systex | b5d25a6b661f35f3eba51a08b22fb6bd76b03b72f5e3a042837795950c7ce524

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/07/2026, 08:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-13_6cd89961d4f0ef196924ac80b7812291_amadey_darkgate_elex_smoke-loader_stop.exe
Size 384KB
Sample260713-krpreaev9q
SHA256 b5d25a6b661f35f3eba51a08b22fb6bd76b03b72f5e3a042837795950c7ce524
MD5 6cd89961d4f0ef196924ac80b7812291
SHA1 3add556368c61d8381f01a82f4e8e6b82d40fa6d
SHA512 4cae61785b9981ad55b169a439ddb9f90b22ce0f8e83d1f558108e7d5fce8fb682422a62cf2b222a3c85dddfa4f872c57735bf80b048b676fea7de471d04828f
SSDEEP 3072:Q9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:ictFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T198847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
4500	causnkicaxspnkfc.exe
4148	causnkicaxspnkfc.sys
1292	CreateProcess.exe
5104	causpkhcxu.exe
924	CreateProcess.exe
1996	CreateProcess.exe
4160	i_causpkhcxu.exe
4696	zxrpmhfzxu.sys
1052	CreateProcess.exe
256	usmkhcaurm.exe
2416	CreateProcess.exe
3500	CreateProcess.exe
3224	i_usmkhcaurm.exe
3992	bzwrpjhbzt.sys
5060	CreateProcess.exe
4968	urmkecwuom.exe
4596	CreateProcess.exe
5448	CreateProcess.exe
5072	i_urmkecwuom.exe
5092	gebwuomgey.sys
5676	CreateProcess.exe
5988	bwuomgeywq.exe
4344	CreateProcess.exe
4232	CreateProcess.exe
3908	i_bwuomgeywq.exe
3128	ojgbztrlbv.sys
2876	CreateProcess.exe
4364	gaytqljdbv.exe
3532	CreateProcess.exe
3420	CreateProcess.exe
1896	i_gaytqljdbv.exe
4892	trljdbvtol.sys
4556	CreateProcess.exe
5900	aysqlidays.exe
5908	CreateProcess.exe
5336	CreateProcess.exe
5404	i_aysqlidays.exe
4476	tnlfdxvqnl.sys
4996	CreateProcess.exe
4440	idyvqnifay.exe
6020	CreateProcess.exe
4748	CreateProcess.exe
1380	i_idyvqnifay.exe
3064	vpnhfaxvpn.sys
2600	CreateProcess.exe
3704	nkfdxvpnhf.exe
4884	CreateProcess.exe
4316	CreateProcess.exe
2444	i_nkfdxvpnhf.exe
4244	fzxrpkicau.sys
3204	CreateProcess.exe
4984	cxusmkicau.exe
1136	CreateProcess.exe
2012	CreateProcess.exe
1828	i_cxusmkicau.exe
4880	ausmkecxup.sys
5552	CreateProcess.exe
6000	keczusmhfc.exe
4328	CreateProcess.exe
5404	CreateProcess.exe
3208	i_keczusmhfc.exe
4368	mkecwuomhe.sys
2960	CreateProcess.exe
4952	cztrmjhbzu.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_1548606689\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_1548606689\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_1123663218\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_406681106\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_406681106\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_1548606689\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_1548606689\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_1829023204\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1300_1829023204\nav_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwuomgeywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	idyvqnifay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxusmkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cztrmjhbzu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdavsnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdavsnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causpkhcxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gaytqljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keczusmhfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkecomgezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urmkecwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqlidays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_idyvqnifay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cztrmjhbzu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvtnlfdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kicausmkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causnkicaxspnkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkfdxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrmjebwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrmjebwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_upmhezxrpk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-13_6cd89961d4f0ef196924ac80b7812291_amadey_darkgate_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaytqljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cxusmkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbvtolge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvtnlfdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicausmkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_causpkhcxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwuomgeywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmkhcaurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqlidays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbvtolge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlidbvtnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkecomgezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkfdxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_keczusmhfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlidbvtnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upmhezxrpk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmkhcaurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urmkecwuom.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
892	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3460	ipconfig.exe
4548	ipconfig.exe
3836	ipconfig.exe
2188	ipconfig.exe
2576	ipconfig.exe
1252	ipconfig.exe
3284	ipconfig.exe
2124	ipconfig.exe
4148	ipconfig.exe
4736	ipconfig.exe
4420	ipconfig.exe
4592	ipconfig.exe
4784	ipconfig.exe
2988	ipconfig.exe
4892	ipconfig.exe
3840	ipconfig.exe
5564	ipconfig.exe
2128	ipconfig.exe
4228	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134284062293221024"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{316091CB-56B0-4925-A8D9-CD8061E410AD}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3332	2026-07-13_6cd89961d4f0ef196924ac80b7812291_amadey_darkgate_elex_smoke-loader_stop.exe
3332	2026-07-13_6cd89961d4f0ef196924ac80b7812291_amadey_darkgate_elex_smoke-loader_stop.exe
3332	2026-07-13_6cd89961d4f0ef196924ac80b7812291_amadey_darkgate_elex_smoke-loader_stop.exe
3332	2026-07-13_6cd89961d4f0ef196924ac80b7812291_amadey_darkgate_elex_smoke-loader_stop.exe
3332	2026-07-13_6cd89961d4f0ef196924ac80b7812291_amadey_darkgate_elex_smoke-loader_stop.exe
3332	2026-07-13_6cd89961d4f0ef196924ac80b7812291_amadey_darkgate_elex_smoke-loader_stop.exe
3332	2026-07-13_6cd89961d4f0ef196924ac80b7812291_amadey_darkgate_elex_smoke-loader_stop.exe
3332	2026-07-13_6cd89961d4f0ef196924ac80b7812291_amadey_darkgate_elex_smoke-loader_stop.exe
3332	2026-07-13_6cd89961d4f0ef196924ac80b7812291_amadey_darkgate_elex_smoke-loader_stop.exe
3332	2026-07-13_6cd89961d4f0ef196924ac80b7812291_amadey_darkgate_elex_smoke-loader_stop.exe
3332	2026-07-13_6cd89961d4f0ef196924ac80b7812291_amadey_darkgate_elex_smoke-loader_stop.exe
3332	2026-07-13_6cd89961d4f0ef196924ac80b7812291_amadey_darkgate_elex_smoke-loader_stop.exe
3332	2026-07-13_6cd89961d4f0ef196924ac80b7812291_amadey_darkgate_elex_smoke-loader_stop.exe
3332	2026-07-13_6cd89961d4f0ef196924ac80b7812291_amadey_darkgate_elex_smoke-loader_stop.exe
3332	2026-07-13_6cd89961d4f0ef196924ac80b7812291_amadey_darkgate_elex_smoke-loader_stop.exe
3332	2026-07-13_6cd89961d4f0ef196924ac80b7812291_amadey_darkgate_elex_smoke-loader_stop.exe
3332	2026-07-13_6cd89961d4f0ef196924ac80b7812291_amadey_darkgate_elex_smoke-loader_stop.exe
3332	2026-07-13_6cd89961d4f0ef196924ac80b7812291_amadey_darkgate_elex_smoke-loader_stop.exe
3332	2026-07-13_6cd89961d4f0ef196924ac80b7812291_amadey_darkgate_elex_smoke-loader_stop.exe
3332	2026-07-13_6cd89961d4f0ef196924ac80b7812291_amadey_darkgate_elex_smoke-loader_stop.exe
3332	2026-07-13_6cd89961d4f0ef196924ac80b7812291_amadey_darkgate_elex_smoke-loader_stop.exe
3332	2026-07-13_6cd89961d4f0ef196924ac80b7812291_amadey_darkgate_elex_smoke-loader_stop.exe
3332	2026-07-13_6cd89961d4f0ef196924ac80b7812291_amadey_darkgate_elex_smoke-loader_stop.exe
3332	2026-07-13_6cd89961d4f0ef196924ac80b7812291_amadey_darkgate_elex_smoke-loader_stop.exe
3332	2026-07-13_6cd89961d4f0ef196924ac80b7812291_amadey_darkgate_elex_smoke-loader_stop.exe
3332	2026-07-13_6cd89961d4f0ef196924ac80b7812291_amadey_darkgate_elex_smoke-loader_stop.exe
3332	2026-07-13_6cd89961d4f0ef196924ac80b7812291_amadey_darkgate_elex_smoke-loader_stop.exe
3332	2026-07-13_6cd89961d4f0ef196924ac80b7812291_amadey_darkgate_elex_smoke-loader_stop.exe
3332	2026-07-13_6cd89961d4f0ef196924ac80b7812291_amadey_darkgate_elex_smoke-loader_stop.exe
3332	2026-07-13_6cd89961d4f0ef196924ac80b7812291_amadey_darkgate_elex_smoke-loader_stop.exe
3332	2026-07-13_6cd89961d4f0ef196924ac80b7812291_amadey_darkgate_elex_smoke-loader_stop.exe
3332	2026-07-13_6cd89961d4f0ef196924ac80b7812291_amadey_darkgate_elex_smoke-loader_stop.exe
3332	2026-07-13_6cd89961d4f0ef196924ac80b7812291_amadey_darkgate_elex_smoke-loader_stop.exe
3332	2026-07-13_6cd89961d4f0ef196924ac80b7812291_amadey_darkgate_elex_smoke-loader_stop.exe
3332	2026-07-13_6cd89961d4f0ef196924ac80b7812291_amadey_darkgate_elex_smoke-loader_stop.exe
3332	2026-07-13_6cd89961d4f0ef196924ac80b7812291_amadey_darkgate_elex_smoke-loader_stop.exe
3332	2026-07-13_6cd89961d4f0ef196924ac80b7812291_amadey_darkgate_elex_smoke-loader_stop.exe
3332	2026-07-13_6cd89961d4f0ef196924ac80b7812291_amadey_darkgate_elex_smoke-loader_stop.exe
3332	2026-07-13_6cd89961d4f0ef196924ac80b7812291_amadey_darkgate_elex_smoke-loader_stop.exe
3332	2026-07-13_6cd89961d4f0ef196924ac80b7812291_amadey_darkgate_elex_smoke-loader_stop.exe
3332	2026-07-13_6cd89961d4f0ef196924ac80b7812291_amadey_darkgate_elex_smoke-loader_stop.exe
3332	2026-07-13_6cd89961d4f0ef196924ac80b7812291_amadey_darkgate_elex_smoke-loader_stop.exe
3332	2026-07-13_6cd89961d4f0ef196924ac80b7812291_amadey_darkgate_elex_smoke-loader_stop.exe
3332	2026-07-13_6cd89961d4f0ef196924ac80b7812291_amadey_darkgate_elex_smoke-loader_stop.exe
3332	2026-07-13_6cd89961d4f0ef196924ac80b7812291_amadey_darkgate_elex_smoke-loader_stop.exe
3332	2026-07-13_6cd89961d4f0ef196924ac80b7812291_amadey_darkgate_elex_smoke-loader_stop.exe
3332	2026-07-13_6cd89961d4f0ef196924ac80b7812291_amadey_darkgate_elex_smoke-loader_stop.exe
3332	2026-07-13_6cd89961d4f0ef196924ac80b7812291_amadey_darkgate_elex_smoke-loader_stop.exe
3332	2026-07-13_6cd89961d4f0ef196924ac80b7812291_amadey_darkgate_elex_smoke-loader_stop.exe
3332	2026-07-13_6cd89961d4f0ef196924ac80b7812291_amadey_darkgate_elex_smoke-loader_stop.exe
3332	2026-07-13_6cd89961d4f0ef196924ac80b7812291_amadey_darkgate_elex_smoke-loader_stop.exe
3332	2026-07-13_6cd89961d4f0ef196924ac80b7812291_amadey_darkgate_elex_smoke-loader_stop.exe
3332	2026-07-13_6cd89961d4f0ef196924ac80b7812291_amadey_darkgate_elex_smoke-loader_stop.exe
3332	2026-07-13_6cd89961d4f0ef196924ac80b7812291_amadey_darkgate_elex_smoke-loader_stop.exe
3332	2026-07-13_6cd89961d4f0ef196924ac80b7812291_amadey_darkgate_elex_smoke-loader_stop.exe
3332	2026-07-13_6cd89961d4f0ef196924ac80b7812291_amadey_darkgate_elex_smoke-loader_stop.exe
4500	causnkicaxspnkfc.exe
4500	causnkicaxspnkfc.exe
4500	causnkicaxspnkfc.exe
4500	causnkicaxspnkfc.exe
4500	causnkicaxspnkfc.exe
4500	causnkicaxspnkfc.exe
4500	causnkicaxspnkfc.exe
4500	causnkicaxspnkfc.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	4160	i_causpkhcxu.exe
Token: SeDebugPrivilege	3224	i_usmkhcaurm.exe
Token: SeDebugPrivilege	5072	i_urmkecwuom.exe
Token: SeDebugPrivilege	3908	i_bwuomgeywq.exe
Token: SeDebugPrivilege	1896	i_gaytqljdbv.exe
Token: SeDebugPrivilege	5404	i_aysqlidays.exe
Token: SeDebugPrivilege	1380	i_idyvqnifay.exe
Token: SeDebugPrivilege	2444	i_nkfdxvpnhf.exe
Token: SeDebugPrivilege	1828	i_cxusmkicau.exe
Token: SeDebugPrivilege	3208	i_keczusmhfc.exe
Token: SeDebugPrivilege	1380	i_cztrmjhbzu.exe
Token: SeDebugPrivilege	4820	i_bztrmjebwu.exe
Token: SeDebugPrivilege	2208	i_ljdbvtolge.exe
Token: SeDebugPrivilege	1364	i_nlidbvtnlg.exe
Token: SeDebugPrivilege	2436	i_yvtnlfdyvq.exe
Token: SeDebugPrivilege	2240	i_fdavsnlfdx.exe
Token: SeDebugPrivilege	3152	i_kicausmkfc.exe
Token: SeDebugPrivilege	2736	i_upmhezxrpk.exe
Token: SeDebugPrivilege	4964	i_mkecomgezw.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1300	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3332 wrote to memory of 4500	3332	2026-07-13_6cd89961d4f0ef196924ac80b7812291_amadey_darkgate_elex_smoke-loader_stop.exe	86
PID 3332 wrote to memory of 612	3332	2026-07-13_6cd89961d4f0ef196924ac80b7812291_amadey_darkgate_elex_smoke-loader_stop.exe	87
PID 612 wrote to memory of 1300	612	iexplore.exe	88
PID 1300 wrote to memory of 5680	1300	msedge.exe	89
PID 1300 wrote to memory of 1720	1300	msedge.exe	90
PID 1300 wrote to memory of 892	1300	msedge.exe	91
PID 1300 wrote to memory of 1720	1300	msedge.exe	90
PID 1300 wrote to memory of 1720	1300	msedge.exe	90
PID 1300 wrote to memory of 3512	1300	msedge.exe	92
PID 1300 wrote to memory of 3512	1300	msedge.exe	92
PID 1300 wrote to memory of 3488	1300	msedge.exe	95
PID 1300 wrote to memory of 2196	1300	msedge.exe	94
PID 1300 wrote to memory of 3488	1300	msedge.exe	95
PID 1300 wrote to memory of 3488	1300	msedge.exe	95
PID 1300 wrote to memory of 2196	1300	msedge.exe	94
PID 1300 wrote to memory of 2196	1300	msedge.exe	94
PID 1300 wrote to memory of 4992	1300	msedge.exe	96
PID 1300 wrote to memory of 4992	1300	msedge.exe	96
PID 1300 wrote to memory of 4992	1300	msedge.exe	96
PID 1300 wrote to memory of 5584	1300	msedge.exe	97
PID 1300 wrote to memory of 5584	1300	msedge.exe	97
PID 1300 wrote to memory of 5584	1300	msedge.exe	97
PID 1300 wrote to memory of 5884	1300	msedge.exe	98
PID 1300 wrote to memory of 5884	1300	msedge.exe	98
PID 4500 wrote to memory of 1292	4500	causnkicaxspnkfc.exe	102
PID 5104 wrote to memory of 924	5104	causpkhcxu.exe	105
PID 1300 wrote to memory of 3448	1300	msedge.exe	108
PID 1300 wrote to memory of 3448	1300	msedge.exe	108
PID 1300 wrote to memory of 5732	1300	msedge.exe	109
PID 1300 wrote to memory of 5732	1300	msedge.exe	109
PID 1300 wrote to memory of 2604	1300	msedge.exe	111
PID 1300 wrote to memory of 2060	1300	msedge.exe	112
PID 1300 wrote to memory of 2060	1300	msedge.exe	112
PID 1300 wrote to memory of 2028	1300	msedge.exe	115
PID 1300 wrote to memory of 2028	1300	msedge.exe	115
PID 4500 wrote to memory of 1996	4500	causnkicaxspnkfc.exe	117
PID 4500 wrote to memory of 1052	4500	causnkicaxspnkfc.exe	121
PID 256 wrote to memory of 2416	256	usmkhcaurm.exe	123
PID 4500 wrote to memory of 3500	4500	causnkicaxspnkfc.exe	126
PID 4500 wrote to memory of 5060	4500	causnkicaxspnkfc.exe	130
PID 4968 wrote to memory of 4596	4968	urmkecwuom.exe	132
PID 4500 wrote to memory of 5448	4500	causnkicaxspnkfc.exe	135
PID 1300 wrote to memory of 2324	1300	msedge.exe	139
PID 1300 wrote to memory of 2324	1300	msedge.exe	139
PID 1300 wrote to memory of 2324	1300	msedge.exe	139
PID 1300 wrote to memory of 4980	1300	msedge.exe	141
PID 1300 wrote to memory of 4980	1300	msedge.exe	141
PID 1300 wrote to memory of 4980	1300	msedge.exe	141
PID 4500 wrote to memory of 5676	4500	causnkicaxspnkfc.exe	142
PID 5988 wrote to memory of 4344	5988	bwuomgeywq.exe	144
PID 4500 wrote to memory of 4232	4500	causnkicaxspnkfc.exe	147
PID 1300 wrote to memory of 2984	1300	msedge.exe	149
PID 1300 wrote to memory of 4600	1300	msedge.exe	150
PID 1300 wrote to memory of 5884	1300	msedge.exe	151
PID 4500 wrote to memory of 2876	4500	causnkicaxspnkfc.exe	154
PID 4364 wrote to memory of 3532	4364	gaytqljdbv.exe	156
PID 4500 wrote to memory of 3420	4500	causnkicaxspnkfc.exe	159
PID 4500 wrote to memory of 4556	4500	causnkicaxspnkfc.exe	163
PID 5900 wrote to memory of 5908	5900	aysqlidays.exe	165
PID 4500 wrote to memory of 5336	4500	causnkicaxspnkfc.exe	168
PID 4500 wrote to memory of 4996	4500	causnkicaxspnkfc.exe	172
PID 4440 wrote to memory of 6020	4440	idyvqnifay.exe	174
PID 4500 wrote to memory of 4748	4500	causnkicaxspnkfc.exe	177
PID 4500 wrote to memory of 2600	4500	causnkicaxspnkfc.exe	181

C:\Users\Admin\AppData\Local\Temp\2026-07-13_6cd89961d4f0ef196924ac80b7812291_amadey_darkgate_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-13_6cd89961d4f0ef196924ac80b7812291_amadey_darkgate_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3332
- C:\Temp\causnkicaxspnkfc.exe
  C:\Temp\causnkicaxspnkfc.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4500
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\causpkhcxu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1292
  - - C:\Temp\causpkhcxu.exe
      C:\Temp\causpkhcxu.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5104
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:924
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3460
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_causpkhcxu.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1996
  - - C:\Temp\i_causpkhcxu.exe
      C:\Temp\i_causpkhcxu.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4160
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\usmkhcaurm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1052
  - - C:\Temp\usmkhcaurm.exe
      C:\Temp\usmkhcaurm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:256
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2416
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3284
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_usmkhcaurm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3500
  - - C:\Temp\i_usmkhcaurm.exe
      C:\Temp\i_usmkhcaurm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3224
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\urmkecwuom.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5060
  - - C:\Temp\urmkecwuom.exe
      C:\Temp\urmkecwuom.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4968
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4596
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2124
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_urmkecwuom.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5448
  - - C:\Temp\i_urmkecwuom.exe
      C:\Temp\i_urmkecwuom.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5072
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bwuomgeywq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5676
  - - C:\Temp\bwuomgeywq.exe
      C:\Temp\bwuomgeywq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5988
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4344
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4548
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bwuomgeywq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4232
  - - C:\Temp\i_bwuomgeywq.exe
      C:\Temp\i_bwuomgeywq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3908
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gaytqljdbv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2876
  - - C:\Temp\gaytqljdbv.exe
      C:\Temp\gaytqljdbv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4364
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3532
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4592
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gaytqljdbv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3420
  - - C:\Temp\i_gaytqljdbv.exe
      C:\Temp\i_gaytqljdbv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1896
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\aysqlidays.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4556
  - - C:\Temp\aysqlidays.exe
      C:\Temp\aysqlidays.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5900
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5908
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3836
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_aysqlidays.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5336
  - - C:\Temp\i_aysqlidays.exe
      C:\Temp\i_aysqlidays.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5404
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\idyvqnifay.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4996
  - - C:\Temp\idyvqnifay.exe
      C:\Temp\idyvqnifay.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4440
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6020
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4784
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_idyvqnifay.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4748
  - - C:\Temp\i_idyvqnifay.exe
      C:\Temp\i_idyvqnifay.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1380
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nkfdxvpnhf.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2600
  - - C:\Temp\nkfdxvpnhf.exe
      C:\Temp\nkfdxvpnhf.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3704
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4884
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4148
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nkfdxvpnhf.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4316
  - - C:\Temp\i_nkfdxvpnhf.exe
      C:\Temp\i_nkfdxvpnhf.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2444
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cxusmkicau.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3204
  - - C:\Temp\cxusmkicau.exe
      C:\Temp\cxusmkicau.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4984
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1136
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2988
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cxusmkicau.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2012
  - - C:\Temp\i_cxusmkicau.exe
      C:\Temp\i_cxusmkicau.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1828
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\keczusmhfc.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5552
  - - C:\Temp\keczusmhfc.exe
      C:\Temp\keczusmhfc.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:6000
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4328
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2128
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_keczusmhfc.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5404
  - - C:\Temp\i_keczusmhfc.exe
      C:\Temp\i_keczusmhfc.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3208
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cztrmjhbzu.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2960
  - - C:\Temp\cztrmjhbzu.exe
      C:\Temp\cztrmjhbzu.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4952
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3548
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4736
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cztrmjhbzu.exe ups_ins
    3⤵
    PID:4372
  - - C:\Temp\i_cztrmjhbzu.exe
      C:\Temp\i_cztrmjhbzu.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1380
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bztrmjebwu.exe ups_run
    3⤵
    PID:3188
  - - C:\Temp\bztrmjebwu.exe
      C:\Temp\bztrmjebwu.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1304
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3156
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2188
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bztrmjebwu.exe ups_ins
    3⤵
    PID:5936
  - - C:\Temp\i_bztrmjebwu.exe
      C:\Temp\i_bztrmjebwu.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4820
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljdbvtolge.exe ups_run
    3⤵
    PID:4536
  - - C:\Temp\ljdbvtolge.exe
      C:\Temp\ljdbvtolge.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1468
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5224
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4892
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljdbvtolge.exe ups_ins
    3⤵
    PID:5996
  - - C:\Temp\i_ljdbvtolge.exe
      C:\Temp\i_ljdbvtolge.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2208
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nlidbvtnlg.exe ups_run
    3⤵
    PID:1316
  - - C:\Temp\nlidbvtnlg.exe
      C:\Temp\nlidbvtnlg.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4704
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4840
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2576
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nlidbvtnlg.exe ups_ins
    3⤵
    PID:2752
  - - C:\Temp\i_nlidbvtnlg.exe
      C:\Temp\i_nlidbvtnlg.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1364
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\yvtnlfdyvq.exe ups_run
    3⤵
    PID:4792
  - - C:\Temp\yvtnlfdyvq.exe
      C:\Temp\yvtnlfdyvq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4864
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1672
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4420
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_yvtnlfdyvq.exe ups_ins
    3⤵
    PID:1536
  - - C:\Temp\i_yvtnlfdyvq.exe
      C:\Temp\i_yvtnlfdyvq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2436
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fdavsnlfdx.exe ups_run
    3⤵
    PID:2708
  - - C:\Temp\fdavsnlfdx.exe
      C:\Temp\fdavsnlfdx.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1160
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3372
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1252
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fdavsnlfdx.exe ups_ins
    3⤵
    PID:4468
  - - C:\Temp\i_fdavsnlfdx.exe
      C:\Temp\i_fdavsnlfdx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2240
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kicausmkfc.exe ups_run
    3⤵
    PID:3136
  - - C:\Temp\kicausmkfc.exe
      C:\Temp\kicausmkfc.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1036
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2208
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3840
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kicausmkfc.exe ups_ins
    3⤵
    PID:4676
  - - C:\Temp\i_kicausmkfc.exe
      C:\Temp\i_kicausmkfc.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3152
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\upmhezxrpk.exe ups_run
    3⤵
    PID:4188
  - - C:\Temp\upmhezxrpk.exe
      C:\Temp\upmhezxrpk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1296
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4472
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5564
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_upmhezxrpk.exe ups_ins
    3⤵
    PID:4376
  - - C:\Temp\i_upmhezxrpk.exe
      C:\Temp\i_upmhezxrpk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2736
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mkecomgezw.exe ups_run
    3⤵
    PID:4644
  - - C:\Temp\mkecomgezw.exe
      C:\Temp\mkecomgezw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3376
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5140
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4228
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mkecomgezw.exe ups_ins
    3⤵
    PID:4036
  - - C:\Temp\i_mkecomgezw.exe
      C:\Temp\i_mkecomgezw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4964
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ff917d3c188,0x7ff917d3c194,0x7ff917d3c1a0
      4⤵
      PID:5680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,17941616318016063947,14039048540919983323,262144 --field-trial-handle=2720,i,15757431119739754121,10179922050431838387,262144 --variations-seed-version --mojo-platform-channel-handle=2716 /prefetch:2
      4⤵
      PID:1720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=1944,i,15130139428180118292,5534149479849585128,524288 --field-trial-handle=2720,i,15757431119739754121,10179922050431838387,262144 --variations-seed-version --mojo-platform-channel-handle=2968 /prefetch:11
      4⤵
      System Time Discovery
      PID:892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=2308,i,12816813800528612460,16718682144474623892,524288 --field-trial-handle=2720,i,15757431119739754121,10179922050431838387,262144 --variations-seed-version --mojo-platform-channel-handle=1972 /prefetch:13
      4⤵
      PID:3512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3600,i,14717561652175877427,2454830134132447200,2097152 --field-trial-handle=2720,i,15757431119739754121,10179922050431838387,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
      4⤵
      PID:2196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3612,i,13561291127225668141,7495746175958740995,2097152 --field-trial-handle=2720,i,15757431119739754121,10179922050431838387,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
      4⤵
      PID:3488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4356,i,14368491218543844667,653383085442357612,2097152 --field-trial-handle=2720,i,15757431119739754121,10179922050431838387,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:1
      4⤵
      PID:4992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4368,i,11078710069469541721,6606867515521020800,2097152 --field-trial-handle=2720,i,15757431119739754121,10179922050431838387,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:9
      4⤵
      PID:5584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5380,i,8480198173812108342,8533167725600441880,524288 --field-trial-handle=2720,i,15757431119739754121,10179922050431838387,262144 --variations-seed-version --mojo-platform-channel-handle=3892 /prefetch:14
      4⤵
      PID:5884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=3876,i,11051950664926702854,14348732920752806563,524288 --field-trial-handle=2720,i,15757431119739754121,10179922050431838387,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:14
      4⤵
      PID:3448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5396,i,16897879541412519876,13359737290701224156,524288 --field-trial-handle=2720,i,15757431119739754121,10179922050431838387,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:14
      4⤵
      PID:5732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6140,i,13772575841060710699,17190176081298930043,524288 --field-trial-handle=2720,i,15757431119739754121,10179922050431838387,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:14
      4⤵
      PID:4040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6140,i,13772575841060710699,17190176081298930043,524288 --field-trial-handle=2720,i,15757431119739754121,10179922050431838387,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:14
      4⤵
      PID:2604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6316,i,5994112936180920627,15849359395532812944,524288 --field-trial-handle=2720,i,15757431119739754121,10179922050431838387,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:14
      4⤵
      PID:2060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6364,i,17586230306359464602,10182338746242924049,524288 --field-trial-handle=2720,i,15757431119739754121,10179922050431838387,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:14
      4⤵
      PID:2028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6068,i,12817328549694562571,9560054493607377103,2097152 --field-trial-handle=2720,i,15757431119739754121,10179922050431838387,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:1
      4⤵
      PID:2324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5044,i,6214164024391759403,843509390561546077,2097152 --field-trial-handle=2720,i,15757431119739754121,10179922050431838387,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:1
      4⤵
      PID:4980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=3776,i,15690178788197553503,4660769414011423161,524288 --field-trial-handle=2720,i,15757431119739754121,10179922050431838387,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:14
      4⤵
      PID:2984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4560,i,12160746070751621918,12800773752064362328,524288 --field-trial-handle=2720,i,15757431119739754121,10179922050431838387,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:14
      4⤵
      PID:4600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6652,i,9233660726200756261,1975420019788910805,524288 --field-trial-handle=2720,i,15757431119739754121,10179922050431838387,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:14
      4⤵
      PID:5884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5728,i,8734737110783318813,72201402332098939,524288 --field-trial-handle=2720,i,15757431119739754121,10179922050431838387,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:14
      4⤵
      PID:3116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=2636,i,1951552214741531864,6751555335833205623,524288 --field-trial-handle=2720,i,15757431119739754121,10179922050431838387,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:14
      4⤵
      PID:3092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=3772,i,14115446298611776872,16676410899675709169,524288 --field-trial-handle=2720,i,15757431119739754121,10179922050431838387,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:14
      4⤵
      PID:2444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=924,i,9125770665148420851,16232772303558127829,524288 --field-trial-handle=2720,i,15757431119739754121,10179922050431838387,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:14
      4⤵
      PID:2248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3752,i,5906029865171632802,13959692922234412448,262144 --field-trial-handle=2720,i,15757431119739754121,10179922050431838387,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:10
      4⤵
      PID:5932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5360,i,11993949824663404145,4844311372727839941,524288 --field-trial-handle=2720,i,15757431119739754121,10179922050431838387,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:14
      4⤵
      PID:3660

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1272

C:\Temp\causnkicaxspnkfc.sys
C:\Temp\causnkicaxspnkfc.sys
1⤵
- Executes dropped EXE
PID:4148

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:992

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4348

C:\Temp\zxrpmhfzxu.sys
C:\Temp\zxrpmhfzxu.sys
1⤵
- Executes dropped EXE
PID:4696

C:\Temp\bzwrpjhbzt.sys
C:\Temp\bzwrpjhbzt.sys
1⤵
- Executes dropped EXE
PID:3992

C:\Temp\gebwuomgey.sys
C:\Temp\gebwuomgey.sys
1⤵
- Executes dropped EXE
PID:5092

C:\Temp\ojgbztrlbv.sys
C:\Temp\ojgbztrlbv.sys
1⤵
- Executes dropped EXE
PID:3128

C:\Temp\trljdbvtol.sys
C:\Temp\trljdbvtol.sys
1⤵
- Executes dropped EXE
PID:4892

C:\Temp\tnlfdxvqnl.sys
C:\Temp\tnlfdxvqnl.sys
1⤵
- Executes dropped EXE
PID:4476

C:\Temp\vpnhfaxvpn.sys
C:\Temp\vpnhfaxvpn.sys
1⤵
- Executes dropped EXE
PID:3064

C:\Temp\fzxrpkicau.sys
C:\Temp\fzxrpkicau.sys
1⤵
- Executes dropped EXE
PID:4244

C:\Temp\ausmkecxup.sys
C:\Temp\ausmkecxup.sys
1⤵
- Executes dropped EXE
PID:4880

C:\Temp\mkecwuomhe.sys
C:\Temp\mkecwuomhe.sys
1⤵
- Executes dropped EXE
PID:4368

C:\Temp\jhbzwrojhb.sys
C:\Temp\jhbzwrojhb.sys
1⤵
PID:4600

C:\Temp\toljdbwqol.sys
C:\Temp\toljdbwqol.sys
1⤵
PID:2928

C:\Temp\eywqoigayt.sys
C:\Temp\eywqoigayt.sys
1⤵
PID:4912

C:\Temp\igaysqkida.sys
C:\Temp\igaysqkida.sys
1⤵
PID:4188

C:\Temp\qnifaysqki.sys
C:\Temp\qnifaysqki.sys
1⤵
PID:2304

C:\Temp\vpnkfaxvpn.sys
C:\Temp\vpnkfaxvpn.sys
1⤵
PID:5092

C:\Temp\kecxupnhxr.sys
C:\Temp\kecxupnhxr.sys
1⤵
PID:3440

C:\Temp\urmjhczxrp.sys
C:\Temp\urmjhczxrp.sys
1⤵
PID:2300

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aysqlidays.exe

Path C:\Temp\aysqlidays.exe
Size 384KB
SHA256 827f3de6ae4a238ff497697631d45c65412a8403d4b3a7c1582670a156ab0f4b
MD5 754316bc0e94f02ec43594f62aeb4f68
SHA1 c05bc09469c930f5105b418dcc9aa746f8e48700
SHA512 7a408a2db4faacc4613f7234fda2a4015130abbb4035b84ae827c7bf4a67c2876192747013f0e61d91a4012a5c1a7425b43fca16b6616abf1c5b0e025cd2b05b
SSDEEP 3072:K9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:wctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T13E847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bwuomgeywq.exe

Path C:\Temp\bwuomgeywq.exe
Size 384KB
SHA256 c14039e80a53c58537dc1fe1e94a45a57325f4781b8260bf0c2ae7c71dacc9ee
MD5 13064dd67cd0a58218acbdbd868892b0
SHA1 133eeea4ba2e2ddce7c3b8dbb7de8e06632598a4
SHA512 d81cb52fed97d89894d7e0982d3751f02d13e56f46f4f1aeee18d5db68e7e4d6203223e8d929d8407b318cde71d8cdea45fcdbf7a4089002493422ce312de848
SSDEEP 3072:c9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:mctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T124847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bzwrpjhbzt.sys

Path C:\Temp\bzwrpjhbzt.sys
Size 293KB
SHA256 28e30905d927c8bcbefd3f77fce3cac10f32bff92119cf226b1112d45ffe47c2
MD5 bfce9c275b4b6358081f31c4dbf3bae8
SHA1 a16b4660c1ccbc43813dc4151d898b2ab5f4f007
SHA512 b0ec36379049d6c49de3e43ebdbcd98870aea24751ff9879dbe0ebfce50246eaeab663bc934f04e105f04c1422f41a8c1ca5816f5a728dd03ef828f1ad901ef1
SSDEEP 3072:etKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:eIJjiJcbI03GBc3ucY5DCSj
TLSH
T1ED545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

causnkicaxspnkfc.exe

Path C:\Temp\causnkicaxspnkfc.exe
Size 384KB
SHA256 57cc50dcaeb249203addc5aa3ad827c00c9df8f86f1df1207d56af81a8500912
MD5 896172d82f3a80b66e3c83eeef016ca0
SHA1 9910a87027a4ef7649bd6c6ff319ca48f600505d
SHA512 c862eafde27546d211540d3aff6951d82356af283f9212c81244a3e3b2c402d5410508f8d1ff0f0d9c8a781d059a1cfe459807f69c91751de0c9188f6a1ed9f5
SSDEEP 3072:V9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:3ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T164847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

causnkicaxspnkfc.sys

Path C:\Temp\causnkicaxspnkfc.sys
Size 293KB
SHA256 da3ed44b508e8d52eee27c974da92781b053d433c12f210700a9115f6310197a
MD5 d3950a7640067ef6c2a6b079270ac3ed
SHA1 0e9473cd4b62d9c57255cf3e46cbba3a28309566
SHA512 7f302117bffacdda177ba9529518862d467f031b55416d5b81b6f343d28be0ea0479267bf1185f16d56e64598b760e9f55959f71a80394453a84ec846d72d1a3
SSDEEP 3072:JtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:JIJjiJcbI03GBc3ucY5DCSj
TLSH
T179545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

causpkhcxu.exe

Path C:\Temp\causpkhcxu.exe
Size 384KB
SHA256 359e2e7f60451d96531de56f012ee7b7995d51f33471cf2a7ef133a7fee44232
MD5 938e3200c09f82a9ea65e5e4f97bd3d5
SHA1 6840e2b3f64e4b473c97862de128cd3733cb1f0f
SHA512 7d81007ce6db1ab5ca5e594cfa000ca22c56b22dd6526943967663140740d464d17466fba6addf2a80e4f27af561ca8ab2a541164661556654d2966121c5c0e0
SSDEEP 3072:g9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:yctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B0847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gaytqljdbv.exe

Path C:\Temp\gaytqljdbv.exe
Size 384KB
SHA256 7ba547cf794163c81a30f26d26a23ae2f2e46b9163149e08c12d289dfbe03083
MD5 c498f280d06b6e8b6f7f2a7d617ee410
SHA1 d4bee32d553d34d1108fcd49ba1d7c6f46ae7787
SHA512 c95d032c4aaba44dc877cffaf4679d0242405a15892f36929535e811d441925e376f9504acbffacf0313cfd3f6d798d1b05c06e50a79d82ddd0a2d36100a2d3c
SSDEEP 3072:m9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:UctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T139847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gebwuomgey.sys

Path C:\Temp\gebwuomgey.sys
Size 293KB
SHA256 074f8060e896e358345840efa281507e5e94d6c92ad227029c9c9a6a13a7529f
MD5 07075a26e3b90296d08ada161fa2c9cf
SHA1 e5a3e5db8467b6584dc52b6ea0fab47317e82dad
SHA512 11d4f4d4199004e7809cd8c61fa5070b7bb4dc79b8e280424581a4313964e93b96e7ad845e391b89cee27ddf6cdc45d49eb1e84c6f407e9e63ccb4972f9423c7
SSDEEP 3072:KtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:KIJjiJcbI03GBc3ucY5DCSj
TLSH
T160545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bwuomgeywq.exe

Path C:\Temp\i_bwuomgeywq.exe
Size 384KB
SHA256 d94af8506069ca499dae186d51af75bec8222f7a03c58e25833b2e1dc24a7c95
MD5 f55b82e4dbb341588293969f0709fcdd
SHA1 c0142816c9ffc85b04bdd286564fe3642904e65b
SHA512 6a7062a0465d7b31fb640b4a9f1fe64ba82306e67fe0dfddcca85a6293c13eb04bc11c0ca407dab08fb93fd2c4a52b874ab0acaf4019cdcdfd566e16e7be3efa
SSDEEP 3072:g9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:yctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T14E846A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_causpkhcxu.exe

Path C:\Temp\i_causpkhcxu.exe
Size 384KB
SHA256 efdfe9cb240db14a8d1e4a4f7685ddf024e95bde2e6742c5be503b2611099c44
MD5 42ca902fbca384b4c91a5e8e4c3cbe0e
SHA1 c41c334ab5443de0b290c83612ce3b927fad2533
SHA512 41d7c1ffb8c71ed5f33858b5a8d35b8400867c82355f8797b5ce0d8849de6a618bba48a53f51669fd616a40f1153280b7bb1eb6bbe806439a4d8c22bd64f1fa6
SSDEEP 3072:p9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:DctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T18E847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gaytqljdbv.exe

Path C:\Temp\i_gaytqljdbv.exe
Size 384KB
SHA256 bfe17d45c9e89b4c8291d4136fe2808119747c0f052e4ed8d3e321854563f030
MD5 ed85f928d8c9e9d898272720670cc204
SHA1 8d0d0b24d68b4c0160735fdc38486a971d6a5d99
SHA512 38f739b64383cc2c440bc86d2799141e3eaf476c6be467a289f2763b11228ebe7780cd0edcfd931ec45f150f46b16103d809c772fea430d8d3c3f3083568ff21
SSDEEP 3072:Y9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:actFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T140847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_urmkecwuom.exe

Path C:\Temp\i_urmkecwuom.exe
Size 384KB
SHA256 c8edd74c4233095d661b010b5a12258fa4761e137ec5dada9395dc5a17f93e51
MD5 a3a3429f4ed91efcf43aa46d11d29abb
SHA1 ce70191720b4122c654ce169fbb31a21d873f78d
SHA512 8739a3a043f87d290c15948d2270ce3093f3dd8e4c22d8a02dfbd192c309049f009d4432fd612fd7de07b5cc0364c2d5561bfb4914c79234e6bf0d60c6612144
SSDEEP 3072:A9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:SctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B9847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_usmkhcaurm.exe

Path C:\Temp\i_usmkhcaurm.exe
Size 384KB
SHA256 acaad696e7e7c597163624a53da0d46feb4614facbe7a5b8d152116127d8a692
MD5 3531630ed5bd7083e716f87465f15f9b
SHA1 b232d99d2850e78093b76524d089987bc76d9ac4
SHA512 093ac6f027032943e851df40e0127415b377a28ce888bb2a6c4e301a7b4b20b2410695545e3b4580fd8029ab66e1ddbf0a3e6a7cc37bb84dd1efbfb11eb816d1
SSDEEP 3072:h9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:rctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T159847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ojgbztrlbv.sys

Path C:\Temp\ojgbztrlbv.sys
Size 293KB
SHA256 2b15e57a66de018623113e8f2e9dfe12125ce2f1984e3ad8aee0efc2b676316d
MD5 7ce04954d14978179e623442ed57f7d2
SHA1 94b7d284c7a384b3f149112d68c27214c7a0957f
SHA512 d8a5f844642f513bea6bc0af9c5e6d8d42f6aa0811634d9ac8bf7f72bcaf134ef78ad885ad9231fea00d98a41068b926849d1b88b69a6111fdc6bc583d4d56a3
SSDEEP 3072:VtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:VIJjiJcbI03GBc3ucY5DCSj
TLSH
T150545B44AAA4B0F6D9D5043C40EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trljdbvtol.sys

Path C:\Temp\trljdbvtol.sys
Size 293KB
SHA256 c165e1f62fe1febb6ea3eedc2948a6a6c2f1f52339e09831ab653f295466ee37
MD5 f44ec85137a71a7b50f72426b1e4cd22
SHA1 779d128900bae89ca3337319885edfb3bc0edcb9
SHA512 f25a13c345e5b91a6e709f3e1451f261eb4409f2ef861eb5e71901e7155c28d13f7c6f4075ce0fb349ff2bdded4540e572f54b7207fe46865f20cd0f58fc3de2
SSDEEP 3072:GtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:GIJjiJcbI03GBc3ucY5DCSj
TLSH
T10D545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urmkecwuom.exe

Path C:\Temp\urmkecwuom.exe
Size 384KB
SHA256 a5af752048b681ad6ea9e7945152196f8cf87b405373017701634a5309139b14
MD5 7944809e84f449edaee2582e5fd72e5d
SHA1 30bbef678b87f4242f0a64dce3ab670d99e24e96
SHA512 403ad0ac986cdc345637c71392183729a2f55d2c743808e5f958dfd066ace86289a08dd490240c6f743aac0330560cb341bb0eba4298630c4d185038b306214e
SSDEEP 3072:N9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:fctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T11A847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usmkhcaurm.exe

Path C:\Temp\usmkhcaurm.exe
Size 384KB
SHA256 6d557ac47e8da9d69f5c32648bd5c4013136221239fa70dccc71abbcfedc0910
MD5 a2ba5db8a59742437fd4e1c6ce250f64
SHA1 6b32b6a1069ccb7fc99d3ace25998cf16aabca5e
SHA512 163859cbb565145e10e1c0e508ab1b3908538736baa521b6eacfa97e09766d5061a1b64077a8ed1f75e03a34a194f1294eae149659ab092523d21582cf33903b
SSDEEP 3072:n9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:9ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D9847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxrpmhfzxu.sys

Path C:\Temp\zxrpmhfzxu.sys
Size 293KB
SHA256 75fb2809bab62bfeabe802c28069fe703ef29c8c7c6c350b9e6d32394e472f16
MD5 6acee730b95a3bb262dac5844dad23d7
SHA1 dd3aa8a21a34004c32dea211b968f6dfbdcfda20
SHA512 1a2c6efa43d5eb80c948199641d5eec73dbf9c4191d22349f649d83009db6fc7b0165e08afbe68447bca69ac4de8f000cfae51bc19a344b1bcb6e9bd6660fc6d
SSDEEP 3072:NtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:NIJjiJcbI03GBc3ucY5DCSj
TLSH
T1A0545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 a394a617cf97e13ffe5f32f3d0d1e6a97c4bb56f5b602723689588454748c528
MD5 e6525e83db3975aedd1db6d4d9680e72
SHA1 3455d88bde6a35ca9e13018553e88a391740c88f
SHA512 b641c3cf81b40baa18984e54037da5c4ca356e8221dd776b61cd418d7389e8cc06b22fd9210bad324f3eda9c16b7182e8e54f0608a2f501bca296150c7dca3d4
TLSH
T1725172A447BB89C2DB2B97B10BF3858A32F6C5D64A075FDE4C4860F4F04EF5D9142155
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a41fc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a41fc.TMP
Size 2KB
SHA256 12d92c0009d014034b00447ecddba41d1984e8b1ed34f029bf1ef8663221aa02
MD5 45eb72a82f5497f3e744e896bff795af
SHA1 e858e5cb310de293224e94b6f63df7e5568c0f87
SHA512 f54ce2282bae7594c2b353fad93208f7531163a9762282ca560daf3448831afa478e5b18168a40c6f7e1e7b3c0c18b81069ae113c1a9e923c23d8a2507e9f9cc
TLSH
T10A5182A44B7B89C2DB2B97B20BF3818A32F5C5D64A075FDE4C4860F4F04EF5CA042151
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 29d7e30729fd8a4c7907f01c276682d75c360757fc84411066911ae15cf112c0
MD5 81214b91458128cbb1f1e3b43c645c32
SHA1 3045b71712fd523f295dfb946ee0dfe66c61e304
SHA512 4a64ee6425e7a79cd5bcd62983a5bfe2cc131575d8a54c3a74250f35a4679295328a8b143925f093e39870b27d59c16482adaf89b3aa3cd06fe6dae7eae488bf
TLSH
T1BF41BDF3C3E4856E891196F0AB187E2BDE1D0915832C3D5AC9E4AE1B93F2471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 78c0d7babf2333a1e227aa80d0aaf6ed285773796199c0b70a5f50fb15448a13
MD5 cc22396db6dba14b99b500f234840278
SHA1 d4f4d814ebfb94833add47255ff1e4b3759ca09a
SHA512 9ff00f835392d7014db449525c93628ed8b3e25828a6cfe3ff06c3c76335f240264086099704f6b7b2f4d28bc97f70e72c64d0391b8072feb3d12e1070785376
SSDEEP 192:sxRrRRyM/jK1Ml8wCs/fgsGoZI0Z2zoA8pi/g6+WNIYorCYcG9IgtJ:sxRr58s/fgsjZIKri/5I+q3
TLSH
T1F852EA166A345A779CDBD30DFA557F93D6F81423A2901E44EAFC8B0C01E6AEC221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 926e470f3cef124375812e728c3961f756f817090810b8e90d70fafc7f8fa134
MD5 5eaf5fe26c806b1a64bcb0169380c0ce
SHA1 8481fecd4ab5a58466f7739fe40f9656c445c1e5
SHA512 dcaa76f088a8c5453e76509e28d968cc0425b96e73268415bb3a6ab27abf83f54a0888cb4e7a4fbc60dc6ee40801cac465431f9c5f9fe0d4d5883006bf1e5405
SSDEEP 192:sxRURRyM/jK1Ml8UQICs/fgsUoZ00ZezoA8pr3/g6+WNIYoeCYcG9IgDeJ:sxRU5qvs/fgs1Z0KDL/5IVqG
TLSH
T10462EA16AA245A779CDBD20DFA517F93D2F81473A2901E44AAFCDB0C01F6ADD221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 206ca181d32579e26614c238661bb6b03581a6e193637eb8dfc521efcf56eaa6
MD5 db020f15f70dc344209dec64d5895853
SHA1 8989db50a6994ea533226144c375d526ed0daef0
SHA512 1ad964f94c67285f2fbe70f63792b0c166d92b416915732f731156bc2f8367b4c05fa98704f3c221285027cc96a8c8fb7fa4cafd96f68ab61bcb08846bb36ff1
SSDEEP 192:sxRURRyM/jK1Ml8wCs/fgsUoZI0Z2zoA8pi/g6+WNIYorCYcG9IgDYJ:sxRU58s/fgs1ZIKri/5I+qo
TLSH
T1E852EA166A345A779CDBD30DFA557F93D6F81423A2901E44EAFC9B0C01E6AEC221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 737c074465863d1dcfa1b19c07779dd43194859f2cd2250faeef415b742a9752
MD5 6ce90ca69a7c4869396d98c949deb5da
SHA1 6e1c7d8cb726a0fc62763d29e5540155f6c1bc72
SHA512 d4cd3299b3d02928e9f2eb7466c8376e7bcc1fa8fad96b26ead9310d86cb831866286153ee7d7a918eab827cf262d4e9ec65f6fd86167851d1b5822ed643a7d0
SSDEEP 768:jXwHno7pLuL7gRWgs2fJ28F1+UoAYDCx9Tuqh0VfUC9xbog/OVj1pVuG4rockPaF:jXwHnUE7gRWgs2fJ2u1jak1p4GDdSZ7f
TLSH
T1E7E2FC7B680CCBBE4F404ADCEC29BD9E6DA802CB96D88D5447FA440C03C6AEB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d4bd4e2a-6f70-472a-a057-d537093d57e9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\d4bd4e2a-6f70-472a-a057-d537093d57e9.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 d4062e7fd98c15e9b2567a6c566fb58904be4972baaafdaaeda0e7e78e7f0873
MD5 97c1a98090fe25f1c6618613809a2010
SHA1 39ee4fb1f4d3f6989f1e3085fd2299e37cdb49ca
SHA512 705426e314985602687c2b757571c26ac2721f4fe3c52a4eee626ac6311458e9d5df6ce7b88e92ef1781ceeabe6dd5cd2ae077f20805b151f1b158a857544e41
SSDEEP 768:hrv+4UNbdz3FF/TBOWTONXyer1IRCzniBReVH1SK7:hbsbV3vdSIqnWEH1l
TLSH
T12903CF32E4999E338CE2A395B047B6437FF86057CA840790EDDE2F4E069B59E130B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 6bc8083fffef512e8fe5d8f0caa5b0a386e51c01ce479fb6fe6080ec069d5be0
MD5 54a6e5d14b0e2d4e8d2b4f6444b433b0
SHA1 a152fe42360406d138367e67b825e49c8b60b9a8
SHA512 dc5723ad8765d3ee896599244037742a6f9815ce970227f4185c414552cf7f2269f785c1a079bc3dcaaebdd9c5c228a8b51693ced58aedb415af1287e13e1795
SSDEEP 768:Arv+4UNbdE3VeDGl/TBOWSVONXyer1IRCzni94b9MN:Absbm3R+SIqnbb+N
TLSH
T1FC13CF31E4599F334CA6A396F04776937FF820A788C40B94EDDA6B4D06979AE130B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 5a0d722177438114d02235e35a1cc0b9e51a7f1e28a3d44c73f3b7abd97e19d7
MD5 cbf521c5d857632e590d8e093df88c92
SHA1 40873ebb33b9e75aea1af020f1740ae90789e4c2
SHA512 2fbe8b49e4988d68e3616861260daa64ea63a15fcb48ae18cf242ee728ee1255c74145ece375c6bb9f4b38ee03faa2281ae799d03c4c45353a38e432acf66e74
SSDEEP 768:rF1j+923hwg0eDj6VsOWSAONXyer1IRCzni94b9MZ:q923YMSIqnbb+Z
TLSH
T1B103AD36D856DF3B9CE2A7D6F2067B86AEF410A789C859C0EED95F4D01D35AD030A806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 5f6cfc0a5543be73c3745fb517fe844cdc3c8d7a83a2a7ebccbfacc49a98ef3d
MD5 0e25730e11c430e812ca58097ff2dedf
SHA1 ba7612857d4b4935bddd6eeac28a1f704dc73c1d
SHA512 696a6473d9b4be0701ddae8bc238430b4f745475ff1792805a278a9ba8df3a6b1f28ac0a1ebef20df2a5e4a3a3fb66b5115d2a201cebf59e50a7421332786dec
SSDEEP 768:7j+9S3OeDjl/TBOWSTONXyer1IRCzni94b9MZ:u9S3tySIqnbb+Z
TLSH
T108F2AF30E4569F374CD6A39AF1073BD6BFF8207788840E84EEE9AF4D069366D130A416
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 fa07b0ac46d4258a7848e3c6509c8f5db709447992623fb6a91b97b35171fc9e
MD5 4971a22a0aa06c6c10c91db504ccb779
SHA1 c4bc935c0146bb6ddc45b9c8b35f0ed113d7fcc7
SHA512 ef1bf68e137bbf227f2319e61aef5ef19fcb7a72736b0a93b37f7aa5963a3464651714a11fe1e6eca961e2618f8c3f53327af22b302b1d46af0fb0433403f1e4
SSDEEP 768:Zj+9S3VeDjl/TBOWSTONXyer1IRCzni94b9MZ:E9S3EySIqnbb+Z
TLSH
T10EF2AF30E4569F374CD6A39AF1473BD6AFF820B788840E94EEE9AF4D059366D130A416
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

8cafc482-d4ef-47ee-b9b7-c5db250738db.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\8cafc482-d4ef-47ee-b9b7-c5db250738db.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1300_1898135896\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 5e8cfd812ec4b017a63ce5e1ad96317e46564ae22691d1d28fe937f03ff3a6e7
MD5 ead626ba592ec5e65799b9dfe1773d58
SHA1 92dcf7bebe904f2d66f05b6d37cb76e56f2a55fa
SHA512 eda6ab06c92608c95888432bf620a64f69157712b4162404f48bcb4c8fa0630b476d39130c046673c02b6742dac04e9c5e351c3b4cf1b32a7f96138fb154cdbf
TLSH
T13071238357B9D6F3C2DA5FF002835244F1FB227C077370604B515586AB34A3A58B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2300-501-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2304-451-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2928-415-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3064-326-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3128-285-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3440-476-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3992-245-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4148-68-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4188-440-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4244-341-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4368-375-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4476-322-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4600-416-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4600-395-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4696-197-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4880-362-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4892-315-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4912-436-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5092-472-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5092-273-0x0000000000010000-0x00000000000AB000-memory.dmp

Download