systex | 7f9df75e0b4b4057ed54e09c662386dfadbf34be4a0c7ce5fd81609c57867373

Analysis

max time kernel
150s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 13:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-23_5d8cfafb8f82587863c55155ced7a829_amadey_darkgate_elex_smoke-loader_stop.exe
Size 384KB
Sample260723-q6e4eazfmc
SHA256 7f9df75e0b4b4057ed54e09c662386dfadbf34be4a0c7ce5fd81609c57867373
MD5 5d8cfafb8f82587863c55155ced7a829
SHA1 24da4e0313cfad05c89ae64bd0d9e352215106b2
SHA512 116cee68fce78937aa833b4fa42b9a965873164e8463ff9e51dcb179f45f7c4ba870909debc9dcc3dfc46cdede1fb20d950a9e6f6929724052be75acdc0d091d
SSDEEP 3072:fjtF1eNGL8tpdhJmaMOk4y3tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/09:7tf7ZIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F8847B00BAA4F0F6D995047800EFAF36A67E74281726CBC3E754CE5D9A113C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
4656	lfdyvqnigaysqkic.exe
2156	lfdyvqnigaysqkic.sys
5768	CreateProcess.exe
5384	lfdxvpnifd.exe
6032	CreateProcess.exe
2836	CreateProcess.exe
2964	i_lfdxvpnifd.exe
3336	ifaxspnhfd.sys
3704	CreateProcess.exe
6076	ifaxsqkicx.exe
6016	CreateProcess.exe
2768	CreateProcess.exe
4420	i_ifaxsqkicx.exe
2924	xsqkhfcxus.sys
5924	CreateProcess.exe
2380	pkhfcauspk.exe
4312	CreateProcess.exe
1804	CreateProcess.exe
2912	i_pkhfcauspk.exe
1408	ausmkhczus.sys
4116	CreateProcess.exe
3644	zxrpjhczup.exe
2332	CreateProcess.exe
704	CreateProcess.exe
5276	i_zxrpjhczup.exe
1312	xrpjhczwuo.sys
3084	CreateProcess.exe
4124	uomgezwrpj.exe
5312	CreateProcess.exe
5300	CreateProcess.exe
3080	i_uomgezwrpj.exe
720	ztjebztrlj.sys
6008	CreateProcess.exe
2828	ljhbztrlje.exe
2656	CreateProcess.exe
1548	CreateProcess.exe
6096	i_ljhbztrlje.exe
3384	ywqojhbztr.sys
2368	CreateProcess.exe
3616	rojytrljdb.exe
4912	CreateProcess.exe
3952	CreateProcess.exe
940	i_rojytrljdb.exe
5580	oigbytqolg.sys
2476	CreateProcess.exe
3480	ligayvtrli.exe
4516	CreateProcess.exe
4008	CreateProcess.exe
984	i_ligayvtrli.exe
3144	qnigaysqki.sys
5556	CreateProcess.exe
5496	lfdavtqlid.exe
5900	CreateProcess.exe
4688	CreateProcess.exe
1124	i_lfdavtqlid.exe
3388	nigaysqfdx.sys
4844	CreateProcess.exe
4156	axsqkicaus.exe
4104	CreateProcess.exe
2132	CreateProcess.exe
1736	i_axsqkicaus.exe
4568	dxvpkicaus.sys
3956	CreateProcess.exe
4512	ausnkfvpnh.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3364_1284426789\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3364_429388153\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3364_429388153\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3364_1936640370\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3364_1454395222\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3364_1454395222\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3364_1936640370\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3364_1936640370\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3364_1936640370\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbvtoljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axsqkicaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljhbztrlje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lfdxvpnifd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxrpjhczup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lfdavtqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axsqkicaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaysqlidav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ausmkfcxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pkhfcauspk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lfdavtqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhbywurmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faxvsqkifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrpjhczup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomgezwrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rojytrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rojytrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpnhczusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhbywurmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qojgbztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqkicavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pkhfcauspk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ligayvtrli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhczusmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbvtoljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqkicavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faxvsqkifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lfdyvqnigaysqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomgezwrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ligayvtrli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhczusmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qojgbztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifaxsqkicx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljhbztrlje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-23_5d8cfafb8f82587863c55155ced7a829_amadey_darkgate_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lfdxvpnifd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ausnkfvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpnhczusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gaysqlidav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifaxsqkicx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ausnkfvpnh.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3424	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3948	ipconfig.exe
5668	ipconfig.exe
564	ipconfig.exe
3112	ipconfig.exe
2084	ipconfig.exe
2060	ipconfig.exe
2284	ipconfig.exe
3740	ipconfig.exe
1148	ipconfig.exe
2180	ipconfig.exe
5908	ipconfig.exe
3184	ipconfig.exe
4572	ipconfig.exe
4884	ipconfig.exe
6004	ipconfig.exe
940	ipconfig.exe
2980	ipconfig.exe
4856	ipconfig.exe
4988	ipconfig.exe
4688	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134292883405560290"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4046655672-1449839301-2197395821-1000\{4933950A-921A-4210-85A3-54CBFA00A523}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3800	2026-07-23_5d8cfafb8f82587863c55155ced7a829_amadey_darkgate_elex_smoke-loader_stop.exe
3800	2026-07-23_5d8cfafb8f82587863c55155ced7a829_amadey_darkgate_elex_smoke-loader_stop.exe
3800	2026-07-23_5d8cfafb8f82587863c55155ced7a829_amadey_darkgate_elex_smoke-loader_stop.exe
3800	2026-07-23_5d8cfafb8f82587863c55155ced7a829_amadey_darkgate_elex_smoke-loader_stop.exe
3800	2026-07-23_5d8cfafb8f82587863c55155ced7a829_amadey_darkgate_elex_smoke-loader_stop.exe
3800	2026-07-23_5d8cfafb8f82587863c55155ced7a829_amadey_darkgate_elex_smoke-loader_stop.exe
3800	2026-07-23_5d8cfafb8f82587863c55155ced7a829_amadey_darkgate_elex_smoke-loader_stop.exe
3800	2026-07-23_5d8cfafb8f82587863c55155ced7a829_amadey_darkgate_elex_smoke-loader_stop.exe
3800	2026-07-23_5d8cfafb8f82587863c55155ced7a829_amadey_darkgate_elex_smoke-loader_stop.exe
3800	2026-07-23_5d8cfafb8f82587863c55155ced7a829_amadey_darkgate_elex_smoke-loader_stop.exe
3800	2026-07-23_5d8cfafb8f82587863c55155ced7a829_amadey_darkgate_elex_smoke-loader_stop.exe
3800	2026-07-23_5d8cfafb8f82587863c55155ced7a829_amadey_darkgate_elex_smoke-loader_stop.exe
3800	2026-07-23_5d8cfafb8f82587863c55155ced7a829_amadey_darkgate_elex_smoke-loader_stop.exe
3800	2026-07-23_5d8cfafb8f82587863c55155ced7a829_amadey_darkgate_elex_smoke-loader_stop.exe
3800	2026-07-23_5d8cfafb8f82587863c55155ced7a829_amadey_darkgate_elex_smoke-loader_stop.exe
3800	2026-07-23_5d8cfafb8f82587863c55155ced7a829_amadey_darkgate_elex_smoke-loader_stop.exe
3800	2026-07-23_5d8cfafb8f82587863c55155ced7a829_amadey_darkgate_elex_smoke-loader_stop.exe
3800	2026-07-23_5d8cfafb8f82587863c55155ced7a829_amadey_darkgate_elex_smoke-loader_stop.exe
3800	2026-07-23_5d8cfafb8f82587863c55155ced7a829_amadey_darkgate_elex_smoke-loader_stop.exe
3800	2026-07-23_5d8cfafb8f82587863c55155ced7a829_amadey_darkgate_elex_smoke-loader_stop.exe
3800	2026-07-23_5d8cfafb8f82587863c55155ced7a829_amadey_darkgate_elex_smoke-loader_stop.exe
3800	2026-07-23_5d8cfafb8f82587863c55155ced7a829_amadey_darkgate_elex_smoke-loader_stop.exe
3800	2026-07-23_5d8cfafb8f82587863c55155ced7a829_amadey_darkgate_elex_smoke-loader_stop.exe
3800	2026-07-23_5d8cfafb8f82587863c55155ced7a829_amadey_darkgate_elex_smoke-loader_stop.exe
3800	2026-07-23_5d8cfafb8f82587863c55155ced7a829_amadey_darkgate_elex_smoke-loader_stop.exe
3800	2026-07-23_5d8cfafb8f82587863c55155ced7a829_amadey_darkgate_elex_smoke-loader_stop.exe
3800	2026-07-23_5d8cfafb8f82587863c55155ced7a829_amadey_darkgate_elex_smoke-loader_stop.exe
3800	2026-07-23_5d8cfafb8f82587863c55155ced7a829_amadey_darkgate_elex_smoke-loader_stop.exe
3800	2026-07-23_5d8cfafb8f82587863c55155ced7a829_amadey_darkgate_elex_smoke-loader_stop.exe
3800	2026-07-23_5d8cfafb8f82587863c55155ced7a829_amadey_darkgate_elex_smoke-loader_stop.exe
3800	2026-07-23_5d8cfafb8f82587863c55155ced7a829_amadey_darkgate_elex_smoke-loader_stop.exe
3800	2026-07-23_5d8cfafb8f82587863c55155ced7a829_amadey_darkgate_elex_smoke-loader_stop.exe
3800	2026-07-23_5d8cfafb8f82587863c55155ced7a829_amadey_darkgate_elex_smoke-loader_stop.exe
3800	2026-07-23_5d8cfafb8f82587863c55155ced7a829_amadey_darkgate_elex_smoke-loader_stop.exe
3800	2026-07-23_5d8cfafb8f82587863c55155ced7a829_amadey_darkgate_elex_smoke-loader_stop.exe
3800	2026-07-23_5d8cfafb8f82587863c55155ced7a829_amadey_darkgate_elex_smoke-loader_stop.exe
3800	2026-07-23_5d8cfafb8f82587863c55155ced7a829_amadey_darkgate_elex_smoke-loader_stop.exe
3800	2026-07-23_5d8cfafb8f82587863c55155ced7a829_amadey_darkgate_elex_smoke-loader_stop.exe
3800	2026-07-23_5d8cfafb8f82587863c55155ced7a829_amadey_darkgate_elex_smoke-loader_stop.exe
3800	2026-07-23_5d8cfafb8f82587863c55155ced7a829_amadey_darkgate_elex_smoke-loader_stop.exe
3800	2026-07-23_5d8cfafb8f82587863c55155ced7a829_amadey_darkgate_elex_smoke-loader_stop.exe
3800	2026-07-23_5d8cfafb8f82587863c55155ced7a829_amadey_darkgate_elex_smoke-loader_stop.exe
3800	2026-07-23_5d8cfafb8f82587863c55155ced7a829_amadey_darkgate_elex_smoke-loader_stop.exe
3800	2026-07-23_5d8cfafb8f82587863c55155ced7a829_amadey_darkgate_elex_smoke-loader_stop.exe
3800	2026-07-23_5d8cfafb8f82587863c55155ced7a829_amadey_darkgate_elex_smoke-loader_stop.exe
3800	2026-07-23_5d8cfafb8f82587863c55155ced7a829_amadey_darkgate_elex_smoke-loader_stop.exe
3800	2026-07-23_5d8cfafb8f82587863c55155ced7a829_amadey_darkgate_elex_smoke-loader_stop.exe
3800	2026-07-23_5d8cfafb8f82587863c55155ced7a829_amadey_darkgate_elex_smoke-loader_stop.exe
3800	2026-07-23_5d8cfafb8f82587863c55155ced7a829_amadey_darkgate_elex_smoke-loader_stop.exe
3800	2026-07-23_5d8cfafb8f82587863c55155ced7a829_amadey_darkgate_elex_smoke-loader_stop.exe
3800	2026-07-23_5d8cfafb8f82587863c55155ced7a829_amadey_darkgate_elex_smoke-loader_stop.exe
3800	2026-07-23_5d8cfafb8f82587863c55155ced7a829_amadey_darkgate_elex_smoke-loader_stop.exe
4656	lfdyvqnigaysqkic.exe
3800	2026-07-23_5d8cfafb8f82587863c55155ced7a829_amadey_darkgate_elex_smoke-loader_stop.exe
4656	lfdyvqnigaysqkic.exe
3800	2026-07-23_5d8cfafb8f82587863c55155ced7a829_amadey_darkgate_elex_smoke-loader_stop.exe
4656	lfdyvqnigaysqkic.exe
3800	2026-07-23_5d8cfafb8f82587863c55155ced7a829_amadey_darkgate_elex_smoke-loader_stop.exe
4656	lfdyvqnigaysqkic.exe
3800	2026-07-23_5d8cfafb8f82587863c55155ced7a829_amadey_darkgate_elex_smoke-loader_stop.exe
4656	lfdyvqnigaysqkic.exe
4656	lfdyvqnigaysqkic.exe
4656	lfdyvqnigaysqkic.exe
4656	lfdyvqnigaysqkic.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	2964	i_lfdxvpnifd.exe
Token: SeDebugPrivilege	4420	i_ifaxsqkicx.exe
Token: SeDebugPrivilege	2912	i_pkhfcauspk.exe
Token: SeDebugPrivilege	5276	i_zxrpjhczup.exe
Token: SeDebugPrivilege	3080	i_uomgezwrpj.exe
Token: SeDebugPrivilege	6096	i_ljhbztrlje.exe
Token: SeDebugPrivilege	940	i_rojytrljdb.exe
Token: SeDebugPrivilege	984	i_ligayvtrli.exe
Token: SeDebugPrivilege	1124	i_lfdavtqlid.exe
Token: SeDebugPrivilege	1736	i_axsqkicaus.exe
Token: SeDebugPrivilege	3992	i_ausnkfvpnh.exe
Token: SeDebugPrivilege	4344	i_xrpnhczusm.exe
Token: SeDebugPrivilege	4424	i_rpjhczusmk.exe
Token: SeDebugPrivilege	5620	i_mhbywurmje.exe
Token: SeDebugPrivilege	4296	i_qojgbztrlj.exe
Token: SeDebugPrivilege	4564	i_ljdbvtoljd.exe
Token: SeDebugPrivilege	1440	i_gaysqlidav.exe
Token: SeDebugPrivilege	204	i_aysqkicavs.exe
Token: SeDebugPrivilege	4596	i_faxvsqkifa.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3364	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3800 wrote to memory of 4656	3800	2026-07-23_5d8cfafb8f82587863c55155ced7a829_amadey_darkgate_elex_smoke-loader_stop.exe	89
PID 3800 wrote to memory of 1296	3800	2026-07-23_5d8cfafb8f82587863c55155ced7a829_amadey_darkgate_elex_smoke-loader_stop.exe	90
PID 1296 wrote to memory of 3364	1296	iexplore.exe	91
PID 3364 wrote to memory of 2620	3364	msedge.exe	92
PID 3364 wrote to memory of 5080	3364	msedge.exe	93
PID 3364 wrote to memory of 3424	3364	msedge.exe	95
PID 3364 wrote to memory of 5080	3364	msedge.exe	93
PID 3364 wrote to memory of 5080	3364	msedge.exe	93
PID 3364 wrote to memory of 2816	3364	msedge.exe	96
PID 3364 wrote to memory of 2816	3364	msedge.exe	96
PID 3364 wrote to memory of 828	3364	msedge.exe	97
PID 3364 wrote to memory of 828	3364	msedge.exe	97
PID 3364 wrote to memory of 828	3364	msedge.exe	97
PID 3364 wrote to memory of 3044	3364	msedge.exe	98
PID 3364 wrote to memory of 3044	3364	msedge.exe	98
PID 3364 wrote to memory of 3044	3364	msedge.exe	98
PID 3364 wrote to memory of 4544	3364	msedge.exe	99
PID 3364 wrote to memory of 2296	3364	msedge.exe	100
PID 3364 wrote to memory of 4544	3364	msedge.exe	99
PID 3364 wrote to memory of 4544	3364	msedge.exe	99
PID 3364 wrote to memory of 2296	3364	msedge.exe	100
PID 3364 wrote to memory of 2296	3364	msedge.exe	100
PID 3364 wrote to memory of 5792	3364	msedge.exe	101
PID 3364 wrote to memory of 5792	3364	msedge.exe	101
PID 3364 wrote to memory of 4220	3364	msedge.exe	104
PID 3364 wrote to memory of 2148	3364	msedge.exe	103
PID 3364 wrote to memory of 4220	3364	msedge.exe	104
PID 3364 wrote to memory of 2148	3364	msedge.exe	103
PID 3364 wrote to memory of 5416	3364	msedge.exe	106
PID 4656 wrote to memory of 5768	4656	lfdyvqnigaysqkic.exe	111
PID 3364 wrote to memory of 5304	3364	msedge.exe	113
PID 3364 wrote to memory of 5304	3364	msedge.exe	113
PID 5384 wrote to memory of 6032	5384	lfdxvpnifd.exe	115
PID 3364 wrote to memory of 5048	3364	msedge.exe	118
PID 3364 wrote to memory of 5048	3364	msedge.exe	118
PID 4656 wrote to memory of 2836	4656	lfdyvqnigaysqkic.exe	120
PID 4656 wrote to memory of 3704	4656	lfdyvqnigaysqkic.exe	124
PID 6076 wrote to memory of 6016	6076	ifaxsqkicx.exe	126
PID 4656 wrote to memory of 2768	4656	lfdyvqnigaysqkic.exe	129
PID 4656 wrote to memory of 5924	4656	lfdyvqnigaysqkic.exe	133
PID 2380 wrote to memory of 4312	2380	pkhfcauspk.exe	135
PID 4656 wrote to memory of 1804	4656	lfdyvqnigaysqkic.exe	138
PID 4656 wrote to memory of 4116	4656	lfdyvqnigaysqkic.exe	143
PID 3644 wrote to memory of 2332	3644	zxrpjhczup.exe	145
PID 4656 wrote to memory of 704	4656	lfdyvqnigaysqkic.exe	148
PID 3364 wrote to memory of 5328	3364	msedge.exe	150
PID 3364 wrote to memory of 5620	3364	msedge.exe	151
PID 3364 wrote to memory of 5668	3364	msedge.exe	152
PID 4656 wrote to memory of 3084	4656	lfdyvqnigaysqkic.exe	155
PID 4124 wrote to memory of 5312	4124	uomgezwrpj.exe	157
PID 4656 wrote to memory of 5300	4656	lfdyvqnigaysqkic.exe	160
PID 4656 wrote to memory of 6008	4656	lfdyvqnigaysqkic.exe	164
PID 2828 wrote to memory of 2656	2828	ljhbztrlje.exe	166
PID 4656 wrote to memory of 1548	4656	lfdyvqnigaysqkic.exe	169
PID 4656 wrote to memory of 2368	4656	lfdyvqnigaysqkic.exe	173
PID 3616 wrote to memory of 4912	3616	rojytrljdb.exe	175
PID 4656 wrote to memory of 3952	4656	lfdyvqnigaysqkic.exe	178
PID 4656 wrote to memory of 2476	4656	lfdyvqnigaysqkic.exe	182
PID 3480 wrote to memory of 4516	3480	ligayvtrli.exe	184
PID 4656 wrote to memory of 4008	4656	lfdyvqnigaysqkic.exe	187
PID 3364 wrote to memory of 1704	3364	msedge.exe	189
PID 3364 wrote to memory of 1704	3364	msedge.exe	189
PID 4656 wrote to memory of 5556	4656	lfdyvqnigaysqkic.exe	195
PID 5496 wrote to memory of 5900	5496	lfdavtqlid.exe	197

C:\Users\Admin\AppData\Local\Temp\2026-07-23_5d8cfafb8f82587863c55155ced7a829_amadey_darkgate_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_5d8cfafb8f82587863c55155ced7a829_amadey_darkgate_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3800
- C:\Temp\lfdyvqnigaysqkic.exe
  C:\Temp\lfdyvqnigaysqkic.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4656
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lfdxvpnifd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5768
  - - C:\Temp\lfdxvpnifd.exe
      C:\Temp\lfdxvpnifd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5384
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6032
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2284
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lfdxvpnifd.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2836
  - - C:\Temp\i_lfdxvpnifd.exe
      C:\Temp\i_lfdxvpnifd.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2964
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ifaxsqkicx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3704
  - - C:\Temp\ifaxsqkicx.exe
      C:\Temp\ifaxsqkicx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6076
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6016
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3948
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ifaxsqkicx.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2768
  - - C:\Temp\i_ifaxsqkicx.exe
      C:\Temp\i_ifaxsqkicx.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4420
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pkhfcauspk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5924
  - - C:\Temp\pkhfcauspk.exe
      C:\Temp\pkhfcauspk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2380
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4312
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3740
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pkhfcauspk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1804
  - - C:\Temp\i_pkhfcauspk.exe
      C:\Temp\i_pkhfcauspk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2912
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zxrpjhczup.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4116
  - - C:\Temp\zxrpjhczup.exe
      C:\Temp\zxrpjhczup.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3644
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2332
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1148
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zxrpjhczup.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:704
  - - C:\Temp\i_zxrpjhczup.exe
      C:\Temp\i_zxrpjhczup.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5276
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\uomgezwrpj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3084
  - - C:\Temp\uomgezwrpj.exe
      C:\Temp\uomgezwrpj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4124
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5312
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2180
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_uomgezwrpj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5300
  - - C:\Temp\i_uomgezwrpj.exe
      C:\Temp\i_uomgezwrpj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3080
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljhbztrlje.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6008
  - - C:\Temp\ljhbztrlje.exe
      C:\Temp\ljhbztrlje.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2828
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2656
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4688
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljhbztrlje.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1548
  - - C:\Temp\i_ljhbztrlje.exe
      C:\Temp\i_ljhbztrlje.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6096
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rojytrljdb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2368
  - - C:\Temp\rojytrljdb.exe
      C:\Temp\rojytrljdb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3616
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4912
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5908
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rojytrljdb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3952
  - - C:\Temp\i_rojytrljdb.exe
      C:\Temp\i_rojytrljdb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:940
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ligayvtrli.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2476
  - - C:\Temp\ligayvtrli.exe
      C:\Temp\ligayvtrli.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3480
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4516
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5668
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ligayvtrli.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4008
  - - C:\Temp\i_ligayvtrli.exe
      C:\Temp\i_ligayvtrli.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:984
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lfdavtqlid.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5556
  - - C:\Temp\lfdavtqlid.exe
      C:\Temp\lfdavtqlid.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5496
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5900
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3184
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lfdavtqlid.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4688
  - - C:\Temp\i_lfdavtqlid.exe
      C:\Temp\i_lfdavtqlid.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1124
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\axsqkicaus.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4844
  - - C:\Temp\axsqkicaus.exe
      C:\Temp\axsqkicaus.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4156
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4104
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4572
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_axsqkicaus.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2132
  - - C:\Temp\i_axsqkicaus.exe
      C:\Temp\i_axsqkicaus.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1736
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ausnkfvpnh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3956
  - - C:\Temp\ausnkfvpnh.exe
      C:\Temp\ausnkfvpnh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4512
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2444
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4884
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ausnkfvpnh.exe ups_ins
    3⤵
    PID:5364
  - - C:\Temp\i_ausnkfvpnh.exe
      C:\Temp\i_ausnkfvpnh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3992
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xrpnhczusm.exe ups_run
    3⤵
    PID:3740
  - - C:\Temp\xrpnhczusm.exe
      C:\Temp\xrpnhczusm.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:720
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4316
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6004
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xrpnhczusm.exe ups_ins
    3⤵
    PID:1892
  - - C:\Temp\i_xrpnhczusm.exe
      C:\Temp\i_xrpnhczusm.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4344
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rpjhczusmk.exe ups_run
    3⤵
    PID:1796
  - - C:\Temp\rpjhczusmk.exe
      C:\Temp\rpjhczusmk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5952
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1572
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:940
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rpjhczusmk.exe ups_ins
    3⤵
    PID:5748
  - - C:\Temp\i_rpjhczusmk.exe
      C:\Temp\i_rpjhczusmk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4424
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mhbywurmje.exe ups_run
    3⤵
    PID:5332
  - - C:\Temp\mhbywurmje.exe
      C:\Temp\mhbywurmje.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6068
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3064
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2060
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mhbywurmje.exe ups_ins
    3⤵
    PID:2928
  - - C:\Temp\i_mhbywurmje.exe
      C:\Temp\i_mhbywurmje.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5620
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qojgbztrlj.exe ups_run
    3⤵
    PID:1620
  - - C:\Temp\qojgbztrlj.exe
      C:\Temp\qojgbztrlj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5064
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4648
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:564
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qojgbztrlj.exe ups_ins
    3⤵
    PID:1848
  - - C:\Temp\i_qojgbztrlj.exe
      C:\Temp\i_qojgbztrlj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4296
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljdbvtoljd.exe ups_run
    3⤵
    PID:3836
  - - C:\Temp\ljdbvtoljd.exe
      C:\Temp\ljdbvtoljd.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5772
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2868
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3112
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljdbvtoljd.exe ups_ins
    3⤵
    PID:5832
  - - C:\Temp\i_ljdbvtoljd.exe
      C:\Temp\i_ljdbvtoljd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4564
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gaysqlidav.exe ups_run
    3⤵
    PID:5644
  - - C:\Temp\gaysqlidav.exe
      C:\Temp\gaysqlidav.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1896
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4620
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2980
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gaysqlidav.exe ups_ins
    3⤵
    PID:4568
  - - C:\Temp\i_gaysqlidav.exe
      C:\Temp\i_gaysqlidav.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1440
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\aysqkicavs.exe ups_run
    3⤵
    PID:984
  - - C:\Temp\aysqkicavs.exe
      C:\Temp\aysqkicavs.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5992
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2376
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4856
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_aysqkicavs.exe ups_ins
    3⤵
    PID:2716
  - - C:\Temp\i_aysqkicavs.exe
      C:\Temp\i_aysqkicavs.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:204
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\faxvsqkifa.exe ups_run
    3⤵
    PID:3112
  - - C:\Temp\faxvsqkifa.exe
      C:\Temp\faxvsqkifa.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5708
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5860
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4988
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_faxvsqkifa.exe ups_ins
    3⤵
    PID:3256
  - - C:\Temp\i_faxvsqkifa.exe
      C:\Temp\i_faxvsqkifa.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4596
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ausmkfcxvp.exe ups_run
    3⤵
    PID:4624
  - - C:\Temp\ausmkfcxvp.exe
      C:\Temp\ausmkfcxvp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4348
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3100
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2084
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffc6c05c188,0x7ffc6c05c194,0x7ffc6c05c1a0
      4⤵
      PID:2620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1736,i,11360336836578083454,904702950066712320,262144 --field-trial-handle=2356,i,6197070408908128317,14555140041228086415,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:2
      4⤵
      PID:5080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,8451907142406785173,9349191741464191522,524288 --field-trial-handle=2356,i,6197070408908128317,14555140041228086415,262144 --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:11
      4⤵
      System Time Discovery
      PID:3424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2452,i,15150410192294101868,11181322399314904145,524288 --field-trial-handle=2356,i,6197070408908128317,14555140041228086415,262144 --variations-seed-version --mojo-platform-channel-handle=3176 /prefetch:13
      4⤵
      PID:2816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3600,i,4668198548642101267,4688226867165180216,2097152 --field-trial-handle=2356,i,6197070408908128317,14555140041228086415,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
      4⤵
      PID:828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3604,i,8801406703357291916,15639545283034944820,2097152 --field-trial-handle=2356,i,6197070408908128317,14555140041228086415,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
      4⤵
      PID:3044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4400,i,14526932198679949873,1280079184260716395,2097152 --field-trial-handle=2356,i,6197070408908128317,14555140041228086415,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:9
      4⤵
      PID:4544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4324,i,7798856863537537304,3719794469326731296,2097152 --field-trial-handle=2356,i,6197070408908128317,14555140041228086415,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:1
      4⤵
      PID:2296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3672,i,3984057093468706101,5688027211146943213,524288 --field-trial-handle=2356,i,6197070408908128317,14555140041228086415,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:14
      4⤵
      PID:5792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,5317571155420525663,14694514763229043764,524288 --field-trial-handle=2356,i,6197070408908128317,14555140041228086415,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
      4⤵
      PID:2148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,3654568434305401981,16627796853432993465,524288 --field-trial-handle=2356,i,6197070408908128317,14555140041228086415,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:14
      4⤵
      PID:4220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,2052029015447771836,11365398926158369107,524288 --field-trial-handle=2356,i,6197070408908128317,14555140041228086415,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:14
      4⤵
      PID:2332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,2052029015447771836,11365398926158369107,524288 --field-trial-handle=2356,i,6197070408908128317,14555140041228086415,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:14
      4⤵
      PID:5416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,6783263453830648223,2807974038777997040,524288 --field-trial-handle=2356,i,6197070408908128317,14555140041228086415,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:14
      4⤵
      PID:5304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6584,i,17191841115437385176,940280978046137836,524288 --field-trial-handle=2356,i,6197070408908128317,14555140041228086415,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:14
      4⤵
      PID:5048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4880,i,3707113518718980714,13590063413582747636,524288 --field-trial-handle=2356,i,6197070408908128317,14555140041228086415,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:14
      4⤵
      PID:5328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4884,i,16099790055909615780,15670106368002425924,524288 --field-trial-handle=2356,i,6197070408908128317,14555140041228086415,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:14
      4⤵
      PID:5620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4868,i,17710076156715391097,995903327604739908,524288 --field-trial-handle=2356,i,6197070408908128317,14555140041228086415,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:14
      4⤵
      PID:5668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2204,i,12441711751904787046,4742379892852000162,524288 --field-trial-handle=2356,i,6197070408908128317,14555140041228086415,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:14
      4⤵
      PID:1704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6760,i,9671069865388087409,15917245976626231315,524288 --field-trial-handle=2356,i,6197070408908128317,14555140041228086415,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:14
      4⤵
      PID:5044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5528,i,14956580082505979446,16524377997742823651,524288 --field-trial-handle=2356,i,6197070408908128317,14555140041228086415,262144 --variations-seed-version --mojo-platform-channel-handle=924 /prefetch:14
      4⤵
      PID:4292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6556,i,6368905066001939444,10217087513961596289,524288 --field-trial-handle=2356,i,6197070408908128317,14555140041228086415,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:14
      4⤵
      PID:2888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6752,i,5263293655703115535,17334843308041103975,262144 --field-trial-handle=2356,i,6197070408908128317,14555140041228086415,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:10
      4⤵
      PID:5176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,15778126030088396179,3429815715420986194,524288 --field-trial-handle=2356,i,6197070408908128317,14555140041228086415,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:14
      4⤵
      PID:2804

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5952

C:\Temp\lfdyvqnigaysqkic.sys
C:\Temp\lfdyvqnigaysqkic.sys
1⤵
- Executes dropped EXE
PID:2156

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1800

C:\Temp\ifaxspnhfd.sys
C:\Temp\ifaxspnhfd.sys
1⤵
- Executes dropped EXE
PID:3336

C:\Temp\xsqkhfcxus.sys
C:\Temp\xsqkhfcxus.sys
1⤵
- Executes dropped EXE
PID:2924

C:\Temp\ausmkhczus.sys
C:\Temp\ausmkhczus.sys
1⤵
- Executes dropped EXE
PID:1408

C:\Temp\xrpjhczwuo.sys
C:\Temp\xrpjhczwuo.sys
1⤵
- Executes dropped EXE
PID:1312

C:\Temp\ztjebztrlj.sys
C:\Temp\ztjebztrlj.sys
1⤵
- Executes dropped EXE
PID:720

C:\Temp\ywqojhbztr.sys
C:\Temp\ywqojhbztr.sys
1⤵
- Executes dropped EXE
PID:3384

C:\Temp\oigbytqolg.sys
C:\Temp\oigbytqolg.sys
1⤵
- Executes dropped EXE
PID:5580

C:\Temp\qnigaysqki.sys
C:\Temp\qnigaysqki.sys
1⤵
- Executes dropped EXE
PID:3144

C:\Temp\nigaysqfdx.sys
C:\Temp\nigaysqfdx.sys
1⤵
- Executes dropped EXE
PID:3388

C:\Temp\dxvpkicaus.sys
C:\Temp\dxvpkicaus.sys
1⤵
- Executes dropped EXE
PID:4568

C:\Temp\xrpkhfcxus.sys
C:\Temp\xrpkhfcxus.sys
1⤵
PID:1748

C:\Temp\xrpmkhbzur.sys
C:\Temp\xrpmkhbzur.sys
1⤵
PID:6084

C:\Temp\wrpjhbztrm.sys
C:\Temp\wrpjhbztrm.sys
1⤵
PID:1660

C:\Temp\omjhbzwurm.sys
C:\Temp\omjhbzwurm.sys
1⤵
PID:4508

C:\Temp\rojgbztrlj.sys
C:\Temp\rojgbztrlj.sys
1⤵
PID:5896

C:\Temp\igdyvqnljd.sys
C:\Temp\igdyvqnljd.sys
1⤵
PID:5012

C:\Temp\igaysqkida.sys
C:\Temp\igaysqkida.sys
1⤵
PID:5848

C:\Temp\fdxvpnifda.sys
C:\Temp\fdxvpnifda.sys
1⤵
PID:5116

C:\Temp\zxvpmkicau.sys
C:\Temp\zxvpmkicau.sys
1⤵
PID:3920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ausmkhczus.sys

Path C:\Temp\ausmkhczus.sys
Size 293KB
SHA256 56550274f4fb2c10338291a9b9ffeaba0b19c6737eecd9ce072f2cd56912e39d
MD5 96951f611f4cf7e12db10dce9f7c52be
SHA1 d52a4a84b5793b116bc4c7699338c8b8708d05df
SHA512 1981a07269d3a4140939121ae68c74a11790d21a848458b77157aa054011d7acbd2be736550ed527c201d1b63abe870d95361c938acae2f2f69d62775bc86adf
SSDEEP 3072:NtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:NIJjiJcbI03GBc3ucY5DCSj
TLSH
T1B5545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ifaxsqkicx.exe

Path C:\Temp\i_ifaxsqkicx.exe
Size 384KB
SHA256 e510343b65386797a78c0c2db6ec1d8992a5a01dd01b08d455419c647bab8b7c
MD5 96ac9bfe271231e56cd3be45ded2b545
SHA1 ca32f759455432848b6d1a11a72d12f9344f7e7a
SHA512 e65acb96cc85efa16546379a926b2f48b2346c4a4e6ab3670a929ac53f082e0a521ca3027832f0b6f44f988e6724f70d2b311ca8569f6c768a67fbfc4d3f6265
SSDEEP 3072:zjtF1eNGL8tpdhJmaMOk4y3tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/09:Xtf7ZIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B8847B00BAA4F0F6D995047800EFAF36A67E74281726CBC3E754CE5D9A113C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lfdxvpnifd.exe

Path C:\Temp\i_lfdxvpnifd.exe
Size 384KB
SHA256 e514ac9b8ee89202bf3b034df9c226a3c54e44893b2b44a34772ef37fdb32145
MD5 d8e53e66a895749cc637f99ddf11c6ef
SHA1 c6f10a1eb9036fce79f5e64c11393862c16fa00d
SHA512 f9ef03b3825df25ec35072e7f5ca2c9f51f090d13bfd404e4a58342209fb8b268c6e48c0dbdf23cdede396206af2fe1ebc40f79d521a7beec39379b12f50e6a0
SSDEEP 3072:VjtF1eNGL8tpdhJmaMOk4y3tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/09:ltf7ZIJjiJcbI03GBc3ucY5DCSjX
TLSH
T17C847B00BAA4F0F6D995047800EFAF36A67E74281726CBC3E754CE5D9A113C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pkhfcauspk.exe

Path C:\Temp\i_pkhfcauspk.exe
Size 384KB
SHA256 aa3b2700adaeca8343538cbf6677486027f1a95d8032be797698adfa8b87f082
MD5 278bd4fdc942040a1225bc1845fc2324
SHA1 63b4f8818b2ecdf51bc8171feb88030660581e34
SHA512 032a166bd84eaac4fa8e218dbed239a822cf18a109e0a614347b1e3d4176a80225ba42bc88d5c57c5473df8e5e2fdef347e165e343cb5fe50a36161affd66beb
SSDEEP 3072:HjtF1eNGL8tpdhJmaMOk4y3tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/09:Dtf7ZIJjiJcbI03GBc3ucY5DCSjX
TLSH
T138847B00BAA4F0F6D995047800EFAF36A67E74281726CBC3E754CE5D9A113C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_uomgezwrpj.exe

Path C:\Temp\i_uomgezwrpj.exe
Size 384KB
SHA256 32dd3081eb88ca46700d6b0b7a4ac3ac38b944262f7433f59201cd1eaa63ac51
MD5 57380d47bc67ada3811495075dab9cba
SHA1 3108bc8e72a15c1f44f7cc40f0caa71cee52ea7a
SHA512 830960ec68aec8158dc379d8c963d7bf38051c46118f3b6c2ff52d5f5dc2ab9f990604ae801160e96903ced359b0fdb6ba5d57464307b14750dab49730e86dee
SSDEEP 3072:EjtF1eNGL8tpdhJmaMOk4y3tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/09:4tf7ZIJjiJcbI03GBc3ucY5DCSjX
TLSH
T14E847B00BAA4F0F6D995047800EFAF36A67E74281726CBC3E754CE5D9A113C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zxrpjhczup.exe

Path C:\Temp\i_zxrpjhczup.exe
Size 384KB
SHA256 2a89cd6c6d95666793c81040fee9a6dc3c4d405eee99b3c7b412f6940c8c21ba
MD5 3c6c9b222c3d28faf7da58afa5ab6cce
SHA1 90df49a7caf1373608dbbd423fc5c12a6a8729c3
SHA512 4022f309b6205abd669ab01c80fbf9721ca7bc4f59483f5afae670aaf8c031ab043261c49f9f875232be5fa4dff68e93c407c05d6c23b86fb6eac6b8983621cc
SSDEEP 3072:9jtF1eNGL8tpdhJmaMOk4y3tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/09:ttf7ZIJjiJcbI03GBc3ucY5DCSjX
TLSH
T15E847B00BAA4F0F6D995047800EFAF36A67E74281726CBC3E754CE5D9A113C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ifaxspnhfd.sys

Path C:\Temp\ifaxspnhfd.sys
Size 293KB
SHA256 02b9a9b01dfecb0d5fc0f0000e19b9fce477200aac48fb93e7178a3173d7a7ce
MD5 3c37550d4e3cc75d038307bb726aa383
SHA1 15d2a27b006ad6a995059a62a780691a5a088c32
SHA512 4219895117df15d28bbe15360131432abd58e12469232f778a2d0d422b9c36a3745eff4999394ce6c3a7010024b92af81f00665b83362dd1008ca742686f44ab
SSDEEP 3072:ctKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:cIJjiJcbI03GBc3ucY5DCSj
TLSH
T129545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ifaxsqkicx.exe

Path C:\Temp\ifaxsqkicx.exe
Size 384KB
SHA256 17444e924c9c2b4bc452a68bfa94fa637eed0dc2fa857a7afb23140b92b0c515
MD5 d7b32d75f0649be11b95ce6bf4e53061
SHA1 cebe28410ca72f55aedacc6d93c077cc940d6308
SHA512 2704d3e52da32499f64d10fce909fd59a92b3a9f8552123552a4dfa24f8383d3dbc36e2f33d4f3db28beea620b98a2fdc0562ea97509bdfd34fef6c0f58f4404
SSDEEP 3072:5jtF1eNGL8tpdhJmaMOk4y3tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/09:Rtf7ZIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1CD847B00BAA4F0F6D995047800EFAF36A67E74281726CBC3E754CE5D9A113C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lfdxvpnifd.exe

Path C:\Temp\lfdxvpnifd.exe
Size 384KB
SHA256 6dca38a85e4396529bd075a3a3987ac2f19d8c0d13cb10542ee590ccd938b1fb
MD5 c06c1e8794aab1ecf2fc200406929ad2
SHA1 e33f688c8a9a8a8206ecec8210ab9927bb07e40b
SHA512 f4d112f5c76cd43af19acc75dfbe6da566742d1313bc6ce0c8398b3bb51d7bd4ddf2b5d59b52f29ebf5bd06ce1a727ad7c3036100e4db7d0137babd6fdaee8eb
SSDEEP 3072:BjtF1eNGL8tpdhJmaMOk4y3tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/09:5tf7ZIJjiJcbI03GBc3ucY5DCSjX
TLSH
T12E847B00BAA4F0F6D995047800EFAF36A67E74281726CBC3E754CE5D9A113C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lfdyvqnigaysqkic.exe

Path C:\Temp\lfdyvqnigaysqkic.exe
Size 384KB
SHA256 f9a9c0292e91dc4c401fe8edad16bbaf3ccb040b56f76f581c29ffc2785fa728
MD5 ecb3b964c85b82e627e64c5ee8a684d1
SHA1 bd8b0470adab6beef60b5d178d53bce4325a4939
SHA512 cbc5e248610271a1f24e91525600ed6dc77c74eecae81ffe186677ab220ae004f196da4d3c2915bdedcef0035e141aecde56f35b327aaf54ac0816311d04c6fe
SSDEEP 3072:ajtF1eNGL8tpdhJmaMOk4y3tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/09:Ktf7ZIJjiJcbI03GBc3ucY5DCSjX
TLSH
T181847B00BAA4F0F6D995047800EFAF36A67E74281726CBC3E754CE5D9A113C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lfdyvqnigaysqkic.sys

Path C:\Temp\lfdyvqnigaysqkic.sys
Size 293KB
SHA256 7f0c5c33ee1ee8b2848ba4dcfcf356f1a11df22beec977730afc02530ef0868a
MD5 598b414d0450da4cb907492780de88a9
SHA1 caf73f0a6dde112ec9100c8a7030ecc28bb837a9
SHA512 9427f2ec4610719635879bcd7108e351b10f1832238789ebd69d5c0b130664a8da367e24004f91ae6ee00086f2c63402790f47b150cabf4ef99a52def1876c5d
SSDEEP 3072:ytKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:yIJjiJcbI03GBc3ucY5DCSj
TLSH
T1DC545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljhbztrlje.exe

Path C:\Temp\ljhbztrlje.exe
Size 384KB
SHA256 df21cdebfa32d43f8e8fe566ea6c2ee59ca403c842c49a242a59f9c18b014236
MD5 c1d399bea8be140ece0db0daf58ffb13
SHA1 0317e7ac599a8752a28d648d68016febb4ff61d3
SHA512 0027773c58e10a08978d4749b2abece5539b4aad950dab39fe68e58cbd59d895f1897a7de7ff350a3b43773d37b636b5b429459b08bdabc5143617b5b3dc425c
SSDEEP 3072:jjtF1eNGL8tpdhJmaMOk4y3tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/09:ntf7ZIJjiJcbI03GBc3ucY5DCSjX
TLSH
T17B847B00BAA4F0F6D995047800EFAF36A67E74281726CBC3E754CE5D9A113C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkhfcauspk.exe

Path C:\Temp\pkhfcauspk.exe
Size 384KB
SHA256 5740c1077df501ef1d3876b11c328b5c014a8ed063d8054d585debc2b7f45de5
MD5 930226583cd59d26d6dd995707e43d07
SHA1 05a6a7503e351de217ea124fae3e0c3c6769f490
SHA512 bd360db46b5bc04771b2d80cafcea9c178be49aa58b53f722578393d1eba4617b7a3bced5867a4d9b6db4877339415179206f4c1255224b2bb9421e7e5205fd2
SSDEEP 3072:WIjtF1eNGL8tpdhJmaMOk4y3tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/D:WUtf7ZIJjiJcbI03GBc3ucY5DCSjXX
TLSH
T188847B00BAA4F0F6D995047800EFAF36A67E74281726CBC3E754CE5D9A113C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uomgezwrpj.exe

Path C:\Temp\uomgezwrpj.exe
Size 384KB
SHA256 3b1ca3689c66f91c31a17a5b65fa78f0ca2ffb42fca276170fac351ed3757681
MD5 b7c3fe1261da9a056d8a09bb276ef7e6
SHA1 945d4e31602dfc610a8e0d1d4004136baf3837d5
SHA512 ef2bcab21222a23efbdabf5dd3c1e78c4ed5342e3efde6dc2ddcbfa2b05e59a2773c8530929f0df4e7d8ef960934ae04c469330ddd9c48f0b5018fec619ba214
SSDEEP 3072:GjtF1eNGL8tpdhJmaMOk4y3tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/09:etf7ZIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A5847B00BAA4F0F6D995047800EFAF36A67E74281726CBC3E754CE5D9A113C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xrpjhczwuo.sys

Path C:\Temp\xrpjhczwuo.sys
Size 293KB
SHA256 27501846e3912964af72b69b4b1307aaba9aa7d87e543c1d3605d01b30f6ca9c
MD5 dcf2a9304d210630c47f829aecf82fac
SHA1 bbcc1ee85a8834ce160f42255dbab99b3186a7f3
SHA512 cc478a227c30debdf5a1a23082b42a4033ee0ce2ac1edde0ada98a47595c02d1673fd860da3bab7723837a14b34454a05d9e295940ebcce364e2d62b1a8c2c20
SSDEEP 3072:ptKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:pIJjiJcbI03GBc3ucY5DCSj
TLSH
T1F2545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xsqkhfcxus.sys

Path C:\Temp\xsqkhfcxus.sys
Size 293KB
SHA256 5c99afb1c7e27b1047dc494bdccd3bf96930f1d92dbf3c9fbaad7ff0645426f9
MD5 b9eb39408676badf36864bd3d7084b43
SHA1 096121228389d96dbdd6d108a4de5405119a5073
SHA512 d6014972c275dcbd553c15c773cd22f7c30e361e7517d2c9cf18c4fc5a423c540078036f8e34252fe3e99da93b6854e2dfb041a1446a56faa2c70a7177e71c8d
SSDEEP 3072:wtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:wIJjiJcbI03GBc3ucY5DCSj
TLSH
T11C545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ztjebztrlj.sys

Path C:\Temp\ztjebztrlj.sys
Size 293KB
SHA256 b1d3c4077180727c0059e05d8464e83f9f3836a0420d6ae23d3ff968ae937908
MD5 1e8364e88ec8a5e34d23c6d4e0399c12
SHA1 e46d8335cd81ce431ab084431404dc16f439b455
SHA512 2af52679d62a1b86272b0449d1ff2ef8807128592152a056a769c77fbdf2da56d14ecdb8d029392300157541f877d1c20918169c9b733f2dea86929ce84d5e2e
SSDEEP 3072:mtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:mIJjiJcbI03GBc3ucY5DCSj
TLSH
T187545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxrpjhczup.exe

Path C:\Temp\zxrpjhczup.exe
Size 384KB
SHA256 6611cb57b5c279bde15aa6d76fcf9fc5ed779b986065f30407facb9ad19689d6
MD5 5c7fd6d5e1cd7097350e42066cfd8bee
SHA1 3c9d50086460fc9d9f8785f1fd36fbedbfd82ad9
SHA512 5c023f324200558c9175716d14ee59f3c852c1fd3c3ea945b4765381a73502a9d532e20351215b302b6bf65a9cee1a14b031f98b6ccb68e5b5c59d33d9429e00
SSDEEP 3072:KjtF1eNGL8tpdhJmaMOk4y3tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/09:atf7ZIJjiJcbI03GBc3ucY5DCSjX
TLSH
T114847B00BAA4F0F6D995047800EFAF36A67E74281726CBC3E754CE5D9A113C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bba2e49c11cb10e1da3782e96a0839de38ec558ccceb0d68515b04792179f852
MD5 34d661b06bc0857903247c15b32b3124
SHA1 72b12aeb58848c0b8474acb525b5e3c41cf32367
SHA512 ff623932c1d85ab3c9cf10c993d26b94c5e1d9968c6a6f9a48925137edcf7379ba3bc8d216e7fc052000ec59dab883f4b498f2262f7941a46d3328c62092e788
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7U:fwUQC5VwBIiElEd2K57P7U
TLSH
T1E0B3A931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e75f270f1371188bd7f350113eee1f4d141652add7af8e5f7af0ab47dac6d1f2
MD5 e0e7da4c84e8882b494037c575bd294c
SHA1 04d43c383ac5d232ee362aad151519414dc6db2b
SHA512 70d9ca23de3befb782d3d04a586490c626e7c63ad00fac39b0fd9adeae2c1d8413a5d2474e847fabb4f48bbf1384f1fcd10e67765d21ed94ac67795b274b3c2e
TLSH
T122D09294BB60A90CCC81B0322AE66355BA1598A1182D868900A5F07A9CA8AC246179AF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e35119268ad2455b6ec4314361db946ee09b095b28e62d25bbd7542d6be959b9
MD5 5c633da04aeb5bea485c08ea28f57d24
SHA1 1c5287022e764ef0bb6d895cd993be007ab68eba
SHA512 341697613439896bbdc5bae2e067bf2b52fd4ee959460166157f5fcf5f0647d000c9824a7394abad2ea244ee761164649972236a37dd919e413ac011474bb4b7
TLSH
T12DD09B947B50A50CCC41703229E5535579155461581D45450055F0799C646C246175BF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 48bc0ddc7eb3840db627890dd2d78179f6a195723cecd31cd8fe6b321f53f6bc
MD5 ce5cce8d36e2c71bd4b3dba7a09ecd61
SHA1 81baf6841d720686debf1d2186069f877fbff0e5
SHA512 5537e09784dce922e289d7887a100af9c1bb4dd46cd01311c8781ec9b2eaca327af4d328d25996b595c68c983d899de21ef18bc316b71000187fb551c00560ca
TLSH
T16941C87063EA29EADB6C4177C7D07BAA72F8C4A946036E61C4482D74C90EF9CB7D0467
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 396fd0c8b5508c3629d7b38f30c1d17b8ab583c543a98afd7df2c207464bcee2
MD5 22787bbe3b040b20d9b8071554979336
SHA1 3c14aea3745927d1a5a43e6d45ba0c9887b17334
SHA512 190de7aefc83bf35a7d9d4f547cda33183a8b8e54ec7c2b955e6e1486d84e09b2f60b37ff1115a32c030a9205da222e91aa5edd95d20aa2581748e307ded6498
TLSH
T10151D0F3C7E8862D8D0156F0AB147E2BCE2D0914832C3D5AC8E4AF5B93E2471E24159F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 8c7781b50fa3494b06ad8588cc1f0f2b8424097eb32abb45496e315b4b7748aa
MD5 48e23e997564a5070ee071a9f2ed8989
SHA1 2044277dcad1454a63c9e5b0afb21b4caa05fa5f
SHA512 3578a4188aa6074f1a1d16dba6f543024b58468860aa2c29dd312f30080e26d4dfe6e2d84593fc08536d60fad92e562eae0a2269edc7a8411cb2b1132ed532ed
SSDEEP 384:sxRRxOIY8OE/f3vsXsBLFbQeTu/5sEl/ngeCK4e2:smkH/fCsBg/5Rgg2
TLSH
T1E662D915AA34997BCCDBD20DFA517F53D6F91523E2905E44AAFCCA0C04E6ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 33fba9ed29b7c139e593bd4907094a907f30d82d750c114693ebd775b762d0ef
MD5 c33485ad9cec306e40b2050f29527901
SHA1 b90ab0f0721791ffd3c57520b51fee7ea78f85d0
SHA512 e35e8781478345b43b504ae6d1237b14b69cde8f1da8d48308f534f74fa3d2e62f60cf105c3c2975e2fe87fc1816c0a8883db547c62979dd48f0689e74586082
SSDEEP 384:sxRRCOIYqCOE/f3vsOgGIBLFbQeFu/5sEl/nUeCK4Hu2:sFyCH/fc5B6/5RUc2
TLSH
T1E662C71AA934997B8CDBD20DFA517F53D2F95563D2905E44AAFCCB0C00E6ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 6ad6eb066ef19753a71e84dd6b579a2ce8ac9e0a99c5010488cf4889c6b20e94
MD5 d1b35a9732135f62b1dfdbee2666ad93
SHA1 e4c9f12dbe50edfe8adba24640aac3317c05d3e5
SHA512 7ced1c43d15c61157d426edc7c3ba6595b255a2dd70d9a160f3dafa96991dfea045835449edae4aafddbad3a5d70233167383e6a438641aa07d9e02a0502babc
SSDEEP 384:sxRRCOIY8OE/f3vsOgsBLFbQeTu/5sEl/ngeCK4HA2:sFkH/fcsBg/5RgS2
TLSH
T19662D906AA34997BCCDBD20DFA517F53D6F91563D2905E44AAFC8A0C04E6BDD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 cf011bef2581061307602091ef5043ea79b2b6f6471b1b269c46e5ea9b009430
MD5 e97bbc25a81d01858b9c98bdac750321
SHA1 db7f4e5204b994e5f582311f517035cde9a481ab
SHA512 36a00758d60d030e38021ed95c8bd6a1b5df7fc4c4a4c7df06819a4ad1f17093ef4666780df64c9d7454113ce470aeec1ccc54104def98510ce0cc9b81311908
SSDEEP 768:0hiiTW7pLuL7jaWgH7f3Q8F1+UoAYDCx9Tuqh0VfUC9xbog/OVGpZOV88ro86H:0hiiT2E7jaWgH7f3Qu1jadpZI8nB
TLSH
T125E2FB3B680CCB7E4F804ADCEC29BD9A6DE801CB96D88D9447EA840C03C67EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 9aeb65f058b4a94a7057c448ba0e5075ccc78d8ab5e66ee2f36fe9029bcdcff5
MD5 348378caae216567c4134d6b1d683c54
SHA1 655346d639dd04356da8e8214c8efbcff41b9810
SHA512 48c0a73ae4c7e84f1ad3298eb47c739a4d67bfabcd7b3cb139eba98ddf54eb6ca58513d948305db102d3def9cee5107ec5b46f34aa14afa35873ad5692f68241
SSDEEP 96:KRJGXThDXzWnUCgbzK4qgVzcZRsPXQH0VAE+imkWivPgMkK4BgGkckEP+nWQKnqP:CJGXThDXinUDbpqgVgZRsPXQH0VAE+in
TLSH
T18C91036570BA02403C7DA90C95F58C1B92D274E63554EA2F3BA861AA1F27E478DFCCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a9bb5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a9bb5.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 1aa7ca459db9a7d1aca41db45dcd12ea43eee47d6d3c1583e6c6a243b2300737
MD5 6bc06c5e98998049a1303a0207c29dfc
SHA1 e7301d8049492b8dfd61fe7c9765cea8f7a1b30d
SHA512 037bb70909a12e4e80208ef8f011e6c5f1bde205d5e656634b9cbdb3c428477eda23faf5bdf75f96d781978264522e5f2f3f5608ef5f109fbed7ce4a48166cb0
SSDEEP 768:7k3KcqG3rDkTGoK48dHeByERRFzjK3YMb9Mq:7k3SG/L48dHSyw/mb+q
TLSH
T180F2BEB0A8645DB34CABD24976937797AFE00173C5D89BA8E1DDEB0E444359C1B0BC2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 73058b204945a7ffdf31c5288ea32bfc50c49d04724bbdc67a747d105d7c513b
MD5 46c54d3914784b98f86f8055a85aad3a
SHA1 f4274ffe9edae582ecbf550362ebb4a3b2ead9f9
SHA512 51ceb060ce3b21a0a68e6be4f758cb2851d66db643f75ccc301119b385875a519c37bf9dea9efe5fea236a1d1de5a697ebe16235f4a2700ed5a7cb4b6711e7c8
SSDEEP 768:Qrv+4UNbdf3/qGaYDkT5K48dHeByERRFzjK3YUeVH1SCj:QbsbJ3yG5l48dHSyw/6EH1Z
TLSH
T16C03BE71A8A85E734CE792897643B617BFF4411386C41BA4C1DD6F4E828B4DC130BE2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 a722ece82c78eca254b76f7a22bd455f555a1790c598932023f8118e3e545491
MD5 f0cc909fef07adc672461d5a2e5bfbb9
SHA1 4e1c3558f75c994bbcb3c71c47fb5b9943ff9432
SHA512 c641459086b0a6f6c1956a41b9bc6ef05edc0225d7d68ecf24de90a36fcc32b44cd2d2a9bd1fe4a209293651dd25bbdeb3e88db8ddb445ca9d856431a03ac726
SSDEEP 768:mrv+4UNbdb39cqGCrDkTGoK48dHeByERRFzjK3YMeVH1SCX:mbsbt3rG6L48dHSyw/mEH11
TLSH
T15613CE70A8A8AE734CEBD2497643B787BFF4016384C44BA4D5D9AF4E85460DC1B0BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 1ea95d7ccc883b6a6123815f23b77449d86bd7eec642fa8d295524eff461c87c
MD5 b703d999de8b3777a7b7f710d18e79ab
SHA1 b1c9efe829baa4848473eee78a4a62143daf370f
SHA512 40f9867271685ab90794e0a4ce2377b84348d5a787e23d3b62fe3708280723bf6d8a13460d6c08f54fc72c83820169a57a30f265d663ed6ec7c12b5b9e03f69b
SSDEEP 768:GFQF3RwgIcqGYDKTGAK48dHeByERRFzjK3YMb9Mq:NF34G048dHSyw/mb+q
TLSH
T19D1339F198D78976D8AE8347677E6E469EFCC163B5889994B3C89D0CCC420BFC706825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

bacc9787-1acb-45d7-a7e1-dd2c5bc13d02.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\bacc9787-1acb-45d7-a7e1-dd2c5bc13d02.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3364_1349738468\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 34a6bd920c26cf01976ca2776d4b9466e894c28906c4d11dfbe95212217598cd
MD5 78c45e56a34f8577208475c9db8026ce
SHA1 69305b6d4eb3d1b909e5c1ab10ebf2cda798bef5
SHA512 e0e2a6abd74e041fb8aa09840c9b0b3074f2be5d00d35594178829486403bb533ae15f2922b09060298ef5f60dd97951beaad87499b7ed7ada80d1e158134b2d
TLSH
T1B771045356A9C5B3C19A5BF502835244F5FB23384763206047655586A730A3A54B8F18
MD5 SHA1 SHA512 TLSH

Submit Download

memory/720-299-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1312-277-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1408-292-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1408-263-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1660-414-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1748-390-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2156-69-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2924-236-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3144-335-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3336-189-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3384-316-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3388-341-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3920-500-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4508-434-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4568-370-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5012-450-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5116-483-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5580-320-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5848-471-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5896-445-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6084-410-0x0000000000010000-0x00000000000AB000-memory.dmp

Download