systex | f7fba10b1372aa569d1ef6f1df3bc977a3a1e310b46373623fbcf46e112fb4b7

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 16:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_26448e166de9877d04ff0abec1c6a16a_amadey_darkgate_elex_smoke-loader_stop.exe
Size 384KB
Sample260817-tn15psek21
SHA256 f7fba10b1372aa569d1ef6f1df3bc977a3a1e310b46373623fbcf46e112fb4b7
MD5 26448e166de9877d04ff0abec1c6a16a
SHA1 451ac08a928bc4b583c00521ce1a0dd16e36097f
SHA512 8594cdb23ecafa596abe1543d0df61b99268c5678aa5c2e0f17325d2140b45c0af957b5e6d644ac769300300f95aa4d5b1dd3e60e39de9460dc91f5dbdb7a114
SSDEEP 3072:99ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:PctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1CC847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
3040	xupnhfzpjhczusmk.exe
2792	xupnhfzpjhczusmk.sys
1152	CreateProcess.exe
1300	pmhezxrpmh.exe
4940	CreateProcess.exe
4908	CreateProcess.exe
1312	i_pmhezxrpmh.exe
4876	mhfzxrpjhc.sys
2700	CreateProcess.exe
4228	eczuomhezx.exe
3708	CreateProcess.exe
2664	CreateProcess.exe
4580	i_eczuomhezx.exe
3056	rpjecwurmj.sys
3000	CreateProcess.exe
3528	omjecwtrlj.exe
3656	CreateProcess.exe
4100	CreateProcess.exe
5252	i_omjecwtrlj.exe
2548	jgbytqomjd.sys
2944	CreateProcess.exe
4152	oljdbztrlj.exe
2864	CreateProcess.exe
4896	CreateProcess.exe
1524	i_oljdbztrlj.exe
3232	troigbztrl.sys
1424	CreateProcess.exe
5656	igaywqoigd.exe
4816	CreateProcess.exe
2476	CreateProcess.exe
4516	i_igaywqoigd.exe
5388	aytqligdyv.sys
6064	CreateProcess.exe
2396	ysqlidavtn.exe
4596	CreateProcess.exe
3448	CreateProcess.exe
2736	i_ysqlidavtn.exe
3044	tnlfdxvqni.sys
4976	CreateProcess.exe
2464	ifaxvqkica.exe
1168	CreateProcess.exe
4376	CreateProcess.exe
4180	i_ifaxvqkica.exe
3136	kfdxvpnhfa.sys
5520	CreateProcess.exe
1608	icaxupnhfa.exe
4524	CreateProcess.exe
5944	CreateProcess.exe
1524	i_icaxupnhfa.exe
200	nkicausmki.sys
1480	CreateProcess.exe
5448	zxupnhfzur.exe
5672	CreateProcess.exe
5728	CreateProcess.exe
4612	i_zxupnhfzur.exe
3944	hfzurpnhec.sys
120	CreateProcess.exe
4484	ecxupmhfrp.exe
2328	CreateProcess.exe
5056	CreateProcess.exe
2648	i_ecxupmhfrp.exe
2820	bztomgecwu.sys
2660	CreateProcess.exe
2904	zwuomhezxr.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_1710712038\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_1482251716\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_1350994329\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_999482296\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_999482296\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_1482251716\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_1350994329\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_999482296\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5328_999482296\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwuomhezxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fayvqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpnifdxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eczuomhezx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrljdbwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrljdbwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxvqnigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omjecwtrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqlidavtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icaxupnhfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxupnhfzur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwuomhezxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpkhcauspk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmkecwuomh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmhezxrpmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqlidavtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icaxupnhfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpkhcauspk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xupnhfzpjhczusmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igaywqoigd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifaxvqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxupnhfzur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywqolgbywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uhfzxuomkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uhfzxuomkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omjecwtrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oljdbztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqolgbywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_26448e166de9877d04ff0abec1c6a16a_amadey_darkgate_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igaywqoigd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fayvqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmkecwuomh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmhezxrpmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifaxvqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecxupmhfrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecxupmhfrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvqnigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpnifdxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eczuomhezx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oljdbztrlj.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1876	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3988	ipconfig.exe
4248	ipconfig.exe
4572	ipconfig.exe
5820	ipconfig.exe
1848	ipconfig.exe
2452	ipconfig.exe
1188	ipconfig.exe
5072	ipconfig.exe
5240	ipconfig.exe
1344	ipconfig.exe
4432	ipconfig.exe
2856	ipconfig.exe
3004	ipconfig.exe
3192	ipconfig.exe
1372	ipconfig.exe
912	ipconfig.exe
2740	ipconfig.exe
5820	ipconfig.exe
5468	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134314567900559044"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3986082593-3624157295-3514260330-1000\{BF95D579-09D7-4787-939A-44ED77676F49}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4904	2026-08-17_26448e166de9877d04ff0abec1c6a16a_amadey_darkgate_elex_smoke-loader_stop.exe
4904	2026-08-17_26448e166de9877d04ff0abec1c6a16a_amadey_darkgate_elex_smoke-loader_stop.exe
4904	2026-08-17_26448e166de9877d04ff0abec1c6a16a_amadey_darkgate_elex_smoke-loader_stop.exe
4904	2026-08-17_26448e166de9877d04ff0abec1c6a16a_amadey_darkgate_elex_smoke-loader_stop.exe
4904	2026-08-17_26448e166de9877d04ff0abec1c6a16a_amadey_darkgate_elex_smoke-loader_stop.exe
4904	2026-08-17_26448e166de9877d04ff0abec1c6a16a_amadey_darkgate_elex_smoke-loader_stop.exe
4904	2026-08-17_26448e166de9877d04ff0abec1c6a16a_amadey_darkgate_elex_smoke-loader_stop.exe
4904	2026-08-17_26448e166de9877d04ff0abec1c6a16a_amadey_darkgate_elex_smoke-loader_stop.exe
4904	2026-08-17_26448e166de9877d04ff0abec1c6a16a_amadey_darkgate_elex_smoke-loader_stop.exe
4904	2026-08-17_26448e166de9877d04ff0abec1c6a16a_amadey_darkgate_elex_smoke-loader_stop.exe
4904	2026-08-17_26448e166de9877d04ff0abec1c6a16a_amadey_darkgate_elex_smoke-loader_stop.exe
4904	2026-08-17_26448e166de9877d04ff0abec1c6a16a_amadey_darkgate_elex_smoke-loader_stop.exe
4904	2026-08-17_26448e166de9877d04ff0abec1c6a16a_amadey_darkgate_elex_smoke-loader_stop.exe
4904	2026-08-17_26448e166de9877d04ff0abec1c6a16a_amadey_darkgate_elex_smoke-loader_stop.exe
4904	2026-08-17_26448e166de9877d04ff0abec1c6a16a_amadey_darkgate_elex_smoke-loader_stop.exe
4904	2026-08-17_26448e166de9877d04ff0abec1c6a16a_amadey_darkgate_elex_smoke-loader_stop.exe
4904	2026-08-17_26448e166de9877d04ff0abec1c6a16a_amadey_darkgate_elex_smoke-loader_stop.exe
4904	2026-08-17_26448e166de9877d04ff0abec1c6a16a_amadey_darkgate_elex_smoke-loader_stop.exe
4904	2026-08-17_26448e166de9877d04ff0abec1c6a16a_amadey_darkgate_elex_smoke-loader_stop.exe
4904	2026-08-17_26448e166de9877d04ff0abec1c6a16a_amadey_darkgate_elex_smoke-loader_stop.exe
4904	2026-08-17_26448e166de9877d04ff0abec1c6a16a_amadey_darkgate_elex_smoke-loader_stop.exe
4904	2026-08-17_26448e166de9877d04ff0abec1c6a16a_amadey_darkgate_elex_smoke-loader_stop.exe
4904	2026-08-17_26448e166de9877d04ff0abec1c6a16a_amadey_darkgate_elex_smoke-loader_stop.exe
4904	2026-08-17_26448e166de9877d04ff0abec1c6a16a_amadey_darkgate_elex_smoke-loader_stop.exe
4904	2026-08-17_26448e166de9877d04ff0abec1c6a16a_amadey_darkgate_elex_smoke-loader_stop.exe
4904	2026-08-17_26448e166de9877d04ff0abec1c6a16a_amadey_darkgate_elex_smoke-loader_stop.exe
4904	2026-08-17_26448e166de9877d04ff0abec1c6a16a_amadey_darkgate_elex_smoke-loader_stop.exe
4904	2026-08-17_26448e166de9877d04ff0abec1c6a16a_amadey_darkgate_elex_smoke-loader_stop.exe
4904	2026-08-17_26448e166de9877d04ff0abec1c6a16a_amadey_darkgate_elex_smoke-loader_stop.exe
4904	2026-08-17_26448e166de9877d04ff0abec1c6a16a_amadey_darkgate_elex_smoke-loader_stop.exe
4904	2026-08-17_26448e166de9877d04ff0abec1c6a16a_amadey_darkgate_elex_smoke-loader_stop.exe
4904	2026-08-17_26448e166de9877d04ff0abec1c6a16a_amadey_darkgate_elex_smoke-loader_stop.exe
4904	2026-08-17_26448e166de9877d04ff0abec1c6a16a_amadey_darkgate_elex_smoke-loader_stop.exe
4904	2026-08-17_26448e166de9877d04ff0abec1c6a16a_amadey_darkgate_elex_smoke-loader_stop.exe
4904	2026-08-17_26448e166de9877d04ff0abec1c6a16a_amadey_darkgate_elex_smoke-loader_stop.exe
4904	2026-08-17_26448e166de9877d04ff0abec1c6a16a_amadey_darkgate_elex_smoke-loader_stop.exe
4904	2026-08-17_26448e166de9877d04ff0abec1c6a16a_amadey_darkgate_elex_smoke-loader_stop.exe
4904	2026-08-17_26448e166de9877d04ff0abec1c6a16a_amadey_darkgate_elex_smoke-loader_stop.exe
4904	2026-08-17_26448e166de9877d04ff0abec1c6a16a_amadey_darkgate_elex_smoke-loader_stop.exe
4904	2026-08-17_26448e166de9877d04ff0abec1c6a16a_amadey_darkgate_elex_smoke-loader_stop.exe
4904	2026-08-17_26448e166de9877d04ff0abec1c6a16a_amadey_darkgate_elex_smoke-loader_stop.exe
4904	2026-08-17_26448e166de9877d04ff0abec1c6a16a_amadey_darkgate_elex_smoke-loader_stop.exe
4904	2026-08-17_26448e166de9877d04ff0abec1c6a16a_amadey_darkgate_elex_smoke-loader_stop.exe
4904	2026-08-17_26448e166de9877d04ff0abec1c6a16a_amadey_darkgate_elex_smoke-loader_stop.exe
4904	2026-08-17_26448e166de9877d04ff0abec1c6a16a_amadey_darkgate_elex_smoke-loader_stop.exe
4904	2026-08-17_26448e166de9877d04ff0abec1c6a16a_amadey_darkgate_elex_smoke-loader_stop.exe
4904	2026-08-17_26448e166de9877d04ff0abec1c6a16a_amadey_darkgate_elex_smoke-loader_stop.exe
4904	2026-08-17_26448e166de9877d04ff0abec1c6a16a_amadey_darkgate_elex_smoke-loader_stop.exe
4904	2026-08-17_26448e166de9877d04ff0abec1c6a16a_amadey_darkgate_elex_smoke-loader_stop.exe
4904	2026-08-17_26448e166de9877d04ff0abec1c6a16a_amadey_darkgate_elex_smoke-loader_stop.exe
4904	2026-08-17_26448e166de9877d04ff0abec1c6a16a_amadey_darkgate_elex_smoke-loader_stop.exe
4904	2026-08-17_26448e166de9877d04ff0abec1c6a16a_amadey_darkgate_elex_smoke-loader_stop.exe
4904	2026-08-17_26448e166de9877d04ff0abec1c6a16a_amadey_darkgate_elex_smoke-loader_stop.exe
4904	2026-08-17_26448e166de9877d04ff0abec1c6a16a_amadey_darkgate_elex_smoke-loader_stop.exe
4904	2026-08-17_26448e166de9877d04ff0abec1c6a16a_amadey_darkgate_elex_smoke-loader_stop.exe
4904	2026-08-17_26448e166de9877d04ff0abec1c6a16a_amadey_darkgate_elex_smoke-loader_stop.exe
3040	xupnhfzpjhczusmk.exe
3040	xupnhfzpjhczusmk.exe
3040	xupnhfzpjhczusmk.exe
3040	xupnhfzpjhczusmk.exe
3040	xupnhfzpjhczusmk.exe
3040	xupnhfzpjhczusmk.exe
3040	xupnhfzpjhczusmk.exe
3040	xupnhfzpjhczusmk.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5328	msedge.exe
5328	msedge.exe
5328	msedge.exe
5328	msedge.exe
5328	msedge.exe
5328	msedge.exe
5328	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	1312	i_pmhezxrpmh.exe
Token: SeDebugPrivilege	4580	i_eczuomhezx.exe
Token: SeDebugPrivilege	5252	i_omjecwtrlj.exe
Token: SeDebugPrivilege	1524	i_oljdbztrlj.exe
Token: SeDebugPrivilege	4516	i_igaywqoigd.exe
Token: SeDebugPrivilege	2736	i_ysqlidavtn.exe
Token: SeDebugPrivilege	4180	i_ifaxvqkica.exe
Token: SeDebugPrivilege	1524	i_icaxupnhfa.exe
Token: SeDebugPrivilege	4612	i_zxupnhfzur.exe
Token: SeDebugPrivilege	2648	i_ecxupmhfrp.exe
Token: SeDebugPrivilege	6048	i_zwuomhezxr.exe
Token: SeDebugPrivilege	2496	i_bztrljdbwt.exe
Token: SeDebugPrivilege	3164	i_ywqolgbywq.exe
Token: SeDebugPrivilege	912	i_fayvqoigay.exe
Token: SeDebugPrivilege	4592	i_fdxvqnigay.exe
Token: SeDebugPrivilege	5488	i_vpnifdxvpn.exe
Token: SeDebugPrivilege	4724	i_rpkhcauspk.exe
Token: SeDebugPrivilege	4584	i_uhfzxuomkh.exe
Token: SeDebugPrivilege	1836	i_rmkecwuomh.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5328	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4904 wrote to memory of 3040	4904	2026-08-17_26448e166de9877d04ff0abec1c6a16a_amadey_darkgate_elex_smoke-loader_stop.exe	89
PID 4904 wrote to memory of 2936	4904	2026-08-17_26448e166de9877d04ff0abec1c6a16a_amadey_darkgate_elex_smoke-loader_stop.exe	90
PID 2936 wrote to memory of 5328	2936	iexplore.exe	91
PID 5328 wrote to memory of 2772	5328	msedge.exe	92
PID 5328 wrote to memory of 2304	5328	msedge.exe	93
PID 5328 wrote to memory of 1876	5328	msedge.exe	94
PID 5328 wrote to memory of 2304	5328	msedge.exe	93
PID 5328 wrote to memory of 2304	5328	msedge.exe	93
PID 5328 wrote to memory of 4956	5328	msedge.exe	95
PID 5328 wrote to memory of 4956	5328	msedge.exe	95
PID 5328 wrote to memory of 352	5328	msedge.exe	97
PID 5328 wrote to memory of 3096	5328	msedge.exe	98
PID 5328 wrote to memory of 352	5328	msedge.exe	97
PID 5328 wrote to memory of 352	5328	msedge.exe	97
PID 5328 wrote to memory of 3096	5328	msedge.exe	98
PID 5328 wrote to memory of 3096	5328	msedge.exe	98
PID 5328 wrote to memory of 5644	5328	msedge.exe	99
PID 5328 wrote to memory of 1396	5328	msedge.exe	100
PID 5328 wrote to memory of 5644	5328	msedge.exe	99
PID 5328 wrote to memory of 5644	5328	msedge.exe	99
PID 5328 wrote to memory of 1396	5328	msedge.exe	100
PID 5328 wrote to memory of 1396	5328	msedge.exe	100
PID 5328 wrote to memory of 4196	5328	msedge.exe	101
PID 5328 wrote to memory of 4196	5328	msedge.exe	101
PID 5328 wrote to memory of 4196	5328	msedge.exe	101
PID 5328 wrote to memory of 3136	5328	msedge.exe	103
PID 5328 wrote to memory of 3136	5328	msedge.exe	103
PID 5328 wrote to memory of 5724	5328	msedge.exe	105
PID 5328 wrote to memory of 5724	5328	msedge.exe	105
PID 5328 wrote to memory of 5724	5328	msedge.exe	105
PID 3040 wrote to memory of 1152	3040	xupnhfzpjhczusmk.exe	107
PID 1300 wrote to memory of 4940	1300	pmhezxrpmh.exe	110
PID 5328 wrote to memory of 1832	5328	msedge.exe	113
PID 5328 wrote to memory of 1060	5328	msedge.exe	114
PID 5328 wrote to memory of 1832	5328	msedge.exe	113
PID 5328 wrote to memory of 1060	5328	msedge.exe	114
PID 5328 wrote to memory of 5912	5328	msedge.exe	116
PID 5328 wrote to memory of 3980	5328	msedge.exe	117
PID 5328 wrote to memory of 3980	5328	msedge.exe	117
PID 5328 wrote to memory of 2032	5328	msedge.exe	118
PID 5328 wrote to memory of 2032	5328	msedge.exe	118
PID 3040 wrote to memory of 4908	3040	xupnhfzpjhczusmk.exe	121
PID 3040 wrote to memory of 2700	3040	xupnhfzpjhczusmk.exe	125
PID 4228 wrote to memory of 3708	4228	eczuomhezx.exe	127
PID 3040 wrote to memory of 2664	3040	xupnhfzpjhczusmk.exe	130
PID 3040 wrote to memory of 3000	3040	xupnhfzpjhczusmk.exe	134
PID 3528 wrote to memory of 3656	3528	omjecwtrlj.exe	136
PID 3040 wrote to memory of 4100	3040	xupnhfzpjhczusmk.exe	139
PID 3040 wrote to memory of 2944	3040	xupnhfzpjhczusmk.exe	143
PID 4152 wrote to memory of 2864	4152	oljdbztrlj.exe	145
PID 3040 wrote to memory of 4896	3040	xupnhfzpjhczusmk.exe	149
PID 5328 wrote to memory of 3688	5328	msedge.exe	151
PID 5328 wrote to memory of 3164	5328	msedge.exe	152
PID 5328 wrote to memory of 4876	5328	msedge.exe	153
PID 3040 wrote to memory of 1424	3040	xupnhfzpjhczusmk.exe	156
PID 5656 wrote to memory of 4816	5656	igaywqoigd.exe	158
PID 3040 wrote to memory of 2476	3040	xupnhfzpjhczusmk.exe	161
PID 3040 wrote to memory of 6064	3040	xupnhfzpjhczusmk.exe	165
PID 2396 wrote to memory of 4596	2396	ysqlidavtn.exe	167
PID 3040 wrote to memory of 3448	3040	xupnhfzpjhczusmk.exe	170
PID 3040 wrote to memory of 4976	3040	xupnhfzpjhczusmk.exe	174
PID 2464 wrote to memory of 1168	2464	ifaxvqkica.exe	176
PID 3040 wrote to memory of 4376	3040	xupnhfzpjhczusmk.exe	179
PID 3040 wrote to memory of 5520	3040	xupnhfzpjhczusmk.exe	183

C:\Users\Admin\AppData\Local\Temp\2026-08-17_26448e166de9877d04ff0abec1c6a16a_amadey_darkgate_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_26448e166de9877d04ff0abec1c6a16a_amadey_darkgate_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Temp\xupnhfzpjhczusmk.exe
  C:\Temp\xupnhfzpjhczusmk.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3040
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pmhezxrpmh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1152
  - - C:\Temp\pmhezxrpmh.exe
      C:\Temp\pmhezxrpmh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1300
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4940
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1372
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pmhezxrpmh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4908
  - - C:\Temp\i_pmhezxrpmh.exe
      C:\Temp\i_pmhezxrpmh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1312
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\eczuomhezx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2700
  - - C:\Temp\eczuomhezx.exe
      C:\Temp\eczuomhezx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4228
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3708
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4572
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_eczuomhezx.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2664
  - - C:\Temp\i_eczuomhezx.exe
      C:\Temp\i_eczuomhezx.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4580
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\omjecwtrlj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3000
  - - C:\Temp\omjecwtrlj.exe
      C:\Temp\omjecwtrlj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3528
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3656
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:912
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_omjecwtrlj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4100
  - - C:\Temp\i_omjecwtrlj.exe
      C:\Temp\i_omjecwtrlj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5252
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\oljdbztrlj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2944
  - - C:\Temp\oljdbztrlj.exe
      C:\Temp\oljdbztrlj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4152
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2864
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2740
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_oljdbztrlj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4896
  - - C:\Temp\i_oljdbztrlj.exe
      C:\Temp\i_oljdbztrlj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1524
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\igaywqoigd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1424
  - - C:\Temp\igaywqoigd.exe
      C:\Temp\igaywqoigd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5656
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4816
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5072
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_igaywqoigd.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2476
  - - C:\Temp\i_igaywqoigd.exe
      C:\Temp\i_igaywqoigd.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4516
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ysqlidavtn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6064
  - - C:\Temp\ysqlidavtn.exe
      C:\Temp\ysqlidavtn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2396
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4596
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1344
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ysqlidavtn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3448
  - - C:\Temp\i_ysqlidavtn.exe
      C:\Temp\i_ysqlidavtn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2736
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ifaxvqkica.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4976
  - - C:\Temp\ifaxvqkica.exe
      C:\Temp\ifaxvqkica.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2464
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1168
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5820
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ifaxvqkica.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4376
  - - C:\Temp\i_ifaxvqkica.exe
      C:\Temp\i_ifaxvqkica.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4180
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\icaxupnhfa.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5520
  - - C:\Temp\icaxupnhfa.exe
      C:\Temp\icaxupnhfa.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1608
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4524
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5468
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_icaxupnhfa.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5944
  - - C:\Temp\i_icaxupnhfa.exe
      C:\Temp\i_icaxupnhfa.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1524
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zxupnhfzur.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1480
  - - C:\Temp\zxupnhfzur.exe
      C:\Temp\zxupnhfzur.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5448
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5672
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4432
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zxupnhfzur.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5728
  - - C:\Temp\i_zxupnhfzur.exe
      C:\Temp\i_zxupnhfzur.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4612
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ecxupmhfrp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:120
  - - C:\Temp\ecxupmhfrp.exe
      C:\Temp\ecxupmhfrp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4484
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2328
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5820
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ecxupmhfrp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5056
  - - C:\Temp\i_ecxupmhfrp.exe
      C:\Temp\i_ecxupmhfrp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2648
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zwuomhezxr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2660
  - - C:\Temp\zwuomhezxr.exe
      C:\Temp\zwuomhezxr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2904
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1524
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3988
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zwuomhezxr.exe ups_ins
    3⤵
    PID:428
  - - C:\Temp\i_zwuomhezxr.exe
      C:\Temp\i_zwuomhezxr.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6048
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bztrljdbwt.exe ups_run
    3⤵
    PID:1224
  - - C:\Temp\bztrljdbwt.exe
      C:\Temp\bztrljdbwt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5668
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2368
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5240
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bztrljdbwt.exe ups_ins
    3⤵
    PID:4404
  - - C:\Temp\i_bztrljdbwt.exe
      C:\Temp\i_bztrljdbwt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2496
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ywqolgbywq.exe ups_run
    3⤵
    PID:1028
  - - C:\Temp\ywqolgbywq.exe
      C:\Temp\ywqolgbywq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5372
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2524
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3192
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ywqolgbywq.exe ups_ins
    3⤵
    PID:3384
  - - C:\Temp\i_ywqolgbywq.exe
      C:\Temp\i_ywqolgbywq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3164
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fayvqoigay.exe ups_run
    3⤵
    PID:1272
  - - C:\Temp\fayvqoigay.exe
      C:\Temp\fayvqoigay.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5876
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5208
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1848
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fayvqoigay.exe ups_ins
    3⤵
    PID:2344
  - - C:\Temp\i_fayvqoigay.exe
      C:\Temp\i_fayvqoigay.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:912
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fdxvqnigay.exe ups_run
    3⤵
    PID:4628
  - - C:\Temp\fdxvqnigay.exe
      C:\Temp\fdxvqnigay.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4328
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5356
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2452
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fdxvqnigay.exe ups_ins
    3⤵
    PID:1708
  - - C:\Temp\i_fdxvqnigay.exe
      C:\Temp\i_fdxvqnigay.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4592
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vpnifdxvpn.exe ups_run
    3⤵
    PID:3388
  - - C:\Temp\vpnifdxvpn.exe
      C:\Temp\vpnifdxvpn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5756
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5232
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2856
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vpnifdxvpn.exe ups_ins
    3⤵
    PID:5324
  - - C:\Temp\i_vpnifdxvpn.exe
      C:\Temp\i_vpnifdxvpn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5488
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rpkhcauspk.exe ups_run
    3⤵
    PID:912
  - - C:\Temp\rpkhcauspk.exe
      C:\Temp\rpkhcauspk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1968
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1056
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3004
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rpkhcauspk.exe ups_ins
    3⤵
    PID:2096
  - - C:\Temp\i_rpkhcauspk.exe
      C:\Temp\i_rpkhcauspk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4724
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\uhfzxuomkh.exe ups_run
    3⤵
    PID:2060
  - - C:\Temp\uhfzxuomkh.exe
      C:\Temp\uhfzxuomkh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4620
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4696
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1188
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_uhfzxuomkh.exe ups_ins
    3⤵
    PID:5044
  - - C:\Temp\i_uhfzxuomkh.exe
      C:\Temp\i_uhfzxuomkh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4584
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rmkecwuomh.exe ups_run
    3⤵
    PID:3980
  - - C:\Temp\rmkecwuomh.exe
      C:\Temp\rmkecwuomh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1240
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5708
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4248
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rmkecwuomh.exe ups_ins
    3⤵
    PID:3264
  - - C:\Temp\i_rmkecwuomh.exe
      C:\Temp\i_rmkecwuomh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1836
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffd8032c188,0x7ffd8032c194,0x7ffd8032c1a0
      4⤵
      PID:2772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1692,i,16239779611522143167,1589114933555495001,262144 --field-trial-handle=2360,i,11171386894342331020,10419394565654321150,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:2
      4⤵
      PID:2304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,10135487937878812593,7194916432720481386,524288 --field-trial-handle=2360,i,11171386894342331020,10419394565654321150,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:11
      4⤵
      System Time Discovery
      PID:1876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2488,i,17155520299451441934,11747690702800382741,524288 --field-trial-handle=2360,i,11171386894342331020,10419394565654321150,262144 --variations-seed-version --mojo-platform-channel-handle=2772 /prefetch:13
      4⤵
      PID:4956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3552,i,12879186106866355068,8891064729906497830,2097152 --field-trial-handle=2360,i,11171386894342331020,10419394565654321150,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
      4⤵
      PID:352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3564,i,14438376390847131259,15958037144834910378,2097152 --field-trial-handle=2360,i,11171386894342331020,10419394565654321150,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
      4⤵
      PID:3096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4328,i,18110345499859815874,13303604014986300792,2097152 --field-trial-handle=2360,i,11171386894342331020,10419394565654321150,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:1
      4⤵
      PID:5644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4332,i,12874551003139191874,10541804177030515365,2097152 --field-trial-handle=2360,i,11171386894342331020,10419394565654321150,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:9
      4⤵
      PID:1396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5256,i,14314716466887447016,17088724572806505384,2097152 --field-trial-handle=2360,i,11171386894342331020,10419394565654321150,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:1
      4⤵
      PID:4196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3720,i,8826216369132879909,12281129809431383503,524288 --field-trial-handle=2360,i,11171386894342331020,10419394565654321150,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:14
      4⤵
      PID:3136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3804,i,17436773687344298575,17068359175881347644,2097152 --field-trial-handle=2360,i,11171386894342331020,10419394565654321150,262144 --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:1
      4⤵
      PID:5724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4372,i,12048092567382961716,16820713883567612450,524288 --field-trial-handle=2360,i,11171386894342331020,10419394565654321150,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
      4⤵
      PID:1832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4368,i,17833173592147860642,11821557608583212505,524288 --field-trial-handle=2360,i,11171386894342331020,10419394565654321150,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:14
      4⤵
      PID:1060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,4025803670647983737,289756156841954769,524288 --field-trial-handle=2360,i,11171386894342331020,10419394565654321150,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
      4⤵
      PID:3168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,4025803670647983737,289756156841954769,524288 --field-trial-handle=2360,i,11171386894342331020,10419394565654321150,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
      4⤵
      PID:5912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,7901674601729856762,16845059601856785651,524288 --field-trial-handle=2360,i,11171386894342331020,10419394565654321150,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:14
      4⤵
      PID:3980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,10120172631399459787,12871066913659478524,524288 --field-trial-handle=2360,i,11171386894342331020,10419394565654321150,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:14
      4⤵
      PID:2032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,12998962150490308479,14826308047695411229,524288 --field-trial-handle=2360,i,11171386894342331020,10419394565654321150,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:14
      4⤵
      PID:3688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4380,i,1600825491845021020,8491625374900297519,524288 --field-trial-handle=2360,i,11171386894342331020,10419394565654321150,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:14
      4⤵
      PID:3164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3556,i,16726548102013911697,16489465085640913838,524288 --field-trial-handle=2360,i,11171386894342331020,10419394565654321150,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:14
      4⤵
      PID:4876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2004,i,1974398042418679434,5266404351879786408,524288 --field-trial-handle=2360,i,11171386894342331020,10419394565654321150,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:14
      4⤵
      PID:5348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5628,i,2256443121355283506,14070764385995445335,524288 --field-trial-handle=2360,i,11171386894342331020,10419394565654321150,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:14
      4⤵
      PID:2112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,9946239125043190975,4292730601190380446,524288 --field-trial-handle=2360,i,11171386894342331020,10419394565654321150,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:14
      4⤵
      PID:1708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,10818978937806611341,7283825013734673269,524288 --field-trial-handle=2360,i,11171386894342331020,10419394565654321150,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:14
      4⤵
      PID:676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6040,i,145136972834212745,8313148079826957733,262144 --field-trial-handle=2360,i,11171386894342331020,10419394565654321150,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:10
      4⤵
      PID:4608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3428,i,1099376303242854041,3431950360373280566,524288 --field-trial-handle=2360,i,11171386894342331020,10419394565654321150,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:14
      4⤵
      PID:5956

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2464

C:\Temp\xupnhfzpjhczusmk.sys
C:\Temp\xupnhfzpjhczusmk.sys
1⤵
- Executes dropped EXE
PID:2792

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4944

C:\Temp\mhfzxrpjhc.sys
C:\Temp\mhfzxrpjhc.sys
1⤵
- Executes dropped EXE
PID:4876

C:\Temp\rpjecwurmj.sys
C:\Temp\rpjecwurmj.sys
1⤵
- Executes dropped EXE
PID:3056

C:\Temp\jgbytqomjd.sys
C:\Temp\jgbytqomjd.sys
1⤵
- Executes dropped EXE
PID:2548

C:\Temp\troigbztrl.sys
C:\Temp\troigbztrl.sys
1⤵
- Executes dropped EXE
PID:3232

C:\Temp\aytqligdyv.sys
C:\Temp\aytqligdyv.sys
1⤵
- Executes dropped EXE
PID:5388

C:\Temp\tnlfdxvqni.sys
C:\Temp\tnlfdxvqni.sys
1⤵
- Executes dropped EXE
PID:3044

C:\Temp\kfdxvpnhfa.sys
C:\Temp\kfdxvpnhfa.sys
1⤵
- Executes dropped EXE
PID:3136

C:\Temp\nkicausmki.sys
C:\Temp\nkicausmki.sys
1⤵
- Executes dropped EXE
PID:200

C:\Temp\hfzurpnhec.sys
C:\Temp\hfzurpnhec.sys
1⤵
- Executes dropped EXE
PID:3944

C:\Temp\bztomgecwu.sys
C:\Temp\bztomgecwu.sys
1⤵
- Executes dropped EXE
PID:2820

C:\Temp\bztrojhbzw.sys
C:\Temp\bztrojhbzw.sys
1⤵
PID:5304

C:\Temp\gebwtolgeb.sys
C:\Temp\gebwtolgeb.sys
1⤵
PID:4944

C:\Temp\ligayvtnlj.sys
C:\Temp\ligayvtnlj.sys
1⤵
PID:200

C:\Temp\igaytnlfdx.sys
C:\Temp\igaytnlfdx.sys
1⤵
PID:2128

C:\Temp\axvpnifays.sys
C:\Temp\axvpnifays.sys
1⤵
PID:5688

C:\Temp\iusmkecaus.sys
C:\Temp\iusmkecaus.sys
1⤵
PID:3956

C:\Temp\xupnkecxus.sys
C:\Temp\xupnkecxus.sys
1⤵
PID:2472

C:\Temp\pmhezxrpmh.sys
C:\Temp\pmhezxrpmh.sys
1⤵
PID:1864

C:\Temp\mgecwuomge.sys
C:\Temp\mgecwuomge.sys
1⤵
PID:1140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aytqligdyv.sys

Path C:\Temp\aytqligdyv.sys
Size 293KB
SHA256 47e0d76661ee75cd5660a305f663546c374c8c6fb6a178df9972b0081a0ad31d
MD5 6cdbd064f4b65028cad92c1d8470ee9c
SHA1 3f35b8cbeca4098ec5e9793598d378a3a7886c1a
SHA512 854e9d5d1f5af1f17df0d2a86b25d0b1f1168c00384bade1523f4d76e569bdef571239660e63bcaca70a5716c750da06cbb390272046eb60b42dfa98bec2d27d
SSDEEP 3072:GtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:GIJjiJcbI03GBc3ucY5DCSj
TLSH
T100545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eczuomhezx.exe

Path C:\Temp\eczuomhezx.exe
Size 384KB
SHA256 9aad622de7d20a9682dd5c14cc3447fe95425fe342bcb01e28d90e00187c7629
MD5 46c8a7982a4edb6f4bdcdf9dde7a5863
SHA1 f97c571b2957ab8f9bc856665c1e065c4debfe07
SHA512 29d730f05a461a9b725e1973db43312f5ace2ac9154b6702fe7627ba8bf1d441fc22d7c475f0ec38021fda29a5b45335f8f3e4d74ad4b75bbfe50e2f1d9d9ae5
SSDEEP 3072:j9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:BctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1EC847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_eczuomhezx.exe

Path C:\Temp\i_eczuomhezx.exe
Size 384KB
SHA256 54834359de864677d9828fa2e04fe5d11647954db7230b6d04f99db25e06601d
MD5 eda71c54c9efbb093f2a597aabdf4265
SHA1 c6ebad5d599cc30c5c71208abadefb34af524235
SHA512 b3c92efadf95baabd66e5a5c66b67151835ca5248bee710466158c270d5c93ee6821c2b2fdf403baa4f862db3a267ce4332e5e21f9f80cadb34c968706af049d
SSDEEP 3072:yX9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9N:4ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T113847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_igaywqoigd.exe

Path C:\Temp\i_igaywqoigd.exe
Size 384KB
SHA256 8c95c56bcbeaa4bebf9c3bd0b98c529b0d33a8f35944ba807268dee48540fa67
MD5 da840426c475a0e2e13d1ea78b19b31f
SHA1 bfe0774fde378a9001b879dd6131a2242916b98f
SHA512 e4e24830ef9a857ae67f077496806622846131cc6a7078748b687879c9feca389206ac6f287f47edddcac0f8b8e018bb55d4ee88b8661fefd3c6e3009cad9eec
SSDEEP 3072:k9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:+ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1FB847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_oljdbztrlj.exe

Path C:\Temp\i_oljdbztrlj.exe
Size 384KB
SHA256 7473fc180d0eb7ecaa40219735a1f98405bd17d1e353e8c3f53e7f866b53f161
MD5 9d41fd671c7660f0bb5f763f815897a5
SHA1 2fc32bb9283924b2b331e1ba2032e963180c28df
SHA512 f3b02284c93786a9935678dda15eacf5bbca7935be2295e5c7fad35c9e9e5fd679b76b02ba42e6dbc0258b960ef509330b0a6a99cdc07197b3850668e5efe6ad
SSDEEP 3072:39ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:NctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T104847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_omjecwtrlj.exe

Path C:\Temp\i_omjecwtrlj.exe
Size 384KB
SHA256 ea390a5aec08de6782da8eff4865cea015772a464d3451dbb1471a0c44881910
MD5 b07685a3aa4ad34c0bceb62509a4e34c
SHA1 a1379c86b41510884e833936c63de8ce5d1ae884
SHA512 5865c183864bf4b7a5c5fd0931887ccdb3409affe8a8316d2fd1f7c475a49bb3ffebcdac865d93935a13403196e930b6f3a79cf137d0b9aea72cf15d6ab37daa
SSDEEP 3072:z9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:RctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T130846A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pmhezxrpmh.exe

Path C:\Temp\i_pmhezxrpmh.exe
Size 384KB
SHA256 2c17adfc41b0000dcc6bd3d796d064781a8c6cbc02b9d0bdc31899682f60417d
MD5 4cc5bc125bcf5c2fc572b6d3d7484983
SHA1 7fa8d92db82d3f199b8b00de9bd087da8870cfa8
SHA512 22b39a0f3ae22486b6bca0600e8cdbcb7cd4e00c9458fd06948e10f0dfbc864509d13ad17ed1c522e3033027759dddc8bc2c274d1b4a68d481fb684deae1eeb9
SSDEEP 3072:59ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:TctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D1847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igaywqoigd.exe

Path C:\Temp\igaywqoigd.exe
Size 384KB
SHA256 83bd847e140e7c30a8ada4ff08c7d74308f7ec3f35583968d958163ca9183ed7
MD5 2fa3e8149708e9d64c6b6d43f861b248
SHA1 f578225df5c79a8de2b872843fbf4e5d394b1275
SHA512 5a6f1a51c338509e8f1adcda29856ce86d1c3beeda6b0531745254c875d8522682b5d8b160879b49fcf987f3f986fdeee75ced52a4e4d09666aec62b389183db
SSDEEP 3072:Q9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:ictFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T18D847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jgbytqomjd.sys

Path C:\Temp\jgbytqomjd.sys
Size 293KB
SHA256 d6bc8bdc4e2aa9d7138fea656dec2c67915541d8122fa9815c1070dca9bf4fa5
MD5 2e14c534aaefd2a31ddea2cfc8835df0
SHA1 41ba84e9859c868e4a883e1edfe4daa18ccc3d7f
SHA512 a195c1b8f232be7549fe9759c2f08bc9051afd23647b2f8433c21873fef616e09ebf1b2abd6982a552028e6d87264041806d7b0fae8f8a0658f66f972021be7a
SSDEEP 3072:vtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:vIJjiJcbI03GBc3ucY5DCSj
TLSH
T198545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mhfzxrpjhc.sys

Path C:\Temp\mhfzxrpjhc.sys
Size 293KB
SHA256 05915d3f5bf641f809a70ef5b6de5e267766773b5e7245e507319852ce775813
MD5 bdcac601d5d729744f690d25f1fb5480
SHA1 63ccb72d87789c3174fdac560028ef641d1a644f
SHA512 d7261d6d910c99cedf7eefe5c22467d6d379fce4ef4538279a50cc03dc4bef78db6a7244a4aede5f91ab78248e95e33a2624a1611278c64ccad38a3a5b37f2f6
SSDEEP 3072:BtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:BIJjiJcbI03GBc3ucY5DCSj
TLSH
T199545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oljdbztrlj.exe

Path C:\Temp\oljdbztrlj.exe
Size 384KB
SHA256 81db7c2d19206f71bf3456376d1dc01999e6894318e396ceb52c3d2a06aa0963
MD5 cb2e1c7eefd7995216114b0b61b7daf4
SHA1 006cc7d9c5fd0bf1f2c039f863ccfa1bd83b91d0
SHA512 daeb3b776d45fb2419771c0eb56288e454d74baa2d7834693872b3c580744be73a07cb300e539a433eff6fd55229bd2f4a2c30da3656b068230146b64e1731d7
SSDEEP 3072:t9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:/ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T164847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omjecwtrlj.exe

Path C:\Temp\omjecwtrlj.exe
Size 384KB
SHA256 1b5b776fed38fe81dd86d5e0e7fe8d8153e8208f6b77e54d46012b871fc912d4
MD5 cad3f2a5b58b22a2c11887d09086009d
SHA1 ef16d0a2b26bb31714821cc25beaf647eb09c807
SHA512 50906b551342acece056549cf130784a03a94a27f18451205d075e56b960509ff1650f4dfe7e483cefa5ddc94cfd8ff874c8276fdfb35ca3a86918c824f28169
SSDEEP 3072:59ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:TctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T14A847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmhezxrpmh.exe

Path C:\Temp\pmhezxrpmh.exe
Size 384KB
SHA256 27d08b829ca30f22cf85d1ac8031b864124aa321966764aa652afaed7061c3c8
MD5 34ccd2ed2d1f4dec41bb6deae18b23e1
SHA1 b964347fce6cd90738a523ec4a1dfa8ccc39f9e8
SHA512 d335fe0d214dfec3fdc1ea78c25cadf9adaa55f0cc3e16fdfabafde6aa01beadc34574cab86244e773a54efd732dda06df40a63c070758af3d01fd34185f4f18
SSDEEP 3072:h9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:rctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T103847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpjecwurmj.sys

Path C:\Temp\rpjecwurmj.sys
Size 293KB
SHA256 7ec5780be6a20338eb50d1448e70e41015e0470afe1525c0a032e954c793e9f3
MD5 37af78c0041f933059d12f19fef3aec9
SHA1 28cf68afac99c9405c1df53a8a81532c1244fe3b
SHA512 1ec9267b0d186d19352c07414b6446a6fca3c5739ef2d6b4a3d7d9a919b6e87f1f5ad11f702fe2a6121628470be195271b018054c7218068ebc05c51785f4c59
SSDEEP 3072:AtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:AIJjiJcbI03GBc3ucY5DCSj
TLSH
T15F545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

troigbztrl.sys

Path C:\Temp\troigbztrl.sys
Size 293KB
SHA256 5466f5b58313a2ce26d215c56a2d07300c50424e72b3f74892d115087386e792
MD5 c6d3d9381173d03d8d7929e84ef0e77e
SHA1 1992ee452dbb0dee82dafb0e553643f8360f6292
SHA512 c752a138b02a2aed1b7f1e754ab079ff6599436fe684499de531036eb86b7085e2c9114f474f22a65ee3349325c2b62f78c4cce4dc72617ed1a9f03d0da7ff71
SSDEEP 3072:atKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:aIJjiJcbI03GBc3ucY5DCSj
TLSH
T11C545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xupnhfzpjhczusmk.exe

Path C:\Temp\xupnhfzpjhczusmk.exe
Size 384KB
SHA256 019ce4cb46c8f9a30c43b92a72c6ade4dbcda3b558bca4944c57b1bbe9b65eb8
MD5 f17dea3bddecd171b17e66808c5ad209
SHA1 50f879211852bb686f48a9af43143a653b810507
SHA512 a5ed0c0438bef4429b4f5fc517a774515ffd6ec9cfb4f2f71023c2c943b220c50e6d2ae085c1c42eb5c477929889543b8df040c76fe5e61f09fd8b56ecef739f
SSDEEP 3072:G9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:0ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T17A847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xupnhfzpjhczusmk.sys

Path C:\Temp\xupnhfzpjhczusmk.sys
Size 293KB
SHA256 c36715703b38f4c3a18d754ffec48e50b2a64df4ffcf689247a54bfb98a0374f
MD5 5815514a7797e701043dd08ad0c9738f
SHA1 1a9d5de2c1376036a8face2eae47af0228a636c4
SHA512 b894474bbcbba9809c9fc5a23698a9dbcc392299e84803ad5e0a041b1084144a839eca46a1c5033e1bf48070888c9a4092e73dfa18af3a13892ec1e917f81ae3
SSDEEP 3072:ntKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:nIJjiJcbI03GBc3ucY5DCSj
TLSH
T125545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ysqlidavtn.exe

Path C:\Temp\ysqlidavtn.exe
Size 384KB
SHA256 c2a58d280e1dd11d6a13dabafa677de6a22586c6b6580639c02a55f09f330b97
MD5 7cbd78233a1382646e38f14a346a9c15
SHA1 a416257fc247e4b73a90e59c3bd3767149cf256b
SHA512 f26b6f21fa4694b57f718a1a80d596763bce417b9c2f2abf44be40664202f820fdd7f113ee61090cfc0c791bb1db3f865cfd0375e4b5103e3bbd18467247f1d2
SSDEEP 3072:/9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:FctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C1847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 18a644ba613d5b4137dabc346f57eca622b6888922eaec751025ab3c0a002fd5
MD5 5eddc74c05def624cfd47ea0a7e304a5
SHA1 b5f795fcc3846bb781e66e0373fce119975b2659
SHA512 1c777d774c154e89b80817ce7344495d83eecf133c36e0ad7c60dd14d76e628697535cc3fc379ca4eeb776f3bea5096f94d0fd76a2394ecd2e52f5ca8dc0053f
TLSH
T133D09B5672455C4CD641343224E55217E3008821654546194353F0768DD668717ABD9A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 da739d58d61b2ac7b5d9bb7ad60982cb15b364d9c7c9297fd0c9719c271cd985
MD5 2d2e0ac0da9a175b4b6a8be7c9d51cce
SHA1 ff15c8a5ff11faefae3f7491c7968a2163702b81
SHA512 0ae78f15909f04e1a81109917b8eeb5b8062a49558d8a40f15c02076b087f36e82b88b329e9d984fc68c62cb15408123b9db7f705f2745bfefc30b5aa2e164e6
TLSH
T1EAD09B5A72455D4CD641343224E55217E3108821754546194253F0768DD668717ABD9E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 012b637fb120c3c584ae9401439d934001e1644c5eb7574027d7ae04395afd22
MD5 bc9716b5039ff3e1f0b58ca23a569ca5
SHA1 e1d8a1432013f457c6e195ac52ed60715ce3df82
SHA512 cde1a7fa11b265fb46e10a6dc568ab7250b978a55016224f062c9b216df6b79023a0fa5f556ed6b30e46ebf9cbdb46e724c59b73fb25a8ebc15b2b169e89853d
TLSH
T1E761C896C3224BF7D72985B635E9449E31F04876390B1F02905B6D3948A3F8C29DF173
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5958e4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5958e4.TMP
Size 3KB
SHA256 fb260e94662bf371a711a84153676f7379f2e5a6cb97c6ec30a0c9be5aa4ddd7
MD5 0571f905af0ef91e1c71dbe338f0e9f9
SHA1 859a03d079b92fb13758c81b4ccf8a4e42fe6297
SHA512 626aebbb3fa8ff9b2fb4d74d143bd71faf0fd7cc5f84fb0383901562d7bd8fb4a428537bf4fd416e5b6b35ec8b1a6f8d76d6b27a70a09cd61dc08c4d54bfe841
TLSH
T19161D996C3224BF7D72984B235E944AE31F14876390B1F02905B6D3948A3F8C69EF173
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 dddf33eaf37227799dcf58db4aeb602978c602d10c63c86bca3875c8ad88f6a2
MD5 023196bc7a13943cbc9c31adda031c3b
SHA1 804ce1effd2375f4a00fb5b0418549852a40bebf
SHA512 3dceb259b476963ba37d79a2932a0ec896463891aa44de8acb910c53e4af9bf1d106d59a62d5f4e5fc065d6a2566a9b19637df8c5fd96c64e202edda05ae7fce
TLSH
T15C41BEF783F4856E891196F0AA186E2BCF2C0915832C7D5AC9E0AE2B93E3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 fe186195ba4c2d0f51f9b9304e06e9744527780692be6efdef031eb4fb61fac2
MD5 e078224f638734e196bf67a541e16b8b
SHA1 ee6b903c046404e83a17136394c2e35275b2441f
SHA512 10f53e19599597be93f33bce904820b2cc97df8e15af7c29cebc7e6b5885c76c049f59f8bda562dc31d2ae67fc86650a0ff2b32466ac5f03de7528afbc8c4b21
SSDEEP 192:sxRvRgCp/fXsM0XYCbKzoA8p9D/g6+WNCaY/YEUX3b+GjpIgVoJ:sxRvhp/fXsM0XPHN/50/6bfO
TLSH
T1D742B7166D28A93B8CC7E21DBA257F53D7F81132A0941E48EAFC9A1C04E76DD620780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 fb183ba04a0d640973db13414729e577e6f7bff74a357276e1a0d31364934370
MD5 36eeccf3a976256954b1ac3d97f89654
SHA1 a45d738cf09491bd0194fcd93266fae642ad0c31
SHA512 3327ed698960ff77d2175095b95c37addc89acfd1070028c85c626e09e610f1985619aba0910ba1015182e1d79978190b8d5db9919ca3867f28e2f6e2e15af57
SSDEEP 192:sxR4RgCp/fXsp0CNZvzYzoA8p9D/g6+WNCaY/YE81v3b+GjpIgDWeoJ:sxR4hp/fXsp0CjrhN/50/Gbfu
TLSH
T18742B816692869379CCBE619FB15BF53D7F85032A1941E48EAFCDA1C04E76CD620780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 3fd378eee96fac691bf84126dbd2b9f602981ab98efa1e735a82bc921ac34760
MD5 13ab5fcff506d4e24ea00d00907d7d02
SHA1 04b8a39918fbee220bc5d4ea21a05adbc6c702d3
SHA512 734d5468f9a5de37f67f7e5dae12e7583cabab108d7a8576f1903ae081431f6810afb85c5db270bcfdc994a61d8850faacd92ea886ae1aa0f4693b3a78609f6f
SSDEEP 192:sxR4RgCp/fXsp0XYCbKzoA8p9D/g6+WNCaY/YEUX3b+GjpIgDWsoJ:sxR4hp/fXsp0XPHN/50/6bfc
TLSH
T1D942B8166D28A93B4CCBE21DFB55BF53D7F81132A0901E48AAFC9A1C04E76DD620780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 7fa71cfa6251b5c5c1dbda683a8f5f3dd441387c8f28d757bd8ae7e588339e48
MD5 c24edab853f33180521fc4005f8a6976
SHA1 e3841e6b374aebf7172bdb095f6fa33336039237
SHA512 2e45f9de853f78dc1b53d32e891d28813a221d6affc15255391dc8ef777d3a9c86bb8d4a4f8a99f29e2aef1fb1e6835ffd5bc211acf4d219db6e055764b12cfd
SSDEEP 768:40Dk6DJQD8rF7pLuL7N0DbWgQ6DjfIQDF8F1+UoAYDCx9Tuqh0VfUC9xbog/OVpT:40Dk6DJQD8rTE7N0DbWgQ6DjfIQDFu13
TLSH
T19CD2EB7B640CCB7F4F804ADDAD197A8E6DA802CB96D8C98047FE991C02C7BEE51154DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 1a0ca7fcd455cd4e347cc0da91a8cb7723b3cf380281d8c879cf17f5e082b592
MD5 5daee16b3a7c055b50df8791c5fd51b9
SHA1 a3c07bdc5b3bc873f28eb8569df1344dbaba926c
SHA512 68978490d8d383ee4ee4befe3731a77ea251a0d5fd39cf1c35c6ba57da574b1dc4f203c843a0e71d01b1d6861a645cd160535276e94a360de749a73cdf4287ff
SSDEEP 768:qrv+4UNbdS3uEwGDTd+ZoH0BeX6+qTko0u229a4vsT+Pi9PKV:qbsbc3ApQvVTVKa47Pv
TLSH
T1F413BE31F8689D7388F6D684B11B32877F7825B3D5C40A58D9DCAB4D058B5A92B0BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 2cefd83b6225456e75a4e296860613a7239b560679cbb38c8df13bb875c0bbac
MD5 4a9dd5e85b4904fd015d4b835dd7b76c
SHA1 f578c452d79d77d007e145f5ee7129d6f8909da6
SHA512 ab9f5727fc7a91fc815d71f4b8ee646bd850c4eef661c11b73f55e1e1f58ae9891bff971e53864a5238c0989c77626b4048ef8ad7ed68b7b8b300508d42fe495
SSDEEP 768:prv+4UNbdG3NFyDTd+ZogeX6+qTko0u229a4vsDXeVH1SdW:pbsbU3nmvVTVKa4mEH1h
TLSH
T14603CF32E8698D778CE6D784714B75472FB92163C7881B80D9EDAF0D029B5AC270BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 185e9974fa41ea6911ae8f819a99e21b6495618e9d606d85c88613e99efa87a5
MD5 c64d2b377e4209619adf2e51e1a7d5dd
SHA1 afe5ad723f13384ee594c13f3507a78c4140a6ab
SHA512 be5ed5fe4eaf5ae4173cd9330074d27331a87d56e79560593a4a5904f20a2996d3ef90d28b79355285ecd43ea598cff13a2009fa90254a0dd0859f55393c321c
SSDEEP 768:sx3K8wGDTd+ZoH0BeX6+qTko0u229a4vsT+Pi9PK+:sx34pQvVTVKa47Pk
TLSH
T119F2BF71F8659C7348EAD78472563287AFB421B3E5C41E58D9ECEB0D058B66C1B0BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 6caad5f03c09f3ac7bba5e84859367306e00f4e1dd1c624f0a364b6b1f42a15a
MD5 3b3fd4d03b578b167e0182f1c0917f1b
SHA1 e9831c24170b379b4c2594c0047282719fc2887a
SHA512 16b52dd086c5e69ee879476c901c9417aa8e8cb14180c10927002065ecad4ff0e82faec25cf9a89105f9a36c05c42d9a74416bbe53a795758e1560153bf93c75
SSDEEP 768:6rv+4UNbdG37H9kDTd+ZoH0weX6+qTko0u229a4vsS+eVH1SdW:6bsbU3bpfvVTVKa4sEH1h
TLSH
T1F403CF32E8699D7349E7D684714B72872F7821B38A840F54D8EDAB4D064B19C2B0FD3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 cc1bf8af0a3a45cf69c6da5b8b9074c68f6d57eca7476879fbf9e020b84987f3
MD5 2ceb208b57c919bd0a50f6a55856984a
SHA1 8491aaa651d435df5ce59ac6473a0f82eb389077
SHA512 40c21fec13c139d2ba1451e633c3357e10611785144028e4c72b7721f6166883e7e6b4225f77b5a1084d5d4606a02c530f90716a0deee9092a1535a5e2747627
SSDEEP 768:q53K8whnZoH05eX6+qTko0u229a4vsT+Pi9PK+:q53+p4vVTVKa47Pk
TLSH
T1C3134AF1A4E39933C4AE9383633D6D469EBCD163B1880984BBD89E0CCC8657FD706816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

5b1f29bb-8db4-4f8b-9ce6-b596feb05deb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5b1f29bb-8db4-4f8b-9ce6-b596feb05deb.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5328_469897156\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 ab6f233f6b5e0bc2bf37f0b47cca32d8bf00a41c001da46cafbc70ddc7d2c200
MD5 5a185763409a6e2f0bea2e8cf2906eae
SHA1 5da8ccff6ec9e80445c169fbf5e3834d55b3f5c9
SHA512 65aa155527f29a7c413a3d24d1da423500fe684f791141f7c72368e0b825287251ff4fe3873da561b88262f0b4e9895f0c0d4959aacf8d9c3003cb9cadff1e28
TLSH
T14871008357A9D9B3C29A5FF102835208F5FB2238073330208B52555AAB30B3A54B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/200-410-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/200-333-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1140-488-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1864-471-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2128-430-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2472-467-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2548-263-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2792-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2820-366-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3044-322-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3056-269-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3056-235-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3136-326-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3232-284-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3944-337-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3956-462-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4876-187-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4944-406-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5304-386-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5388-307-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5688-441-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5912-224-0x000001E7C3350000-0x000001E7C370B000-memory.dmp

Download