systex | 2b6389d41ad60d21618a119bec09cf3802390ef7e1af01d230698290366bb066

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 23:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_8d05f63313d836e82794e6a610541cda_amadey_darkgate_elex_smoke-loader_stop.exe
Size 384KB
Sample260814-3efbbabk9s
SHA256 2b6389d41ad60d21618a119bec09cf3802390ef7e1af01d230698290366bb066
MD5 8d05f63313d836e82794e6a610541cda
SHA1 100c096430c87d580656d106d09b6185f74b9fed
SHA512 f85b28a64286e5ee5e16730a5fbe6339072052a7ac983736551e4bbebcd2b08f7307468d32a65a4a40e9d4c448c3ae12d02cc2a99f99ccfab13d1e6e4b77402e
SSDEEP 3072:w9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:CctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T12A846A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
2652	caysqkifaxvpnlfc.exe
1732	caysqkifaxvpnlfc.sys
1824	CreateProcess.exe
5368	pnifavsnki.exe
3476	CreateProcess.exe
5844	CreateProcess.exe
1092	i_pnifavsnki.exe
2268	xvpnkfcxvp.sys
3632	CreateProcess.exe
4700	smkfdxvpnh.exe
1912	CreateProcess.exe
2248	CreateProcess.exe
4112	i_smkfdxvpnh.exe
3132	hcausnkeca.sys
5116	CreateProcess.exe
2084	uspkhfzusm.exe
3264	CreateProcess.exe
3312	CreateProcess.exe
5264	i_uspkhfzusm.exe
1932	mjhfzwupmh.sys
3088	CreateProcess.exe
4280	pjhczurmke.exe
5068	CreateProcess.exe
4308	CreateProcess.exe
4624	i_pjhczurmke.exe
4468	bztrmjecwu.sys
2672	CreateProcess.exe
4356	ywrojgbzwr.exe
2184	CreateProcess.exe
3652	CreateProcess.exe
5900	i_ywrojgbzwr.exe
1668	qojgbywqoj.sys
1112	CreateProcess.exe
3132	toljgbztqo.exe
4088	CreateProcess.exe
5128	CreateProcess.exe
5260	i_toljgbztqo.exe
3360	qoigbytrlj.sys
1432	CreateProcess.exe
4632	gdbvtrlgdb.exe
2288	CreateProcess.exe
4680	CreateProcess.exe
2380	i_gdbvtrlgdb.exe
2680	gdbvtqljdb.sys
3928	CreateProcess.exe
984	ayvqolgdyv.exe
936	CreateProcess.exe
4704	CreateProcess.exe
3056	i_ayvqolgdyv.exe
2732	xvqnlfdxvt.sys
4604	CreateProcess.exe
5768	sqkidavtnl.exe
4092	CreateProcess.exe
4864	CreateProcess.exe
5700	i_sqkidavtnl.exe
2956	kicaxvsnki.sys
6036	CreateProcess.exe
852	qkicausmkf.exe
5264	CreateProcess.exe
5208	CreateProcess.exe
3760	i_qkicausmkf.exe
3520	kfcxvpnhfa.sys
4964	CreateProcess.exe
1092	usmkhcausm.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3840_669046529\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3840_144931891\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3840_144931891\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3840_711367608\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3840_711367608\nav_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywrojgbzwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xusmkeczus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xusmkeczus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvqnlfdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_8d05f63313d836e82794e6a610541cda_amadey_darkgate_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnifavsnki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smkfdxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uspkhfzusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkidavtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkicausmkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomkecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljebwuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdbvtrlgdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ayvqolgdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmkhcausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbvtqlgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdywqlidby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvqnlfdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uspkhfzusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdywqlidby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkhfdxvpni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkhfdxvpni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkfdxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywrojgbzwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	toljgbztqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkidavtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmkhcausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmkfcxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljebwuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhczurmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_toljgbztqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ayvqolgdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkicausmkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbvtqlgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmkfcxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhczurmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdbvtrlgdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomkecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	caysqkifaxvpnlfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnifavsnki.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2612	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2352	ipconfig.exe
3064	ipconfig.exe
2700	ipconfig.exe
4396	ipconfig.exe
1668	ipconfig.exe
4480	ipconfig.exe
2920	ipconfig.exe
1936	ipconfig.exe
6004	ipconfig.exe
5936	ipconfig.exe
5716	ipconfig.exe
5944	ipconfig.exe
4788	ipconfig.exe
2536	ipconfig.exe
4144	ipconfig.exe
5596	ipconfig.exe
4516	ipconfig.exe
5428	ipconfig.exe
1444	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134312235337652604"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{93ABE9DD-51F7-4A5C-A7B1-A7ECEA1739FD}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1052	2026-08-14_8d05f63313d836e82794e6a610541cda_amadey_darkgate_elex_smoke-loader_stop.exe
1052	2026-08-14_8d05f63313d836e82794e6a610541cda_amadey_darkgate_elex_smoke-loader_stop.exe
1052	2026-08-14_8d05f63313d836e82794e6a610541cda_amadey_darkgate_elex_smoke-loader_stop.exe
1052	2026-08-14_8d05f63313d836e82794e6a610541cda_amadey_darkgate_elex_smoke-loader_stop.exe
1052	2026-08-14_8d05f63313d836e82794e6a610541cda_amadey_darkgate_elex_smoke-loader_stop.exe
1052	2026-08-14_8d05f63313d836e82794e6a610541cda_amadey_darkgate_elex_smoke-loader_stop.exe
1052	2026-08-14_8d05f63313d836e82794e6a610541cda_amadey_darkgate_elex_smoke-loader_stop.exe
1052	2026-08-14_8d05f63313d836e82794e6a610541cda_amadey_darkgate_elex_smoke-loader_stop.exe
1052	2026-08-14_8d05f63313d836e82794e6a610541cda_amadey_darkgate_elex_smoke-loader_stop.exe
1052	2026-08-14_8d05f63313d836e82794e6a610541cda_amadey_darkgate_elex_smoke-loader_stop.exe
1052	2026-08-14_8d05f63313d836e82794e6a610541cda_amadey_darkgate_elex_smoke-loader_stop.exe
1052	2026-08-14_8d05f63313d836e82794e6a610541cda_amadey_darkgate_elex_smoke-loader_stop.exe
1052	2026-08-14_8d05f63313d836e82794e6a610541cda_amadey_darkgate_elex_smoke-loader_stop.exe
1052	2026-08-14_8d05f63313d836e82794e6a610541cda_amadey_darkgate_elex_smoke-loader_stop.exe
1052	2026-08-14_8d05f63313d836e82794e6a610541cda_amadey_darkgate_elex_smoke-loader_stop.exe
1052	2026-08-14_8d05f63313d836e82794e6a610541cda_amadey_darkgate_elex_smoke-loader_stop.exe
1052	2026-08-14_8d05f63313d836e82794e6a610541cda_amadey_darkgate_elex_smoke-loader_stop.exe
1052	2026-08-14_8d05f63313d836e82794e6a610541cda_amadey_darkgate_elex_smoke-loader_stop.exe
1052	2026-08-14_8d05f63313d836e82794e6a610541cda_amadey_darkgate_elex_smoke-loader_stop.exe
1052	2026-08-14_8d05f63313d836e82794e6a610541cda_amadey_darkgate_elex_smoke-loader_stop.exe
1052	2026-08-14_8d05f63313d836e82794e6a610541cda_amadey_darkgate_elex_smoke-loader_stop.exe
1052	2026-08-14_8d05f63313d836e82794e6a610541cda_amadey_darkgate_elex_smoke-loader_stop.exe
1052	2026-08-14_8d05f63313d836e82794e6a610541cda_amadey_darkgate_elex_smoke-loader_stop.exe
1052	2026-08-14_8d05f63313d836e82794e6a610541cda_amadey_darkgate_elex_smoke-loader_stop.exe
1052	2026-08-14_8d05f63313d836e82794e6a610541cda_amadey_darkgate_elex_smoke-loader_stop.exe
1052	2026-08-14_8d05f63313d836e82794e6a610541cda_amadey_darkgate_elex_smoke-loader_stop.exe
1052	2026-08-14_8d05f63313d836e82794e6a610541cda_amadey_darkgate_elex_smoke-loader_stop.exe
1052	2026-08-14_8d05f63313d836e82794e6a610541cda_amadey_darkgate_elex_smoke-loader_stop.exe
1052	2026-08-14_8d05f63313d836e82794e6a610541cda_amadey_darkgate_elex_smoke-loader_stop.exe
1052	2026-08-14_8d05f63313d836e82794e6a610541cda_amadey_darkgate_elex_smoke-loader_stop.exe
1052	2026-08-14_8d05f63313d836e82794e6a610541cda_amadey_darkgate_elex_smoke-loader_stop.exe
1052	2026-08-14_8d05f63313d836e82794e6a610541cda_amadey_darkgate_elex_smoke-loader_stop.exe
1052	2026-08-14_8d05f63313d836e82794e6a610541cda_amadey_darkgate_elex_smoke-loader_stop.exe
1052	2026-08-14_8d05f63313d836e82794e6a610541cda_amadey_darkgate_elex_smoke-loader_stop.exe
1052	2026-08-14_8d05f63313d836e82794e6a610541cda_amadey_darkgate_elex_smoke-loader_stop.exe
1052	2026-08-14_8d05f63313d836e82794e6a610541cda_amadey_darkgate_elex_smoke-loader_stop.exe
1052	2026-08-14_8d05f63313d836e82794e6a610541cda_amadey_darkgate_elex_smoke-loader_stop.exe
1052	2026-08-14_8d05f63313d836e82794e6a610541cda_amadey_darkgate_elex_smoke-loader_stop.exe
1052	2026-08-14_8d05f63313d836e82794e6a610541cda_amadey_darkgate_elex_smoke-loader_stop.exe
1052	2026-08-14_8d05f63313d836e82794e6a610541cda_amadey_darkgate_elex_smoke-loader_stop.exe
1052	2026-08-14_8d05f63313d836e82794e6a610541cda_amadey_darkgate_elex_smoke-loader_stop.exe
1052	2026-08-14_8d05f63313d836e82794e6a610541cda_amadey_darkgate_elex_smoke-loader_stop.exe
1052	2026-08-14_8d05f63313d836e82794e6a610541cda_amadey_darkgate_elex_smoke-loader_stop.exe
1052	2026-08-14_8d05f63313d836e82794e6a610541cda_amadey_darkgate_elex_smoke-loader_stop.exe
1052	2026-08-14_8d05f63313d836e82794e6a610541cda_amadey_darkgate_elex_smoke-loader_stop.exe
1052	2026-08-14_8d05f63313d836e82794e6a610541cda_amadey_darkgate_elex_smoke-loader_stop.exe
1052	2026-08-14_8d05f63313d836e82794e6a610541cda_amadey_darkgate_elex_smoke-loader_stop.exe
1052	2026-08-14_8d05f63313d836e82794e6a610541cda_amadey_darkgate_elex_smoke-loader_stop.exe
1052	2026-08-14_8d05f63313d836e82794e6a610541cda_amadey_darkgate_elex_smoke-loader_stop.exe
1052	2026-08-14_8d05f63313d836e82794e6a610541cda_amadey_darkgate_elex_smoke-loader_stop.exe
1052	2026-08-14_8d05f63313d836e82794e6a610541cda_amadey_darkgate_elex_smoke-loader_stop.exe
1052	2026-08-14_8d05f63313d836e82794e6a610541cda_amadey_darkgate_elex_smoke-loader_stop.exe
1052	2026-08-14_8d05f63313d836e82794e6a610541cda_amadey_darkgate_elex_smoke-loader_stop.exe
1052	2026-08-14_8d05f63313d836e82794e6a610541cda_amadey_darkgate_elex_smoke-loader_stop.exe
1052	2026-08-14_8d05f63313d836e82794e6a610541cda_amadey_darkgate_elex_smoke-loader_stop.exe
1052	2026-08-14_8d05f63313d836e82794e6a610541cda_amadey_darkgate_elex_smoke-loader_stop.exe
2652	caysqkifaxvpnlfc.exe
2652	caysqkifaxvpnlfc.exe
2652	caysqkifaxvpnlfc.exe
2652	caysqkifaxvpnlfc.exe
2652	caysqkifaxvpnlfc.exe
2652	caysqkifaxvpnlfc.exe
2652	caysqkifaxvpnlfc.exe
2652	caysqkifaxvpnlfc.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe
3840	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	1092	i_pnifavsnki.exe
Token: SeDebugPrivilege	4112	i_smkfdxvpnh.exe
Token: SeDebugPrivilege	5264	i_uspkhfzusm.exe
Token: SeDebugPrivilege	4624	i_pjhczurmke.exe
Token: SeDebugPrivilege	5900	i_ywrojgbzwr.exe
Token: SeDebugPrivilege	5260	i_toljgbztqo.exe
Token: SeDebugPrivilege	2380	i_gdbvtrlgdb.exe
Token: SeDebugPrivilege	3056	i_ayvqolgdyv.exe
Token: SeDebugPrivilege	5700	i_sqkidavtnl.exe
Token: SeDebugPrivilege	3760	i_qkicausmkf.exe
Token: SeDebugPrivilege	4384	i_usmkhcausm.exe
Token: SeDebugPrivilege	3740	i_xusmkeczus.exe
Token: SeDebugPrivilege	1084	i_wuomkecwuo.exe
Token: SeDebugPrivilege	1744	i_ljebwuomge.exe
Token: SeDebugPrivilege	5512	i_ljdbvtqlgd.exe
Token: SeDebugPrivilege	1488	i_gdywqlidby.exe
Token: SeDebugPrivilege	5012	i_xvqnlfdyvq.exe
Token: SeDebugPrivilege	4416	i_qkhfdxvpni.exe
Token: SeDebugPrivilege	3860	i_pmkfcxvpnh.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3840	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1052 wrote to memory of 2652	1052	2026-08-14_8d05f63313d836e82794e6a610541cda_amadey_darkgate_elex_smoke-loader_stop.exe	89
PID 1052 wrote to memory of 1228	1052	2026-08-14_8d05f63313d836e82794e6a610541cda_amadey_darkgate_elex_smoke-loader_stop.exe	90
PID 1228 wrote to memory of 3840	1228	iexplore.exe	91
PID 3840 wrote to memory of 1068	3840	msedge.exe	92
PID 3840 wrote to memory of 2612	3840	msedge.exe	95
PID 3840 wrote to memory of 3020	3840	msedge.exe	96
PID 3840 wrote to memory of 3020	3840	msedge.exe	96
PID 3840 wrote to memory of 4460	3840	msedge.exe	93
PID 3840 wrote to memory of 4460	3840	msedge.exe	93
PID 3840 wrote to memory of 4460	3840	msedge.exe	93
PID 3840 wrote to memory of 260	3840	msedge.exe	98
PID 3840 wrote to memory of 260	3840	msedge.exe	98
PID 3840 wrote to memory of 52	3840	msedge.exe	97
PID 3840 wrote to memory of 260	3840	msedge.exe	98
PID 3840 wrote to memory of 52	3840	msedge.exe	97
PID 3840 wrote to memory of 52	3840	msedge.exe	97
PID 3840 wrote to memory of 4940	3840	msedge.exe	99
PID 3840 wrote to memory of 1968	3840	msedge.exe	100
PID 3840 wrote to memory of 4940	3840	msedge.exe	99
PID 3840 wrote to memory of 4940	3840	msedge.exe	99
PID 3840 wrote to memory of 1968	3840	msedge.exe	100
PID 3840 wrote to memory of 1968	3840	msedge.exe	100
PID 3840 wrote to memory of 3516	3840	msedge.exe	101
PID 3840 wrote to memory of 3516	3840	msedge.exe	101
PID 3840 wrote to memory of 3516	3840	msedge.exe	101
PID 3840 wrote to memory of 664	3840	msedge.exe	103
PID 3840 wrote to memory of 664	3840	msedge.exe	103
PID 3840 wrote to memory of 4564	3840	msedge.exe	104
PID 3840 wrote to memory of 4564	3840	msedge.exe	104
PID 3840 wrote to memory of 4564	3840	msedge.exe	104
PID 3840 wrote to memory of 4480	3840	msedge.exe	108
PID 2652 wrote to memory of 1824	2652	caysqkifaxvpnlfc.exe	109
PID 3840 wrote to memory of 5208	3840	msedge.exe	111
PID 3840 wrote to memory of 1080	3840	msedge.exe	112
PID 3840 wrote to memory of 4604	3840	msedge.exe	113
PID 3840 wrote to memory of 5208	3840	msedge.exe	111
PID 3840 wrote to memory of 1080	3840	msedge.exe	112
PID 3840 wrote to memory of 4604	3840	msedge.exe	113
PID 5368 wrote to memory of 3476	5368	pnifavsnki.exe	115
PID 3840 wrote to memory of 2700	3840	msedge.exe	120
PID 3840 wrote to memory of 2700	3840	msedge.exe	120
PID 2652 wrote to memory of 5844	2652	caysqkifaxvpnlfc.exe	121
PID 3840 wrote to memory of 4672	3840	msedge.exe	123
PID 3840 wrote to memory of 4672	3840	msedge.exe	123
PID 3840 wrote to memory of 4672	3840	msedge.exe	123
PID 2652 wrote to memory of 3632	2652	caysqkifaxvpnlfc.exe	126
PID 4700 wrote to memory of 1912	4700	smkfdxvpnh.exe	128
PID 2652 wrote to memory of 2248	2652	caysqkifaxvpnlfc.exe	131
PID 2652 wrote to memory of 5116	2652	caysqkifaxvpnlfc.exe	135
PID 2084 wrote to memory of 3264	2084	uspkhfzusm.exe	137
PID 2652 wrote to memory of 3312	2652	caysqkifaxvpnlfc.exe	140
PID 2652 wrote to memory of 3088	2652	caysqkifaxvpnlfc.exe	145
PID 4280 wrote to memory of 5068	4280	pjhczurmke.exe	147
PID 2652 wrote to memory of 4308	2652	caysqkifaxvpnlfc.exe	150
PID 3840 wrote to memory of 1272	3840	msedge.exe	152
PID 3840 wrote to memory of 5600	3840	msedge.exe	153
PID 3840 wrote to memory of 3392	3840	msedge.exe	154
PID 2652 wrote to memory of 2672	2652	caysqkifaxvpnlfc.exe	157
PID 4356 wrote to memory of 2184	4356	ywrojgbzwr.exe	159
PID 2652 wrote to memory of 3652	2652	caysqkifaxvpnlfc.exe	162
PID 2652 wrote to memory of 1112	2652	caysqkifaxvpnlfc.exe	166
PID 3132 wrote to memory of 4088	3132	toljgbztqo.exe	168
PID 2652 wrote to memory of 5128	2652	caysqkifaxvpnlfc.exe	171
PID 2652 wrote to memory of 1432	2652	caysqkifaxvpnlfc.exe	175

C:\Users\Admin\AppData\Local\Temp\2026-08-14_8d05f63313d836e82794e6a610541cda_amadey_darkgate_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_8d05f63313d836e82794e6a610541cda_amadey_darkgate_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1052
- C:\Temp\caysqkifaxvpnlfc.exe
  C:\Temp\caysqkifaxvpnlfc.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2652
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pnifavsnki.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1824
  - - C:\Temp\pnifavsnki.exe
      C:\Temp\pnifavsnki.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5368
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3476
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4144
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pnifavsnki.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5844
  - - C:\Temp\i_pnifavsnki.exe
      C:\Temp\i_pnifavsnki.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1092
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\smkfdxvpnh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3632
  - - C:\Temp\smkfdxvpnh.exe
      C:\Temp\smkfdxvpnh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4700
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1912
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2352
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_smkfdxvpnh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2248
  - - C:\Temp\i_smkfdxvpnh.exe
      C:\Temp\i_smkfdxvpnh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4112
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\uspkhfzusm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5116
  - - C:\Temp\uspkhfzusm.exe
      C:\Temp\uspkhfzusm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2084
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3264
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5936
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_uspkhfzusm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3312
  - - C:\Temp\i_uspkhfzusm.exe
      C:\Temp\i_uspkhfzusm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5264
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pjhczurmke.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3088
  - - C:\Temp\pjhczurmke.exe
      C:\Temp\pjhczurmke.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4280
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5068
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2700
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pjhczurmke.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4308
  - - C:\Temp\i_pjhczurmke.exe
      C:\Temp\i_pjhczurmke.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4624
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ywrojgbzwr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2672
  - - C:\Temp\ywrojgbzwr.exe
      C:\Temp\ywrojgbzwr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4356
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2184
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4396
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ywrojgbzwr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3652
  - - C:\Temp\i_ywrojgbzwr.exe
      C:\Temp\i_ywrojgbzwr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5900
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\toljgbztqo.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1112
  - - C:\Temp\toljgbztqo.exe
      C:\Temp\toljgbztqo.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3132
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4088
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5716
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_toljgbztqo.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5128
  - - C:\Temp\i_toljgbztqo.exe
      C:\Temp\i_toljgbztqo.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5260
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gdbvtrlgdb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1432
  - - C:\Temp\gdbvtrlgdb.exe
      C:\Temp\gdbvtrlgdb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4632
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2288
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5596
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gdbvtrlgdb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4680
  - - C:\Temp\i_gdbvtrlgdb.exe
      C:\Temp\i_gdbvtrlgdb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2380
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ayvqolgdyv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3928
  - - C:\Temp\ayvqolgdyv.exe
      C:\Temp\ayvqolgdyv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:984
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:936
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4516
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ayvqolgdyv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4704
  - - C:\Temp\i_ayvqolgdyv.exe
      C:\Temp\i_ayvqolgdyv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3056
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqkidavtnl.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4604
  - - C:\Temp\sqkidavtnl.exe
      C:\Temp\sqkidavtnl.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5768
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4092
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1668
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqkidavtnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4864
  - - C:\Temp\i_sqkidavtnl.exe
      C:\Temp\i_sqkidavtnl.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5700
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qkicausmkf.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6036
  - - C:\Temp\qkicausmkf.exe
      C:\Temp\qkicausmkf.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:852
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5264
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3064
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qkicausmkf.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5208
  - - C:\Temp\i_qkicausmkf.exe
      C:\Temp\i_qkicausmkf.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3760
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\usmkhcausm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4964
  - - C:\Temp\usmkhcausm.exe
      C:\Temp\usmkhcausm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1092
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5324
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5944
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_usmkhcausm.exe ups_ins
    3⤵
    PID:5168
  - - C:\Temp\i_usmkhcausm.exe
      C:\Temp\i_usmkhcausm.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4384
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xusmkeczus.exe ups_run
    3⤵
    PID:5880
  - - C:\Temp\xusmkeczus.exe
      C:\Temp\xusmkeczus.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2336
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4924
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4480
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xusmkeczus.exe ups_ins
    3⤵
    PID:6008
  - - C:\Temp\i_xusmkeczus.exe
      C:\Temp\i_xusmkeczus.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3740
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wuomkecwuo.exe ups_run
    3⤵
    PID:4532
  - - C:\Temp\wuomkecwuo.exe
      C:\Temp\wuomkecwuo.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3876
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3340
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4788
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wuomkecwuo.exe ups_ins
    3⤵
    PID:4252
  - - C:\Temp\i_wuomkecwuo.exe
      C:\Temp\i_wuomkecwuo.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1084
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljebwuomge.exe ups_run
    3⤵
    PID:2932
  - - C:\Temp\ljebwuomge.exe
      C:\Temp\ljebwuomge.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5528
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2148
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5428
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljebwuomge.exe ups_ins
    3⤵
    PID:5840
  - - C:\Temp\i_ljebwuomge.exe
      C:\Temp\i_ljebwuomge.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1744
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljdbvtqlgd.exe ups_run
    3⤵
    PID:1032
  - - C:\Temp\ljdbvtqlgd.exe
      C:\Temp\ljdbvtqlgd.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:400
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2572
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2920
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljdbvtqlgd.exe ups_ins
    3⤵
    PID:5872
  - - C:\Temp\i_ljdbvtqlgd.exe
      C:\Temp\i_ljdbvtqlgd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5512
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gdywqlidby.exe ups_run
    3⤵
    PID:1120
  - - C:\Temp\gdywqlidby.exe
      C:\Temp\gdywqlidby.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5992
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4812
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2536
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gdywqlidby.exe ups_ins
    3⤵
    PID:5032
  - - C:\Temp\i_gdywqlidby.exe
      C:\Temp\i_gdywqlidby.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1488
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvqnlfdyvq.exe ups_run
    3⤵
    PID:3256
  - - C:\Temp\xvqnlfdyvq.exe
      C:\Temp\xvqnlfdyvq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5600
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2556
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1936
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xvqnlfdyvq.exe ups_ins
    3⤵
    PID:5008
  - - C:\Temp\i_xvqnlfdyvq.exe
      C:\Temp\i_xvqnlfdyvq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5012
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qkhfdxvpni.exe ups_run
    3⤵
    PID:5716
  - - C:\Temp\qkhfdxvpni.exe
      C:\Temp\qkhfdxvpni.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4344
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4160
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1444
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qkhfdxvpni.exe ups_ins
    3⤵
    PID:6048
  - - C:\Temp\i_qkhfdxvpni.exe
      C:\Temp\i_qkhfdxvpni.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4416
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pmkfcxvpnh.exe ups_run
    3⤵
    PID:1844
  - - C:\Temp\pmkfcxvpnh.exe
      C:\Temp\pmkfcxvpnh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4568
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5332
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6004
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pmkfcxvpnh.exe ups_ins
    3⤵
    PID:840
  - - C:\Temp\i_pmkfcxvpnh.exe
      C:\Temp\i_pmkfcxvpnh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3860
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ff8eaa5c188,0x7ff8eaa5c194,0x7ff8eaa5c1a0
      4⤵
      PID:1068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1608,i,2388382584430141941,10407572604244565412,262144 --field-trial-handle=2172,i,2271476094719462214,8738941539324176693,262144 --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:2
      4⤵
      PID:4460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1928,i,14103177974586330442,10920029046332487774,524288 --field-trial-handle=2172,i,2271476094719462214,8738941539324176693,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:11
      4⤵
      System Time Discovery
      PID:2612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2512,i,8333621114439319099,9109588424450413627,524288 --field-trial-handle=2172,i,2271476094719462214,8738941539324176693,262144 --variations-seed-version --mojo-platform-channel-handle=3128 /prefetch:13
      4⤵
      PID:3020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3572,i,15314663626987979965,11189397570850933609,2097152 --field-trial-handle=2172,i,2271476094719462214,8738941539324176693,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
      4⤵
      PID:52
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3592,i,16154508704457288480,6209682534485992428,2097152 --field-trial-handle=2172,i,2271476094719462214,8738941539324176693,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
      4⤵
      PID:260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4288,i,4953031766419002399,14013514444877677867,2097152 --field-trial-handle=2172,i,2271476094719462214,8738941539324176693,262144 --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:1
      4⤵
      PID:4940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4300,i,122608602558474664,14749071536077460057,2097152 --field-trial-handle=2172,i,2271476094719462214,8738941539324176693,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:9
      4⤵
      PID:1968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5420,i,9554622793790975549,4238991978996014591,2097152 --field-trial-handle=2172,i,2271476094719462214,8738941539324176693,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
      4⤵
      PID:3516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3680,i,2036590434717250731,13534127887197927555,524288 --field-trial-handle=2172,i,2271476094719462214,8738941539324176693,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:14
      4⤵
      PID:664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4428,i,8116250275819688291,15580185552823651371,2097152 --field-trial-handle=2172,i,2271476094719462214,8738941539324176693,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
      4⤵
      PID:4564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,7827161428401353843,17430048144858293981,524288 --field-trial-handle=2172,i,2271476094719462214,8738941539324176693,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:14
      4⤵
      PID:5880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,7827161428401353843,17430048144858293981,524288 --field-trial-handle=2172,i,2271476094719462214,8738941539324176693,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:14
      4⤵
      PID:4480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,8084025552466645027,6470885549531805907,524288 --field-trial-handle=2172,i,2271476094719462214,8738941539324176693,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:14
      4⤵
      PID:5208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3796,i,14111162820258016709,14360767697056232709,524288 --field-trial-handle=2172,i,2271476094719462214,8738941539324176693,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:14
      4⤵
      PID:1080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5680,i,1370187576810404446,16912463925706564820,524288 --field-trial-handle=2172,i,2271476094719462214,8738941539324176693,262144 --variations-seed-version --mojo-platform-channel-handle=3816 /prefetch:14
      4⤵
      PID:4604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,2717048660001390292,18017554420586556259,524288 --field-trial-handle=2172,i,2271476094719462214,8738941539324176693,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:14
      4⤵
      PID:2700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5452,i,5244322265867164058,8717053055602064286,2097152 --field-trial-handle=2172,i,2271476094719462214,8738941539324176693,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:1
      4⤵
      PID:4672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4840,i,1936479005607193901,8875387393405860975,524288 --field-trial-handle=2172,i,2271476094719462214,8738941539324176693,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
      4⤵
      PID:1272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4896,i,16568653915527336858,2198245691006375960,524288 --field-trial-handle=2172,i,2271476094719462214,8738941539324176693,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:14
      4⤵
      PID:5600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,15031614799177908087,6541265475674554593,524288 --field-trial-handle=2172,i,2271476094719462214,8738941539324176693,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:14
      4⤵
      PID:3392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,7301789719642162606,4724739511428506946,524288 --field-trial-handle=2172,i,2271476094719462214,8738941539324176693,262144 --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:14
      4⤵
      PID:4612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2448,i,11755940808825408853,6507164851535817537,524288 --field-trial-handle=2172,i,2271476094719462214,8738941539324176693,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:14
      4⤵
      PID:4860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6112,i,460159105388417111,17825727963868915418,262144 --field-trial-handle=2172,i,2271476094719462214,8738941539324176693,262144 --variations-seed-version --mojo-platform-channel-handle=920 /prefetch:10
      4⤵
      PID:3860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3556,i,2088270639669028114,14785168374498936454,524288 --field-trial-handle=2172,i,2271476094719462214,8738941539324176693,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:14
      4⤵
      PID:3516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,13345379781631414552,3954945297000602995,524288 --field-trial-handle=2172,i,2271476094719462214,8738941539324176693,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:14
      4⤵
      PID:4424

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6096

C:\Temp\caysqkifaxvpnlfc.sys
C:\Temp\caysqkifaxvpnlfc.sys
1⤵
- Executes dropped EXE
PID:1732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1844

C:\Temp\xvpnkfcxvp.sys
C:\Temp\xvpnkfcxvp.sys
1⤵
- Executes dropped EXE
PID:2268

C:\Temp\hcausnkeca.sys
C:\Temp\hcausnkeca.sys
1⤵
- Executes dropped EXE
PID:3132

C:\Temp\mjhfzwupmh.sys
C:\Temp\mjhfzwupmh.sys
1⤵
- Executes dropped EXE
PID:1932

C:\Temp\bztrmjecwu.sys
C:\Temp\bztrmjecwu.sys
1⤵
- Executes dropped EXE
PID:4468

C:\Temp\qojgbywqoj.sys
C:\Temp\qojgbywqoj.sys
1⤵
- Executes dropped EXE
PID:1668

C:\Temp\qoigbytrlj.sys
C:\Temp\qoigbytrlj.sys
1⤵
- Executes dropped EXE
PID:3360

C:\Temp\gdbvtqljdb.sys
C:\Temp\gdbvtqljdb.sys
1⤵
- Executes dropped EXE
PID:2680

C:\Temp\xvqnlfdxvt.sys
C:\Temp\xvqnlfdxvt.sys
1⤵
- Executes dropped EXE
PID:2732

C:\Temp\kicaxvsnki.sys
C:\Temp\kicaxvsnki.sys
1⤵
- Executes dropped EXE
PID:2956

C:\Temp\kfcxvpnhfa.sys
C:\Temp\kfcxvpnhfa.sys
1⤵
- Executes dropped EXE
PID:3520

C:\Temp\zxupmkecwu.sys
C:\Temp\zxupmkecwu.sys
1⤵
PID:5900

C:\Temp\ecwurmkecw.sys
C:\Temp\ecwurmkecw.sys
1⤵
PID:1120

C:\Temp\romgebwtom.sys
C:\Temp\romgebwtom.sys
1⤵
PID:5000

C:\Temp\trljebwuom.sys
C:\Temp\trljebwuom.sys
1⤵
PID:2000

C:\Temp\gdywqolgdy.sys
C:\Temp\gdywqolgdy.sys
1⤵
PID:3360

C:\Temp\fdxvqnlfdy.sys
C:\Temp\fdxvqnlfdy.sys
1⤵
PID:2704

C:\Temp\pnlfcausqk.sys
C:\Temp\pnlfcausqk.sys
1⤵
PID:4972

C:\Temp\xvpnhfaxvp.sys
C:\Temp\xvpnhfaxvp.sys
1⤵
PID:5620

C:\Temp\spkicauspk.sys
C:\Temp\spkicauspk.sys
1⤵
PID:3372

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CreateProcess.exe

Path C:\Temp\CreateProcess.exe
Size 3KB
SHA256 7a4f92204a82e01a3623b4a0b5f8350400ef6b437f468d93053bc1074f7c1088
MD5 47134220660667a805c0bc9fc67337f5
SHA1 5703db6a3fb259f174628d2928aaec4bb0e29654
SHA512 93d3fcd131180602f8c1a120d3c97f7a9168a0e0ca9cf354a37802613decc107124e56752e26abeb9e23fce041f1b881d5f549a916018f713cb2fe23f4a4d19a
TLSH
T11871239356B8CAB3C6DE5BF502835248F2FB22384763702407665587AB70F3A58B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

bztrmjecwu.sys

Path C:\Temp\bztrmjecwu.sys
Size 293KB
SHA256 c9e0778896d463ad406a182c159fc641686c3e3b4f7fb05eb8a166c0a7199cd5
MD5 09c805835016fd6aed8cdf189d7e07d1
SHA1 33bb11a8df75bce0e6f6a417b255f054862b521f
SHA512 b33f72f997439d84411b1e2426c09363743bcf1997fa310f468733a578e32eeadc9184847b9948e3cff95e83bc20da1da4a22c116c75003d41ea9b0ced15a6da
SSDEEP 3072:gtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:gIJjiJcbI03GBc3ucY5DCSj
TLSH
T1A2545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

caysqkifaxvpnlfc.exe

Path C:\Temp\caysqkifaxvpnlfc.exe
Size 384KB
SHA256 39b72bffe72fdc6a97095bb96de8ba9de80ae49d26867bf33490bcd08c498a09
MD5 6e37e7e22d6ccc18765c289d569c48b5
SHA1 ec754524fd618ecd7f26c42707ac7ce5b598c3e9
SHA512 733d998d5d68c1323c5376702624dc003e00fa5ed66841d020cca3ff2105e8eb1d5b41c42e5c2372b3d6e6cb98b38441a8aa77c062a2bbaeb18cad03c90d4f84
SSDEEP 3072:I9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:KctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T15A847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

caysqkifaxvpnlfc.sys

Path C:\Temp\caysqkifaxvpnlfc.sys
Size 293KB
SHA256 92baf0bee898c43bab21c8c9300338e39d7655dc755aff6982e79546d62ab517
MD5 6f600c870d1358db321b42b5c61a91e2
SHA1 9923411639564a4be785738da70d17f28991399a
SHA512 878f27e70a9cb18bb23be30225bd107a0f8aacc054b9a6f327014bc8de909c53a0ec3179967c3197169c0b419121453c20275a4edda70408a5a116b7a21c5d8f
SSDEEP 3072:OtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:OIJjiJcbI03GBc3ucY5DCSj
TLSH
T125545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hcausnkeca.sys

Path C:\Temp\hcausnkeca.sys
Size 293KB
SHA256 8b9e2e3b4b241681d967cbe6f580e26d13e1b1e2520f94d4f0397a645f964e5f
MD5 4573748ce2e2881f1b0386fb93fdd5c8
SHA1 d2e26fc030017400acfc040dcd7ca8297e237d1f
SHA512 0d5250fc306cca018ec7e4adb1bd4ff3b10cc204e58649238434a0c4faa5c713bdf7ad675daa4cc981038f0b173fa4bfe3e4f714b85cacf841e6db80bd4d935f
SSDEEP 3072:htKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:hIJjiJcbI03GBc3ucY5DCSj
TLSH
T167545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pjhczurmke.exe

Path C:\Temp\i_pjhczurmke.exe
Size 384KB
SHA256 b142d059571c52e6ee46dfd2125fad2603ae9d9fe8b45eae2c53232a986dc875
MD5 d6a4c9f0c1aeeff187be0ce7c8254823
SHA1 7da4bb825427f4ba0475342bea3549f397c61d85
SHA512 63662d68abe0f63f50ca9fbf0cb17093a250ece25fe7daf21a0fe2ca015a5ccec15cecb231ea4e82b90eea3aef84d9d20a275e0a3577578c160aeb15a6943255
SSDEEP 3072:V9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:3ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T17A847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pnifavsnki.exe

Path C:\Temp\i_pnifavsnki.exe
Size 384KB
SHA256 bdac8c607867c10e0f8f9592dcc9af2f01b5e33a3a2c1d3ba5fe0342792e5064
MD5 2cc748991e14847c64326dd99993b407
SHA1 1d38e4fc76d6e86a96dbe0c6f7257c99e7d24f3f
SHA512 c3bc4e8d6b2545979a28eacc9d5830ce715371301b97b73021feaf9969cdcdc8a31dc916f019ffa4837b22996dea1190fd80b960bcb92b3334c0d097261cc550
SSDEEP 3072:E9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:ectFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T111847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_smkfdxvpnh.exe

Path C:\Temp\i_smkfdxvpnh.exe
Size 384KB
SHA256 bcd4610f47d6596fb47800a4c0771d74dc435408a70aaebcd1fd36e79af7fe20
MD5 dacb73ae6ac9fe56ade1032d34c84794
SHA1 633cf92a3218fbbe64b8bd12e6bd61d963d3f6e8
SHA512 7536089f5fba70a65e1e507436f513b5ea03f939b71242ec9b88420e0b9a91af0845b6f3d2d8821848f903043ca2aeb871e9012f983e36bfee4dc96eb17f242a
SSDEEP 3072:t9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:/ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B6847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_uspkhfzusm.exe

Path C:\Temp\i_uspkhfzusm.exe
Size 384KB
SHA256 31e59063db436f3e1e489579550bc62bfdd9ddce80de150bdb612c133e0d37be
MD5 954d32c4a553ec03dcdc33320552be56
SHA1 67919c769ab1b778badf1278c7f226d5f85888fc
SHA512 07850cfd9bccdbdbb7065fd28a68fe748f229df76931284da429e945a1699345374d733b909f4844ea1765b1f36da9936e6162140d9edb766e98c3512e97f3d9
SSDEEP 3072:39ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:NctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T138847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ywrojgbzwr.exe

Path C:\Temp\i_ywrojgbzwr.exe
Size 384KB
SHA256 0bcf6963df87ee9a269d150a5ce207c1f04d1c3233deceea281b57301d67a151
MD5 75c4a96e4e712a3129b4d96b8b145499
SHA1 038d480ea8116b44221659684a3594df982d0a75
SHA512 0580468bbc69f80bd53cc5bc311231e7d6479dcaced4709d9170c6812ef9b486aca5b0dd92636ca21b71980bfd907c29940eab470a4d5378d54af04d85f458d8
SSDEEP 3072:J9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:jctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T184847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mjhfzwupmh.sys

Path C:\Temp\mjhfzwupmh.sys
Size 293KB
SHA256 3716a52d40c20873ba96d7a95a2869d2d8b29c31c028773214cbbc6471897b77
MD5 50e45d48f0cadee9954449fde7de2af3
SHA1 5b22e8a066b3c7f36160654849d8b5a64062c5b7
SHA512 e9ce4044c4d0cadfd516db06370679555c69641d032ac697843b2313b4d600222a5f86d6337f1c773dab8c000e86984398e019755cb7f7c1e6766f73f666bcb0
SSDEEP 3072:CtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:CIJjiJcbI03GBc3ucY5DCSj
TLSH
T162545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pjhczurmke.exe

Path C:\Temp\pjhczurmke.exe
Size 384KB
SHA256 8ed6e71cf85760dbbd7f15318bb6f051f6512078c635dc1eae44af10c80a9c14
MD5 003430ce6545d1e42b2fe8725f195a18
SHA1 3066b002ebd48a13ff8dabdb6f232b511da535a9
SHA512 b1a828ecd03548e9ef8a413fb3a707edf1c82fb660218e3d10ee0903eb75f6ea69088335aafc896283a05c5bbdafccda3106489aeec16a0aef97b6d4cdc0ff53
SSDEEP 3072:39ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:NctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T14E847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnifavsnki.exe

Path C:\Temp\pnifavsnki.exe
Size 384KB
SHA256 9b42ddf7045ce6633c2d9aa1f569eb7c3044788e3cbbdbb4769b57cd60d48dc2
MD5 4b807d8b8f471ba33ae92178c09d19aa
SHA1 1b6307d1ae121466f4d294db5ee91b886b08f0b9
SHA512 34b1f27f664a02312a0007097b9af8c33e8361767a2d62c267bc522dffd3532e64dbaee06b1c61d171fc904b3517004f2c2b14347af95fcf50da94d284b5ee35
SSDEEP 3072:U9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:uctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T187847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qojgbywqoj.sys

Path C:\Temp\qojgbywqoj.sys
Size 293KB
SHA256 c430d6e482867cd9e1b8b145f27e082b1cd6f16ddbf626fea028959dfb8b7571
MD5 7942b692ec970c5776361e144286f94c
SHA1 435e1516b641dc81c2f82951674e00eff0ea023a
SHA512 4ebfbced79da0ed82c65af7e987676dbb1950655067ab73a6c072c550bab9f03e3a5860485578eb2913aed105baaba6b6d2a3ccd4e20f7876e072bdbfe391a4e
SSDEEP 3072:ntKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:nIJjiJcbI03GBc3ucY5DCSj
TLSH
T182545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

smkfdxvpnh.exe

Path C:\Temp\smkfdxvpnh.exe
Size 384KB
SHA256 20908d98dfe1dcc01ee14af5b927d67a3fa65200ab4dbb7d38a7e4d8d7042890
MD5 c5e7abb691ed064c9ff229ecf5a80fcb
SHA1 7ee363a289085793379bcd9cccf2c3578145fc3a
SHA512 d0556ad724e0db60064fe6c5070c2d096d1b3204abb7758a9bbde450f7a0605e2299b0555a06a1d1324888a9c418b5a9988b334956199179106fa36b8c02a139
SSDEEP 3072:89ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:GctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T169847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uspkhfzusm.exe

Path C:\Temp\uspkhfzusm.exe
Size 384KB
SHA256 c1c1fd8a78e8f169827a55aa9d8ab1aacb4635df8a9cbb1bf8bbfa9fff12a771
MD5 89d2f69b32e586895915b055670d972e
SHA1 3f0e88d65cd54d4f18064cd63d777c214d20b6b2
SHA512 2767ad496c1a4e5601ec847302ac1b29dd1cb03199979ea6714602c5b4a442c8a3712294603df64d2ac8491e5f4db926a71060c794a459b7f553526ca8ef5350
SSDEEP 3072:dR9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx96:dbctFtIJjiJcbI03GBc3ucY5DCSjXM
TLSH
T1ED847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvpnkfcxvp.sys

Path C:\Temp\xvpnkfcxvp.sys
Size 293KB
SHA256 9475727c743bd69f115c0f6a3639902f0d694312f8e05a6e4d75b228a857bd77
MD5 a40ea90982c4cd7e6450094311650257
SHA1 6e1c8ad006b60271b9d070516db3bd5b12e4e832
SHA512 fa83584c13229ef14e6f6ba34f4e89cde52c236225d1d1598e5338bdda00cb12213d31e8a246e3461b2709aa6e3165ea538a887fd322075b4bafe400d0efd80a
SSDEEP 3072:gtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:gIJjiJcbI03GBc3ucY5DCSj
TLSH
T157545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywrojgbzwr.exe

Path C:\Temp\ywrojgbzwr.exe
Size 384KB
SHA256 7a3507f6cc41af963a0465ff500b4b4b0ff0ac4d9006426b7584c7ec690e35b8
MD5 b0e2685ed5593e88747655eaf568f536
SHA1 f99c3d8faebf659b05a76081d4946599a67d5e79
SHA512 8679fad4ba584142aa83605f24186842c775b0bbd78377e40c0c87693e487f0b5108a34e6ae0b9933fc61c4a3cbc2d3778c96cc6892f2d59d53ef000b29ab15e
SSDEEP 3072:u9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:MctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T148847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 e0424f12e2966d4edd61d48eb03e7a78e7aa9d384165acd4a8973fc664dca54a
MD5 7acb47b9e36d0b80e2fc9707e9c8e89d
SHA1 551a4ce1b41fc63afca9012e67ab4229c732feb7
SHA512 9b137ab83de648a2382112e33229e3ec6225fb81e794374fa123d6e7e13e4de7bc9858a11d08d360a0f72c10415e71a0f49f1cffe9e27deeea1ca3cbacdcc9b3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7K:fwUQC5VwBIiElEd2K57P7K
TLSH
T16BB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 8b1c061b5411183d08701c62c4c6954cb928d016ff6785740acfdd7bc8392b57
MD5 7ca24d01cda117c356d26fb552c4fea7
SHA1 695bb0a531f149afcbf0bbcc6a1f97ba9bac0cef
SHA512 574c9076b8db680ebc2132d37a97ef6415bd965d0a3a5c7b58a5d48c1295173a56f058e8c7e7fdf9efd70d54ea471773a426be4d6b41b2ef141bf831fb4b45e1
TLSH
T1DA612DD2A3A10AE2E7358EBF84E1F45737F8CC5A81B32E0474835E746462FE0A2D5163
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591563.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe591563.TMP
Size 3KB
SHA256 7942fece67e23f422ba6fe3112b027caa9668f5d57b8ecd0008d66a41299abb8
MD5 faadd5056e8550d16b968a27d8672cd6
SHA1 f1fdde925756c4091d0756872229059250364cec
SHA512 de7adae9446935895bc15d7d146197a9fd63a27dcf45d8c673c451039004f596eecdbfc311f98cd24d17ebc89b306d711f08221f1c54357ddabe9e6166ff8551
TLSH
T184612DD2A3A10AE2E7358EBA84E1F45737F8CC5A81B31E1474835E786462FE0A2D5163
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 2465de64393e45a40400e0a7ae2471df5e7b0cada020936c17a264f8c3a284ec
MD5 6c33693054f55bd1aa86aed49d45e758
SHA1 4b80a3e7ddc8dd0a230cf05acf97d51791cac23f
SHA512 04fc4fa4a5c33ec99b9c8210335c059c5bfcdcb02bf83d35a82891c0c79fdc9c0c2d08d9f3ca2871431d36cc2c3d6150058ce9cdbec5bf813394639e018e932f
TLSH
T171419EF7C3F4856E890196F0AA18AE1BCE2C0515432C7D5AC9E4AE2793E3471E141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 849c7c565053156680090b2fbae567f896ad399098567bd821ee8581d1945623
MD5 8944968b5d61522ad9c39cbb0564907c
SHA1 50cf6ab13ea0bd74ee5f2a3cd8c15f093ffa33bb
SHA512 fc222e8d9b9ad83da5a6307b18c29496e8aa18238a1f2071df169b86d02ce8a2f3837805a0180cc28897c8b5012a407ffe84ff3978433540cb776830b1ba074c
SSDEEP 192:sxRcRNyM/jK1Ml8wCe/fIsdYDBZBdzoA8p9b/g6+WNCn9/YndUJh7G1IgV2J:sxRcP8e/fIsdYDPaR/5c/0qYU
TLSH
T13462EA15AA3499778CDBD20DFA55BF93D6F91563A1901E44AAFCCB1C00E6AEC231381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 842242d64389489fd46fd263b09c6b0ad2d561f25d2193d816cdddeefb578089
MD5 aed2701be4266a9caed9072e9bc690df
SHA1 dfd05d30666aae1c27181247f157372781037d17
SHA512 efefb282f8125a1f37cde6e87581255c0c0b7e1f5f30ae293c825a8d3d8c09fa87b586d591f557c44ef95f14fc0e9db7fdb2a7ee850a04aad2bc06a64e02aa01
SSDEEP 192:sxRzRNyM/jK1Ml8wCe/fIsiYDBZBdzoA8p9b/g6+WNCn9/YndUJh7G1IgDk2J:sxRzP8e/fIsiYDPaR/5c/0qYb
TLSH
T1C462FA15AA3499778CDBD20DFA55BF93D6F914A3A1901E44AAFCCB1C00E6ADD231381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 3d8777dac4e6b8659f855057d8e8fe14cf3f326104df4263ee4fc355adfe62b8
MD5 92abccb6f27e6f8abe686f920ef7ea07
SHA1 a1e4042a86c296b0caf34c8a098c84c4f448d28b
SHA512 db58c421ae9dc58eb55a7cee6e16f35c897df3c095adf9147613df0bb333dfa0edac7841149d1e2e92d04f57297b2dbf999a4ca202e983fd8548ab77d4d1c67f
SSDEEP 192:sxRzRNyM/jK1Ml8UQROCe/fIsiY0BZBdzoA8prb/g6+WNCn9/Yndgxh7G1IgDG2J:sxRzPqfe/fIsiY0Pan/5c/0AYJ
TLSH
T18962E915AA2499778CDBE20DFA55BF93D6F914A391901E44AAFCCB1C00F6ADD231381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 e4294eabe2df8429eea749e8428c44e867b399cae8931a5394633ddbd39e159a
MD5 355ba755f63891af532f3ad77facc515
SHA1 c5c2350662a66d9adcecbdb086abd5ccbe84def5
SHA512 4cf642d5c14e9ba06f31b209d3e77dc08e75461046f6740fc9a5dc200c3e68c8196a57e3cf3343e1fc5462c6e3eb9e520cf3c390cc5ca5a7a27e74aa4b09a2f3
SSDEEP 768:wGedFg7pLuL7X6WgoufDM8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYDOu4YSroSg857:wGedFsE7X6WgoufDMu1ja3DOVYJ67
TLSH
T129E2DB3B684CCB7E4F804EDCEC29BE9E6DA801CB9AD88D5447EA840C03C57EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b834a953cfb1843ef40867755be272f1aae600eda5437fc1b410db9c1bb264de
MD5 72768825ffcbca5abff6c52199f98252
SHA1 cabebdcbbc728a2add778a5536776a41f6f93920
SHA512 f4f031ad57ef5e635f8cd266bff76ffe772eb1238c67d8bbdc5a4edee932be1706d0275f7d3c1a1ce074ebd76343612f51fcc35fafb7ca98ca2cfd760ddd907e
SSDEEP 96:KRdqjXNn7vWj4mgfvK4+gBvcldQzLkHm7KmgIIOW4tVgGOK47g0OcOGlkZmQKbKj:CdqjXNn7Oj4XfV+gBkldQzLkHm7KmgIZ
TLSH
T1BC91360175BA12443C7E762C81788A5FCA9278733155E46F37A841A64FABE024FFECC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 d779006999628d3bdbe0b95612094b771eca26ea9752d3de60eca371cbd4f530
MD5 737118e8a466eba558faebf73dddcd36
SHA1 7616d988d3211d20f12f84d2c537fbe37479a4df
SHA512 dc8370e97932f0576cf4de4fb692781c7bde86daca8bb07dc105e2c625062192ebebab4b46b3c5bf4d7d7857b8e16c5ca0713c6f50bd840dda928e107211dd93
SSDEEP 768:6rv+4UNbds3fwDZIO0tNzc4ReyIsXGeVH1S5D:6bsbS3htc44bsWEH1Y
TLSH
T12C03DF32AC789977ACF69686B50B36533EF8511B82D81F94C5DE2F0C464B1DD131B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 d0d423e92a7f65fc1612492acd85b3fd3518659fae5d652f587300aa797c6484
MD5 4136a0d23ea135ea394ee06d0bf7e696
SHA1 5fffaa624fbe0227bc8fb9495862dc57f784bf98
SHA512 e3846049d6e15393e42197e282ffc1334742526ebc031b195d64e43f1bf3502e65733b3e8c9b841771fcdf3255450a4a903d5ace8e7a11f5bbeb1c14ece91d48
SSDEEP 768:7A83udDZIO00hemNzc4ReyIsPZPi9Pttm:7A83Ydtc44bsBPKtm
TLSH
T15CF2BF70EC749C63ACFAAB86F5463792BEF41567D0C82E88D6ED9F0C05432AD175B812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 c00dfc05a21c21091f713947c75aeea2d32049dc36c0834d51545284dd479e37
MD5 b1d91df0a04b8db34380258f97b075a2
SHA1 f0eaa0a729c701e5418773639b6ed3f833f59eaa
SHA512 954acf234e78b4dc62d696b155013256376885bc987552267e4c425d07807e227327effaeba5d0531698250f1f0fadd02551000983e83775093633426bafd70f
SSDEEP 768:RA83ZdDZIO00hemNzc4ReyIsPZPi9Pttm:RA83jdtc44bsBPKtm
TLSH
T1B6F2BF70EC749C63ACFAAB86F5463792BEF45567C0C81E88D6ED9F0C05432AD175B812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 7da793305423430d1ebeeb85b60086484c7deeea183dcfe15dfcaa9bf0b88a60
MD5 9ae2f21b2d6fdf80204b85054cfa510e
SHA1 28334bc861190a2e49cd3d014ac8a661ae62935c
SHA512 9326172d9778d97fbb50d7d845722e7fd271951415fd23b1ecdfdff6dc2a128ea26d52ec7378b306886252788a6a14b81f85b08be1135b8a4f9f6adda36df373
SSDEEP 768:JfFQM3xwgnkZw5O00heyNzc4ReyIsPZPi9Pttm:JiM3q1tc44bsBPKtm
TLSH
T15A1307F198E78976E8AE5783A73D2E42ADFCD153B1985984B7D94E4CCC421BFC30A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 988d39602b4c0e97e56fa9974ff740d0a0d9e53e9dd82e3193d408c3447b9c7d
MD5 186e0778b8d729a85a53b9817b2a3c43
SHA1 583bd148aa2aa09322d5e41d6a004574d792c828
SHA512 b2afd2d5453cb72e1e4de4a2396c14e08e9033372eeff7f95683a65364316c24511f7d4a077f076fe3955cd965e712fdbdb04e8bf547ae08f7a1c31facd31799
SSDEEP 768:eGrv+4UNbds33DDZIO00hefNzc4ReyIs2ZeVH1S5D:eGbsbS3fItc44bsuEH1Y
TLSH
T13603CF32A878DD33ACFAA685B04736933FF8616B81840E94C9EA5F4C4A471DD175F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 1c32c37fb16777d38b4a49d550ffff57774b708f1ac28728791ddbadd8c6fd70
MD5 b9e12c78539ba5c34a32158e84373419
SHA1 d49b013a25e75bda856151312a845c5a8e62faac
SHA512 46909a4c2ddde7cd16d33096b24d8d73d140cc5593d85bbf593f34c7b1984631ba3b1f3a2e471b08b79887adce1431c035dbae8b36e86af9351b535c6bec66b4
SSDEEP 768:7krv+4UNbdP3PdDZIO00heaNzc4ReyIsPZPi9PttF:7kbsbh3dTtc44bsBPKtF
TLSH
T1BE13CF31F878DD63ACFAAA85F10736937EF815A780C41A98DAD99F4C05871AE171F813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

001d1522-7dc8-4c5a-b842-dbbe1f700d1b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\001d1522-7dc8-4c5a-b842-dbbe1f700d1b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3840_1524544170\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1120-387-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1668-288-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1732-60-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1932-263-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2000-395-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2268-188-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2680-314-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2704-411-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2732-320-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2956-324-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2956-354-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3132-264-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3132-235-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3360-399-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3360-310-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3360-413-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3372-455-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3520-353-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4468-305-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4468-276-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4972-416-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5000-391-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5620-444-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5900-374-0x0000000000010000-0x00000000000AB000-memory.dmp

Download