022ade9a
SHA1 0764d85fe912b7a3309980a4829f26e6f88edaa2
SHA512 3d66e2eecfadce8a09c80ea389fa95186af38098c614a84bbd4ee253b1d9818bd61929b71be30bad9c0f4b010b7cb29a90d5015e92e4a629c76bbde9d21a8f4c
SSDEEP 192:sxRTi/yM/jK1Ml8UQwC3/fYsWEPAyAQZ0BH9upFzoA8pr//g6+WNC0s/YnGGhJGW:sxRm7qn3/fYszIrO0zuK7/5q/fsB7
TLSH
T11062C916AA245D7BDCDBD209FA517F93D6F95563A2901E08AAFCCB0C00E76DD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 deb4f380e8085bd7f144b9b4fc11abf2c3aaef0637f33d897bc5d3f618b002fa
MD5 08c6a86d2652bacc8c083c6feaa6683c
SHA1 cbade5c0c1a690004bc9027810b615f62c645f14
SHA512 e8705264e1662a8c3bebcb8a34a9c64b4e585d94786883ad895d88e84ddaa9692e70485384ada32579cd970d01b636492cf06c991e9d7527d3f59942bde0c0bd
SSDEEP 192:sxRTi/yM/jK1Ml8wC3/fYsWEPA/AQZ0BH9uptzoA8pi/g6+WNIYnY3hJGiIgDnJ:sxRm583/fYszI4O0zu2i/5I5RBN
TLSH
T1DA52D915AA34597BCCDBD20DFA557F93D6F91563A2901E08EAFC8A0C04E76ED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 143b5ee1c5d9ed7bec33950f8e72427ec5982be9a7e0cfb16bdd9667b8073a68
MD5 b3cd10742ab1da51683a2e32d3f83bfb
SHA1 c6037e35d16b77bbb01252f9577734349b7da3b1
SHA512 97336d1ca8c5a982f5e9689117d573473c449d8e114cac5344af2866a787a5a0df6f2c221c30b90de1e9bb70d52b9d74fa1106f7585d30e22d21ab4cab7210c1
SSDEEP 192:sxRTi/yM/jK1Ml8wC3/fYsWEPAyAQZ0BH9upFzoA8p9//g6+WNC0s/YnGGhJGiIc:sxRm783/fYszIrO0zuKV/5q/fsB7
TLSH
T1B262C915A6245D7BDCDBD209FA517F93D6F95563A2901E08AAFCCB0C00E7ADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 15add50bf5210c791e5564248e1ea4ca64c107cb48fd8533d1ba268a4e806be5
MD5 bb3cd2ca7c0c1200d016b629a9dc9d64
SHA1 346ee55f377c2107c636d1039445c38b26bfcee1
SHA512 87cda2bc9eec84b60a60dddbb7ce45914624ee247d69716f757b2c0f953371f513060af3736625b03b7166ffdb55a36e5976de805926ade0e4acb371d54235a6
SSDEEP 768:wGedPg7pLuL7X6WgoufDM8F1+UoAYDCx9Tuqh0VfUC9xbog/OV+OOu4Y7roSO80r:wGedPsE7X6WgoufDMu1jaZOOVYI1r
TLSH
T155E2DB3B680CCB7E4F404EDDEC29BE9FADA801CB5AD8895447EA840C03C67EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

29012812-d085-42c0-946c-59a7e6828c6b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\29012812-d085-42c0-946c-59a7e6828c6b.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 d04c9bf2478deb48953ce4be3ad3506fba022765a86118724f029a56b2439632
MD5 2f492b4ade808da8b611e7b8c6c68c7d
SHA1 abf3e11c1707a88211e0f0085c0fb157044254ff
SHA512 4458fa5d0caeb3574940911e58fe49db8ec14966a8dc990fdc83158acb6dbbe83ed715c9e0dbf4288cd8b630de0cf2653314119897b2b23d36c784a9b6fcef35
SSDEEP 768:6rv+4UNbds33hDZIO0oGJNzc4ReyIsXEeVH1S5D:6bsbS35GJtc44bs0EH1Y
TLSH
T10B03DF33E8688977ACF69686B40776537EF8612782D81E94C5DE1F0C4A8B5DD130F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 10616878b854beea143e4f7d1426614c1b64db82d4624ce64f3591868f3ac076
MD5 222afda5600b28d6cc7e49d68cbdffcb
SHA1 834dccedc3a2571598bf82f12658fae9d6477a4a
SHA512 c50ff936bd1b9936850f8d9ea0402d64a7613252d26d93f4b2ccf65f606ee2b29291a04f5cc7702ba1c0be2b1f4c0b7bc1feffea71d609e9caac74b8f18e4fa3
SSDEEP 768:nrv+4UNbdu3j6MSDZIO0oGENNzc4ReyIsPheVH1S5F:nbsbM3jkGWtc44bspEH1W
TLSH
T15313CF32A878CD73ACFAA24AB50776937EF8216781C40E98C9DA5F4C4A471DD171F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 5cbf6ae0de73f688db03af9c342e77a8deeba4032369fbc9bb1cce55070f98ec
MD5 e232f78a682d5b9b5a4e76b765f86e89
SHA1 5a45360c2d4792183ae176962e8f8911d35acb17
SHA512 acb95784e5d9f9e145f93a997d44697806ebb84442d28dcfd67aae3269fe4dd32f6e86ac72c27a817606c2cded0484ec91f05e2f2dafd50a8b7ed605d64b70c4
SSDEEP 768:Uj+9A3f6uSDZIO0oGEhNzc4ReyIsPhb9Mx:D9A3fqGYtc44bspb+x
TLSH
T13FF2B035FC69CD63ACE9924AB5173693BEF521BB81C41E88DADD9F0C098369C075B423
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 42896cef5864d0c0bfd9fd967c9547e360d30e84e0cdc8d2b3bd849bb1424202
MD5 f2f00db9d187c5c6163602053060ad83
SHA1 aa31f17311d9feffe102d49abb2d04ecd88daa49
SHA512 4a393ca882c88ce669dd04fd8d11ae296190bf39d9826e69509ab98120799c70d6cfa7774fcaada24d58fbf38dbcc0ad59f45170e5ee1d9a77d834cb2848c38b
SSDEEP 768:BF1j+9A3mwgc6A7Zw5O0oGEVNzc4ReyIsPhb9Mx:A9A3FXGktc44bspb+x
TLSH
T19F1317F698D78976E89D4787A73E2E42ADFCD167B1885884B7C55E0CCC821BFC30A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

05d200b1-246d-4026-a7b3-33603f6c9664.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\05d200b1-246d-4026-a7b3-33603f6c9664.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1184_1307497458\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 47f6c06ecf4f1a1435c77815d9dc3e7726b020232b644a25f7c51160e40e4a5a
MD5 6fe3e22320db06f32f2308b684b92a0c
SHA1 d140b7125d8e7229d031f2e1804a5f8a918dc44b
SHA512 bad07fc18b83ade001ded97c35d5ef81530c8d682631ef8992042e42fa3007c0c44d71c13de03232eada6a3d5662d08c3e9cf0533f38867484443afbf03d565d
TLSH
T18F71008357A8D6B2C1DE9BF103835644F5BB2238073330200B92598AEB30A7A58B8F08
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1056-486-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1248-453-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1264-280-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1360-413-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1936-310-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2360-393-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2408-344-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2432-503-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2488-474-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3316-64-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3336-340-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4084-325-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4304-193-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4348-319-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4520-437-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5016-240-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5144-373-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5412-471-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5412-448-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5628-417-0x0000000000010000-0x00000000000AB000-memory.dmp

Download