systex | 3bf5330dd73a318179ab97941a555bcf61632dbb15bf2560d071d6bf645b0e2c

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 12:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-30_330bca49af77446d9ffe44882335cb51_amadey_darkgate_elex_smoke-loader_stop.exe
Size 384KB
Sample260930-pp9e9axhka
SHA256 3bf5330dd73a318179ab97941a555bcf61632dbb15bf2560d071d6bf645b0e2c
MD5 330bca49af77446d9ffe44882335cb51
SHA1 6d04bc890cc7ae4bf24b9ee6450c1050a07ce194
SHA512 f7e53eec84228e1da60bd35ca834d4d3b68e49a2c479033ec06700487a80955f543dfb0011a179387a628941ef8c083a8721b26c6801fd794eff816828f5ac44
SSDEEP 3072:kbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:kbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T19A847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
1088	ytqljdbvtnlgdywq.exe
4668	ytqljdbvtnlgdywq.sys
6028	CreateProcess.exe
984	yvtolgdyvq.exe
1500	CreateProcess.exe
4100	CreateProcess.exe
4676	i_yvtolgdyvq.exe
2904	aysqkifays.sys
4960	CreateProcess.exe
4956	ysqkidavtn.exe
6068	CreateProcess.exe
4736	CreateProcess.exe
1820	i_ysqkidavtn.exe
1116	pnkicvsnkf.sys
1368	CreateProcess.exe
3400	fdxusnkfax.exe
4636	CreateProcess.exe
4620	CreateProcess.exe
5176	i_fdxusnkfax.exe
3660	ausmkecwup.sys
4308	CreateProcess.exe
4756	ausmkecxup.exe
5832	CreateProcess.exe
6004	CreateProcess.exe
3444	i_ausmkecxup.exe
3404	zurpmhfcxu.sys
3300	CreateProcess.exe
5976	rmjhbzurmj.exe
2644	CreateProcess.exe
1604	CreateProcess.exe
988	i_rmjhbzurmj.exe
4424	mjecwuomje.sys
2772	CreateProcess.exe
6036	jhbztrmjec.exe
2116	CreateProcess.exe
1516	CreateProcess.exe
6084	i_jhbztrmjec.exe
4484	jgeywtolje.sys
1660	CreateProcess.exe
4216	mjdbzwromg.exe
2904	CreateProcess.exe
5952	CreateProcess.exe
3860	i_mjdbzwromg.exe
1212	oljdbytqlj.sys
1060	CreateProcess.exe
4480	qljdbytqlj.exe
3588	CreateProcess.exe
3404	CreateProcess.exe
4124	i_qljdbytqlj.exe
4692	ytrljdbywt.sys
1904	CreateProcess.exe
5336	nlidbvtnlg.exe
5728	CreateProcess.exe
3376	CreateProcess.exe
5092	i_nlidbvtnlg.exe
1056	gdyvqnifdx.sys
3432	CreateProcess.exe
4796	avsnlfdxvq.exe
5452	CreateProcess.exe
2708	CreateProcess.exe
5488	i_avsnlfdxvq.exe
3576	lfdxusqkif.sys
1836	CreateProcess.exe
3856	fcausnkica.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2868_1132799799\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2868_1248709907\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2868_1248709907\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2868_1377923900\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2868_1377923900\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2868_1377923900\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2868_1377923900\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2868_628104627\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2868_1132799799\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvtolgdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qljdbytqlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlidbvtnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlidbvtnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmhezxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgezwuomhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhbztrmjec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvtolgdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxusnkfax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgezwuomhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	davtqlidby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqkidavtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjdbzwromg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qljdbytqlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcausnkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmhezxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvtnlgdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-30_330bca49af77446d9ffe44882335cb51_amadey_darkgate_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ytqljdbvtnlgdywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ausmkecxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjdbzwromg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fcausnkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnifdxvpni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhbztrmjec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avsnlfdxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_avsnlfdxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnhfzusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxusnkfax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnhfzusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezwrojgbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bytrljdbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bytrljdbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_davtqlidby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ausmkecxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmjhbzurmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvtnlgdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqkidavtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmjhbzurmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezwrojgbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnifdxvpni.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5624	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3328	ipconfig.exe
2236	ipconfig.exe
3460	ipconfig.exe
4076	ipconfig.exe
3556	ipconfig.exe
2120	ipconfig.exe
3680	ipconfig.exe
1916	ipconfig.exe
252	ipconfig.exe
1688	ipconfig.exe
2856	ipconfig.exe
5176	ipconfig.exe
2592	ipconfig.exe
3680	ipconfig.exe
3816	ipconfig.exe
4244	ipconfig.exe
3924	ipconfig.exe
4492	ipconfig.exe
2264	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4154726816-2055034831-2297277433-1000\{E9FF07A5-2182-49E8-B352-E8ED8524A2A7}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1808	2026-09-30_330bca49af77446d9ffe44882335cb51_amadey_darkgate_elex_smoke-loader_stop.exe
1808	2026-09-30_330bca49af77446d9ffe44882335cb51_amadey_darkgate_elex_smoke-loader_stop.exe
1808	2026-09-30_330bca49af77446d9ffe44882335cb51_amadey_darkgate_elex_smoke-loader_stop.exe
1808	2026-09-30_330bca49af77446d9ffe44882335cb51_amadey_darkgate_elex_smoke-loader_stop.exe
1808	2026-09-30_330bca49af77446d9ffe44882335cb51_amadey_darkgate_elex_smoke-loader_stop.exe
1808	2026-09-30_330bca49af77446d9ffe44882335cb51_amadey_darkgate_elex_smoke-loader_stop.exe
1808	2026-09-30_330bca49af77446d9ffe44882335cb51_amadey_darkgate_elex_smoke-loader_stop.exe
1808	2026-09-30_330bca49af77446d9ffe44882335cb51_amadey_darkgate_elex_smoke-loader_stop.exe
1808	2026-09-30_330bca49af77446d9ffe44882335cb51_amadey_darkgate_elex_smoke-loader_stop.exe
1808	2026-09-30_330bca49af77446d9ffe44882335cb51_amadey_darkgate_elex_smoke-loader_stop.exe
1808	2026-09-30_330bca49af77446d9ffe44882335cb51_amadey_darkgate_elex_smoke-loader_stop.exe
1808	2026-09-30_330bca49af77446d9ffe44882335cb51_amadey_darkgate_elex_smoke-loader_stop.exe
1808	2026-09-30_330bca49af77446d9ffe44882335cb51_amadey_darkgate_elex_smoke-loader_stop.exe
1808	2026-09-30_330bca49af77446d9ffe44882335cb51_amadey_darkgate_elex_smoke-loader_stop.exe
1808	2026-09-30_330bca49af77446d9ffe44882335cb51_amadey_darkgate_elex_smoke-loader_stop.exe
1808	2026-09-30_330bca49af77446d9ffe44882335cb51_amadey_darkgate_elex_smoke-loader_stop.exe
1808	2026-09-30_330bca49af77446d9ffe44882335cb51_amadey_darkgate_elex_smoke-loader_stop.exe
1808	2026-09-30_330bca49af77446d9ffe44882335cb51_amadey_darkgate_elex_smoke-loader_stop.exe
1808	2026-09-30_330bca49af77446d9ffe44882335cb51_amadey_darkgate_elex_smoke-loader_stop.exe
1808	2026-09-30_330bca49af77446d9ffe44882335cb51_amadey_darkgate_elex_smoke-loader_stop.exe
1808	2026-09-30_330bca49af77446d9ffe44882335cb51_amadey_darkgate_elex_smoke-loader_stop.exe
1808	2026-09-30_330bca49af77446d9ffe44882335cb51_amadey_darkgate_elex_smoke-loader_stop.exe
1808	2026-09-30_330bca49af77446d9ffe44882335cb51_amadey_darkgate_elex_smoke-loader_stop.exe
1808	2026-09-30_330bca49af77446d9ffe44882335cb51_amadey_darkgate_elex_smoke-loader_stop.exe
1808	2026-09-30_330bca49af77446d9ffe44882335cb51_amadey_darkgate_elex_smoke-loader_stop.exe
1808	2026-09-30_330bca49af77446d9ffe44882335cb51_amadey_darkgate_elex_smoke-loader_stop.exe
1808	2026-09-30_330bca49af77446d9ffe44882335cb51_amadey_darkgate_elex_smoke-loader_stop.exe
1808	2026-09-30_330bca49af77446d9ffe44882335cb51_amadey_darkgate_elex_smoke-loader_stop.exe
1808	2026-09-30_330bca49af77446d9ffe44882335cb51_amadey_darkgate_elex_smoke-loader_stop.exe
1808	2026-09-30_330bca49af77446d9ffe44882335cb51_amadey_darkgate_elex_smoke-loader_stop.exe
1808	2026-09-30_330bca49af77446d9ffe44882335cb51_amadey_darkgate_elex_smoke-loader_stop.exe
1808	2026-09-30_330bca49af77446d9ffe44882335cb51_amadey_darkgate_elex_smoke-loader_stop.exe
1808	2026-09-30_330bca49af77446d9ffe44882335cb51_amadey_darkgate_elex_smoke-loader_stop.exe
1808	2026-09-30_330bca49af77446d9ffe44882335cb51_amadey_darkgate_elex_smoke-loader_stop.exe
1808	2026-09-30_330bca49af77446d9ffe44882335cb51_amadey_darkgate_elex_smoke-loader_stop.exe
1808	2026-09-30_330bca49af77446d9ffe44882335cb51_amadey_darkgate_elex_smoke-loader_stop.exe
1808	2026-09-30_330bca49af77446d9ffe44882335cb51_amadey_darkgate_elex_smoke-loader_stop.exe
1808	2026-09-30_330bca49af77446d9ffe44882335cb51_amadey_darkgate_elex_smoke-loader_stop.exe
1808	2026-09-30_330bca49af77446d9ffe44882335cb51_amadey_darkgate_elex_smoke-loader_stop.exe
1808	2026-09-30_330bca49af77446d9ffe44882335cb51_amadey_darkgate_elex_smoke-loader_stop.exe
1808	2026-09-30_330bca49af77446d9ffe44882335cb51_amadey_darkgate_elex_smoke-loader_stop.exe
1808	2026-09-30_330bca49af77446d9ffe44882335cb51_amadey_darkgate_elex_smoke-loader_stop.exe
1808	2026-09-30_330bca49af77446d9ffe44882335cb51_amadey_darkgate_elex_smoke-loader_stop.exe
1808	2026-09-30_330bca49af77446d9ffe44882335cb51_amadey_darkgate_elex_smoke-loader_stop.exe
1808	2026-09-30_330bca49af77446d9ffe44882335cb51_amadey_darkgate_elex_smoke-loader_stop.exe
1808	2026-09-30_330bca49af77446d9ffe44882335cb51_amadey_darkgate_elex_smoke-loader_stop.exe
1808	2026-09-30_330bca49af77446d9ffe44882335cb51_amadey_darkgate_elex_smoke-loader_stop.exe
1808	2026-09-30_330bca49af77446d9ffe44882335cb51_amadey_darkgate_elex_smoke-loader_stop.exe
1808	2026-09-30_330bca49af77446d9ffe44882335cb51_amadey_darkgate_elex_smoke-loader_stop.exe
1808	2026-09-30_330bca49af77446d9ffe44882335cb51_amadey_darkgate_elex_smoke-loader_stop.exe
1808	2026-09-30_330bca49af77446d9ffe44882335cb51_amadey_darkgate_elex_smoke-loader_stop.exe
1808	2026-09-30_330bca49af77446d9ffe44882335cb51_amadey_darkgate_elex_smoke-loader_stop.exe
1808	2026-09-30_330bca49af77446d9ffe44882335cb51_amadey_darkgate_elex_smoke-loader_stop.exe
1808	2026-09-30_330bca49af77446d9ffe44882335cb51_amadey_darkgate_elex_smoke-loader_stop.exe
1808	2026-09-30_330bca49af77446d9ffe44882335cb51_amadey_darkgate_elex_smoke-loader_stop.exe
1808	2026-09-30_330bca49af77446d9ffe44882335cb51_amadey_darkgate_elex_smoke-loader_stop.exe
1088	ytqljdbvtnlgdywq.exe
1088	ytqljdbvtnlgdywq.exe
1088	ytqljdbvtnlgdywq.exe
1088	ytqljdbvtnlgdywq.exe
1088	ytqljdbvtnlgdywq.exe
1088	ytqljdbvtnlgdywq.exe
1088	ytqljdbvtnlgdywq.exe
1088	ytqljdbvtnlgdywq.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	4676	i_yvtolgdyvq.exe
Token: SeDebugPrivilege	1820	i_ysqkidavtn.exe
Token: SeDebugPrivilege	5176	i_fdxusnkfax.exe
Token: SeDebugPrivilege	3444	i_ausmkecxup.exe
Token: SeDebugPrivilege	988	i_rmjhbzurmj.exe
Token: SeDebugPrivilege	6084	i_jhbztrmjec.exe
Token: SeDebugPrivilege	3860	i_mjdbzwromg.exe
Token: SeDebugPrivilege	4124	i_qljdbytqlj.exe
Token: SeDebugPrivilege	5092	i_nlidbvtnlg.exe
Token: SeDebugPrivilege	5488	i_avsnlfdxvq.exe
Token: SeDebugPrivilege	2416	i_fcausnkica.exe
Token: SeDebugPrivilege	5640	i_xvpnhfzusm.exe
Token: SeDebugPrivilege	4272	i_pmhezxrpjh.exe
Token: SeDebugPrivilege	5844	i_mgezwuomhb.exe
Token: SeDebugPrivilege	4460	i_ezwrojgbzt.exe
Token: SeDebugPrivilege	6084	i_bytrljdbzt.exe
Token: SeDebugPrivilege	2080	i_yvtnlgdyvq.exe
Token: SeDebugPrivilege	4088	i_davtqlidby.exe
Token: SeDebugPrivilege	1692	i_qnifdxvpni.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2868	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 1088	1808	2026-09-30_330bca49af77446d9ffe44882335cb51_amadey_darkgate_elex_smoke-loader_stop.exe	89
PID 1808 wrote to memory of 2256	1808	2026-09-30_330bca49af77446d9ffe44882335cb51_amadey_darkgate_elex_smoke-loader_stop.exe	90
PID 2256 wrote to memory of 2868	2256	iexplore.exe	91
PID 2868 wrote to memory of 1188	2868	msedge.exe	92
PID 2868 wrote to memory of 5624	2868	msedge.exe	93
PID 2868 wrote to memory of 1968	2868	msedge.exe	94
PID 2868 wrote to memory of 1968	2868	msedge.exe	94
PID 2868 wrote to memory of 1968	2868	msedge.exe	94
PID 2868 wrote to memory of 2744	2868	msedge.exe	95
PID 2868 wrote to memory of 2744	2868	msedge.exe	95
PID 2868 wrote to memory of 5176	2868	msedge.exe	97
PID 2868 wrote to memory of 5176	2868	msedge.exe	97
PID 2868 wrote to memory of 5176	2868	msedge.exe	97
PID 2868 wrote to memory of 4148	2868	msedge.exe	98
PID 2868 wrote to memory of 4148	2868	msedge.exe	98
PID 2868 wrote to memory of 4148	2868	msedge.exe	98
PID 2868 wrote to memory of 988	2868	msedge.exe	100
PID 2868 wrote to memory of 948	2868	msedge.exe	99
PID 2868 wrote to memory of 988	2868	msedge.exe	100
PID 2868 wrote to memory of 988	2868	msedge.exe	100
PID 2868 wrote to memory of 948	2868	msedge.exe	99
PID 2868 wrote to memory of 948	2868	msedge.exe	99
PID 2868 wrote to memory of 1380	2868	msedge.exe	102
PID 2868 wrote to memory of 1380	2868	msedge.exe	102
PID 2868 wrote to memory of 5236	2868	msedge.exe	105
PID 2868 wrote to memory of 5020	2868	msedge.exe	106
PID 2868 wrote to memory of 5236	2868	msedge.exe	105
PID 2868 wrote to memory of 5020	2868	msedge.exe	106
PID 1088 wrote to memory of 6028	1088	ytqljdbvtnlgdywq.exe	107
PID 2868 wrote to memory of 2120	2868	msedge.exe	110
PID 984 wrote to memory of 1500	984	yvtolgdyvq.exe	112
PID 2868 wrote to memory of 5436	2868	msedge.exe	117
PID 2868 wrote to memory of 5436	2868	msedge.exe	117
PID 2868 wrote to memory of 2364	2868	msedge.exe	118
PID 2868 wrote to memory of 2364	2868	msedge.exe	118
PID 1088 wrote to memory of 4100	1088	ytqljdbvtnlgdywq.exe	119
PID 1088 wrote to memory of 4960	1088	ytqljdbvtnlgdywq.exe	123
PID 4956 wrote to memory of 6068	4956	ysqkidavtn.exe	125
PID 1088 wrote to memory of 4736	1088	ytqljdbvtnlgdywq.exe	128
PID 1088 wrote to memory of 1368	1088	ytqljdbvtnlgdywq.exe	132
PID 3400 wrote to memory of 4636	3400	fdxusnkfax.exe	134
PID 1088 wrote to memory of 4620	1088	ytqljdbvtnlgdywq.exe	137
PID 1088 wrote to memory of 4308	1088	ytqljdbvtnlgdywq.exe	142
PID 4756 wrote to memory of 5832	4756	ausmkecxup.exe	144
PID 1088 wrote to memory of 6004	1088	ytqljdbvtnlgdywq.exe	147
PID 2868 wrote to memory of 3588	2868	msedge.exe	149
PID 2868 wrote to memory of 2892	2868	msedge.exe	150
PID 2868 wrote to memory of 4940	2868	msedge.exe	151
PID 1088 wrote to memory of 3300	1088	ytqljdbvtnlgdywq.exe	154
PID 5976 wrote to memory of 2644	5976	rmjhbzurmj.exe	156
PID 1088 wrote to memory of 1604	1088	ytqljdbvtnlgdywq.exe	159
PID 1088 wrote to memory of 2772	1088	ytqljdbvtnlgdywq.exe	163
PID 6036 wrote to memory of 2116	6036	jhbztrmjec.exe	165
PID 1088 wrote to memory of 1516	1088	ytqljdbvtnlgdywq.exe	168
PID 1088 wrote to memory of 1660	1088	ytqljdbvtnlgdywq.exe	172
PID 4216 wrote to memory of 2904	4216	mjdbzwromg.exe	174
PID 1088 wrote to memory of 5952	1088	ytqljdbvtnlgdywq.exe	177
PID 1088 wrote to memory of 1060	1088	ytqljdbvtnlgdywq.exe	181
PID 4480 wrote to memory of 3588	4480	qljdbytqlj.exe	183
PID 1088 wrote to memory of 3404	1088	ytqljdbvtnlgdywq.exe	186
PID 2868 wrote to memory of 4968	2868	msedge.exe	188
PID 2868 wrote to memory of 4968	2868	msedge.exe	188
PID 1088 wrote to memory of 1904	1088	ytqljdbvtnlgdywq.exe	194
PID 5336 wrote to memory of 5728	5336	nlidbvtnlg.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-09-30_330bca49af77446d9ffe44882335cb51_amadey_darkgate_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_330bca49af77446d9ffe44882335cb51_amadey_darkgate_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Temp\ytqljdbvtnlgdywq.exe
  C:\Temp\ytqljdbvtnlgdywq.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1088
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\yvtolgdyvq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6028
  - - C:\Temp\yvtolgdyvq.exe
      C:\Temp\yvtolgdyvq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:984
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1500
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1916
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_yvtolgdyvq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4100
  - - C:\Temp\i_yvtolgdyvq.exe
      C:\Temp\i_yvtolgdyvq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4676
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ysqkidavtn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4960
  - - C:\Temp\ysqkidavtn.exe
      C:\Temp\ysqkidavtn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4956
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6068
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3816
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ysqkidavtn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4736
  - - C:\Temp\i_ysqkidavtn.exe
      C:\Temp\i_ysqkidavtn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1820
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fdxusnkfax.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1368
  - - C:\Temp\fdxusnkfax.exe
      C:\Temp\fdxusnkfax.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3400
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4636
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:252
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fdxusnkfax.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4620
  - - C:\Temp\i_fdxusnkfax.exe
      C:\Temp\i_fdxusnkfax.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5176
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ausmkecxup.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4308
  - - C:\Temp\ausmkecxup.exe
      C:\Temp\ausmkecxup.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4756
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5832
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1688
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ausmkecxup.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6004
  - - C:\Temp\i_ausmkecxup.exe
      C:\Temp\i_ausmkecxup.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3444
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rmjhbzurmj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3300
  - - C:\Temp\rmjhbzurmj.exe
      C:\Temp\rmjhbzurmj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5976
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2644
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2856
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rmjhbzurmj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1604
  - - C:\Temp\i_rmjhbzurmj.exe
      C:\Temp\i_rmjhbzurmj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:988
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jhbztrmjec.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2772
  - - C:\Temp\jhbztrmjec.exe
      C:\Temp\jhbztrmjec.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6036
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2116
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5176
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jhbztrmjec.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1516
  - - C:\Temp\i_jhbztrmjec.exe
      C:\Temp\i_jhbztrmjec.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6084
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mjdbzwromg.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1660
  - - C:\Temp\mjdbzwromg.exe
      C:\Temp\mjdbzwromg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4216
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2904
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2592
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mjdbzwromg.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5952
  - - C:\Temp\i_mjdbzwromg.exe
      C:\Temp\i_mjdbzwromg.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3860
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qljdbytqlj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1060
  - - C:\Temp\qljdbytqlj.exe
      C:\Temp\qljdbytqlj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4480
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3588
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4076
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qljdbytqlj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3404
  - - C:\Temp\i_qljdbytqlj.exe
      C:\Temp\i_qljdbytqlj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4124
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nlidbvtnlg.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1904
  - - C:\Temp\nlidbvtnlg.exe
      C:\Temp\nlidbvtnlg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5336
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5728
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3328
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nlidbvtnlg.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3376
  - - C:\Temp\i_nlidbvtnlg.exe
      C:\Temp\i_nlidbvtnlg.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5092
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\avsnlfdxvq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3432
  - - C:\Temp\avsnlfdxvq.exe
      C:\Temp\avsnlfdxvq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4796
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5452
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3556
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_avsnlfdxvq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2708
  - - C:\Temp\i_avsnlfdxvq.exe
      C:\Temp\i_avsnlfdxvq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5488
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fcausnkica.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1836
  - - C:\Temp\fcausnkica.exe
      C:\Temp\fcausnkica.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3856
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4584
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2120
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fcausnkica.exe ups_ins
    3⤵
    PID:4228
  - - C:\Temp\i_fcausnkica.exe
      C:\Temp\i_fcausnkica.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2416
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvpnhfzusm.exe ups_run
    3⤵
    PID:2548
  - - C:\Temp\xvpnhfzusm.exe
      C:\Temp\xvpnhfzusm.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2756
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2076
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3680
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xvpnhfzusm.exe ups_ins
    3⤵
    PID:1552
  - - C:\Temp\i_xvpnhfzusm.exe
      C:\Temp\i_xvpnhfzusm.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5640
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pmhezxrpjh.exe ups_run
    3⤵
    PID:5824
  - - C:\Temp\pmhezxrpjh.exe
      C:\Temp\pmhezxrpjh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3152
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2592
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4244
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pmhezxrpjh.exe ups_ins
    3⤵
    PID:5472
  - - C:\Temp\i_pmhezxrpjh.exe
      C:\Temp\i_pmhezxrpjh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4272
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mgezwuomhb.exe ups_run
    3⤵
    PID:3472
  - - C:\Temp\mgezwuomhb.exe
      C:\Temp\mgezwuomhb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:592
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5896
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2236
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mgezwuomhb.exe ups_ins
    3⤵
    PID:4832
  - - C:\Temp\i_mgezwuomhb.exe
      C:\Temp\i_mgezwuomhb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5844
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ezwrojgbzt.exe ups_run
    3⤵
    PID:5768
  - - C:\Temp\ezwrojgbzt.exe
      C:\Temp\ezwrojgbzt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1068
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1356
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3460
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ezwrojgbzt.exe ups_ins
    3⤵
    PID:4324
  - - C:\Temp\i_ezwrojgbzt.exe
      C:\Temp\i_ezwrojgbzt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4460
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bytrljdbzt.exe ups_run
    3⤵
    PID:2888
  - - C:\Temp\bytrljdbzt.exe
      C:\Temp\bytrljdbzt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:8
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2656
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3680
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bytrljdbzt.exe ups_ins
    3⤵
    PID:5144
  - - C:\Temp\i_bytrljdbzt.exe
      C:\Temp\i_bytrljdbzt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6084
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\yvtnlgdyvq.exe ups_run
    3⤵
    PID:2956
  - - C:\Temp\yvtnlgdyvq.exe
      C:\Temp\yvtnlgdyvq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4888
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3096
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3924
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_yvtnlgdyvq.exe ups_ins
    3⤵
    PID:6072
  - - C:\Temp\i_yvtnlgdyvq.exe
      C:\Temp\i_yvtnlgdyvq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2080
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\davtqlidby.exe ups_run
    3⤵
    PID:1208
  - - C:\Temp\davtqlidby.exe
      C:\Temp\davtqlidby.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5484
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3112
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4492
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_davtqlidby.exe ups_ins
    3⤵
    PID:3264
  - - C:\Temp\i_davtqlidby.exe
      C:\Temp\i_davtqlidby.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4088
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qnifdxvpni.exe ups_run
    3⤵
    PID:5572
  - - C:\Temp\qnifdxvpni.exe
      C:\Temp\qnifdxvpni.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1880
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5052
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2264
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qnifdxvpni.exe ups_ins
    3⤵
    PID:4420
  - - C:\Temp\i_qnifdxvpni.exe
      C:\Temp\i_qnifdxvpni.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1692
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x394,0x7ffefd88c188,0x7ffefd88c194,0x7ffefd88c1a0
      4⤵
      PID:1188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1888,i,10283021066778459697,13886520880726837692,524288 --field-trial-handle=2288,i,9067416748540306629,1554774447625348757,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:11
      4⤵
      System Time Discovery
      PID:5624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1600,i,2393844148659805487,1792692348194245789,262144 --field-trial-handle=2288,i,9067416748540306629,1554774447625348757,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
      4⤵
      PID:1968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2464,i,2432647047262674668,13674320513823303855,524288 --field-trial-handle=2288,i,9067416748540306629,1554774447625348757,262144 --variations-seed-version --mojo-platform-channel-handle=3040 /prefetch:13
      4⤵
      PID:2744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3572,i,5294287464897502066,10819539655121820874,2097152 --field-trial-handle=2288,i,9067416748540306629,1554774447625348757,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
      4⤵
      PID:5176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3592,i,716219700065512829,7336292951463968638,2097152 --field-trial-handle=2288,i,9067416748540306629,1554774447625348757,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
      4⤵
      PID:4148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,8829664361308418691,16888068164111779578,2097152 --field-trial-handle=2288,i,9067416748540306629,1554774447625348757,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:1
      4⤵
      PID:948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,10076319527185014442,9425244159913867209,2097152 --field-trial-handle=2288,i,9067416748540306629,1554774447625348757,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:9
      4⤵
      PID:988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3772,i,612283479925997724,3308650386691718087,524288 --field-trial-handle=2288,i,9067416748540306629,1554774447625348757,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:14
      4⤵
      PID:1380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,2475801949090550009,16889080232444891040,524288 --field-trial-handle=2288,i,9067416748540306629,1554774447625348757,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:14
      4⤵
      PID:5236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3624,i,2984596417253442152,3272198158018541234,524288 --field-trial-handle=2288,i,9067416748540306629,1554774447625348757,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:14
      4⤵
      PID:5020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,11243469964115931423,6733068787571517147,524288 --field-trial-handle=2288,i,9067416748540306629,1554774447625348757,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:14
      4⤵
      PID:5488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,11243469964115931423,6733068787571517147,524288 --field-trial-handle=2288,i,9067416748540306629,1554774447625348757,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:14
      4⤵
      PID:2120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,15691861380227737093,841950409185061882,524288 --field-trial-handle=2288,i,9067416748540306629,1554774447625348757,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:14
      4⤵
      PID:5436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6616,i,81839720297851509,13602995477087076966,524288 --field-trial-handle=2288,i,9067416748540306629,1554774447625348757,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:14
      4⤵
      PID:2364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,12184210944740515321,14072340254330305190,524288 --field-trial-handle=2288,i,9067416748540306629,1554774447625348757,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:14
      4⤵
      PID:3588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,11356787891601013345,3610551453811764206,524288 --field-trial-handle=2288,i,9067416748540306629,1554774447625348757,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:14
      4⤵
      PID:2892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,15110270989916375812,8642254134562995478,524288 --field-trial-handle=2288,i,9067416748540306629,1554774447625348757,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:14
      4⤵
      PID:4940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2472,i,1428006214909477611,7387084581476731936,524288 --field-trial-handle=2288,i,9067416748540306629,1554774447625348757,262144 --variations-seed-version --mojo-platform-channel-handle=3272 /prefetch:14
      4⤵
      PID:4968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,14242176869714957585,17719391479949651307,524288 --field-trial-handle=2288,i,9067416748540306629,1554774447625348757,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:14
      4⤵
      PID:4504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,2506786450372047063,4943370654068482009,524288 --field-trial-handle=2288,i,9067416748540306629,1554774447625348757,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:14
      4⤵
      PID:5956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,32572253421154541,14489915499771585470,524288 --field-trial-handle=2288,i,9067416748540306629,1554774447625348757,262144 --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:14
      4⤵
      PID:3328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6132,i,10812119802712381417,5299282438663640961,262144 --field-trial-handle=2288,i,9067416748540306629,1554774447625348757,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:10
      4⤵
      PID:5764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,17292692809973928582,3349962746745061444,524288 --field-trial-handle=2288,i,9067416748540306629,1554774447625348757,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:14
      4⤵
      PID:5960

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2824

C:\Temp\ytqljdbvtnlgdywq.sys
C:\Temp\ytqljdbvtnlgdywq.sys
1⤵
- Executes dropped EXE
PID:4668

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3708

C:\Temp\aysqkifays.sys
C:\Temp\aysqkifays.sys
1⤵
- Executes dropped EXE
PID:2904

C:\Temp\pnkicvsnkf.sys
C:\Temp\pnkicvsnkf.sys
1⤵
- Executes dropped EXE
PID:1116

C:\Temp\ausmkecwup.sys
C:\Temp\ausmkecwup.sys
1⤵
- Executes dropped EXE
PID:3660

C:\Temp\zurpmhfcxu.sys
C:\Temp\zurpmhfcxu.sys
1⤵
- Executes dropped EXE
PID:3404

C:\Temp\mjecwuomje.sys
C:\Temp\mjecwuomje.sys
1⤵
- Executes dropped EXE
PID:4424

C:\Temp\jgeywtolje.sys
C:\Temp\jgeywtolje.sys
1⤵
- Executes dropped EXE
PID:4484

C:\Temp\oljdbytqlj.sys
C:\Temp\oljdbytqlj.sys
1⤵
- Executes dropped EXE
PID:1212

C:\Temp\ytrljdbywt.sys
C:\Temp\ytrljdbywt.sys
1⤵
- Executes dropped EXE
PID:4692

C:\Temp\gdyvqnifdx.sys
C:\Temp\gdyvqnifdx.sys
1⤵
- Executes dropped EXE
PID:1056

C:\Temp\lfdxusqkif.sys
C:\Temp\lfdxusqkif.sys
1⤵
- Executes dropped EXE
PID:3576

C:\Temp\xspkicausm.sys
C:\Temp\xspkicausm.sys
1⤵
PID:3328

C:\Temp\upmkecausp.sys
C:\Temp\upmkecausp.sys
1⤵
PID:4444

C:\Temp\pmhfzxrpjh.sys
C:\Temp\pmhfzxrpjh.sys
1⤵
PID:6072

C:\Temp\bztrpjgebz.sys
C:\Temp\bztrpjgebz.sys
1⤵
PID:4492

C:\Temp\bzwqljdbyt.sys
C:\Temp\bzwqljdbyt.sys
1⤵
PID:5572

C:\Temp\geywqolgdb.sys
C:\Temp\geywqolgdb.sys
1⤵
PID:4816

C:\Temp\daysqoigay.sys
C:\Temp\daysqoigay.sys
1⤵
PID:2636

C:\Temp\qnigaxsqki.sys
C:\Temp\qnigaxsqki.sys
1⤵
PID:5704

C:\Temp\xvkicausnk.sys
C:\Temp\xvkicausnk.sys
1⤵
PID:504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ausmkecwup.sys

Path C:\Temp\ausmkecwup.sys
Size 293KB
SHA256 abd80e6547957dfade3e6d49c8c17baf02b747efdae36b36c9b17e253d1ee810
MD5 2acbf31e18444d0d6dd97397c6289ffb
SHA1 21b6f6680f69c87b846500fd674fb8806d5bccc9
SHA512 68090e8d5aa5313c85407b30a2492ab433959e58b4e71817ac687679135f8ece676d4f4f3890a2433e0a43f04da090fa6d10fd662b2ef12747112c55de12fc47
SSDEEP 3072:+tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:+IJjiJcbI03GBc3ucY5DCSj
TLSH
T1BD545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ausmkecxup.exe

Path C:\Temp\ausmkecxup.exe
Size 384KB
SHA256 75698d6c8f2edace8fd394f582074c9a736d585333a38ca8ef13212afb286a6c
MD5 3cf015e415e612e8d040c7350f7f5591
SHA1 db8b82b905e035fd1300acc57a8650e230f02db0
SHA512 e8d20861151f9c4dbf7689a4709fac0c66d45ca6ac30f22efd8169bbfb2f1f796d460ca1ff6617231184eead576eb5cca5ee763aaa8807206f71ea9c361613da
SSDEEP 3072:ubtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:ubtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T14C847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC3F754CE5D9A517C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aysqkifays.sys

Path C:\Temp\aysqkifays.sys
Size 293KB
SHA256 835d0ce74ab4fef2818f714dc89860b60781998ab5201a0392f06af64c97abfb
MD5 9e5d034809c140b6ffef6eeae39b5bba
SHA1 3e687e8e56d0c8de42f73e345def608e2c4de632
SHA512 016d5858b5ca51617f89c1b5dfaf315a04944eef047d2ddd7366a3831446a995f81f04a0da125a623d0e12e3da428a6dbebfe4717908e6d13dd1fc87cb71f793
SSDEEP 3072:7tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:7IJjiJcbI03GBc3ucY5DCSj
TLSH
T19A545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdxusnkfax.exe

Path C:\Temp\fdxusnkfax.exe
Size 384KB
SHA256 3bcb47c6e5ef8d72949e5a3ced50a129cccca93793fae10528708a850a394cd3
MD5 08aa3b0e209c109c9c45d43f4dcbe18f
SHA1 e03c296d2d043bdd0ead91992a7dcfe65f42b978
SHA512 0ed43db85bf9e6096dd6dea7eb36a45b30f30fe9046e6829ce5d90e1715718abee17b15778b3044c6c5d848f381d74ba29ee82ce10977ce64729960b1ed65d6e
SSDEEP 3072:pbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:pbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T160847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC3F754CE5D9A517C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ausmkecxup.exe

Path C:\Temp\i_ausmkecxup.exe
Size 384KB
SHA256 93a42b9ad2687d6ce17939f01c109742dcff401dfc890571ea4056fdfecde354
MD5 47017954358f3592d87c0be53cb2580b
SHA1 9691c34cc724c1021e1a4c00ac4eeb9ce1ef1661
SHA512 e4011024aa032db32afc2d8f25152f01449c9176665072576f7f776405f96ac4ed6cbe4b67658667a2321422f9ffab83afefb71e8231b23fa758dcd3d14e5ff5
SSDEEP 3072:AbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:Abtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T11E847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC3F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fdxusnkfax.exe

Path C:\Temp\i_fdxusnkfax.exe
Size 384KB
SHA256 3d18576013eea0c5fdead2e3703d28e809983515562262c2c286f435f3498105
MD5 2be8bb2d84c74f82204951c9ce973b23
SHA1 158dcfdb1839e14a5cc204c6994427822fd28321
SHA512 c3102c73d047af5f56b2c80c1cb804c958df6b76a822119ef66e6e4610b0112e8193900d8ff2c94ac8be4b48dde728842deae8d70f98a0e943eab825352e7dd2
SSDEEP 3072:nbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:nbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T12E847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F354CE5D9A517C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rmjhbzurmj.exe

Path C:\Temp\i_rmjhbzurmj.exe
Size 384KB
SHA256 0f489b153893ee8772db3300c7391f5cc144dd7e675b047f2cd0c288710197fc
MD5 22a3807fce15e90a6155ab494de0e55d
SHA1 3435e79a0df4b387a77a118fd2ce74acafc6bdc0
SHA512 d6409f5397bd42381189313022b390a292949b5a53c721d3db43755b85ff505d12d4143fb4dce3d1e13c57e03a3b3aed2d866c9a6b7e02e60d2114b3551c712d
SSDEEP 3072:3btF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:3btt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T129847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ysqkidavtn.exe

Path C:\Temp\i_ysqkidavtn.exe
Size 384KB
SHA256 716a1b020cb6498bf16f5a81d0d859b44ebcbec07f8af533fea4eb8a7c8c5743
MD5 270cccefbe65cba74cfa154364f88df4
SHA1 8cda1cc7b2c9323e8ef29ca8a3dbd7caa8cb6ce0
SHA512 a86014b6055fbaf3a54b51f317e60de11cd45228152b4a9d194cba333a6d0efaf338627d0d0600862f51fd7b4b5590325effb1b5d9132ebf82c7a9c3aebb12f0
SSDEEP 3072:RbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:Rbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F4847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_yvtolgdyvq.exe

Path C:\Temp\i_yvtolgdyvq.exe
Size 384KB
SHA256 774589ab4e7af11972a53ec73211dc92f7c67c3e1288b27ef320c7d2e9632550
MD5 d38b5e3e92bffc4787c306e80fe1840a
SHA1 504cc9bc777d2c62aa46650a3b490f9fd6806bd3
SHA512 d17ba8e0772af57ebb4b957e4ec0eff3ef6c2e736094f8a3dd3a46773313c29c532a4a292153251180f05bfd3a817ed25f1c2d9460e2547774d90e52e7f1c71b
SSDEEP 3072:/btF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:/btt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D2847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F354CE5D9A517C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhbztrmjec.exe

Path C:\Temp\jhbztrmjec.exe
Size 384KB
SHA256 4a4353f4533ae48bcba7520853286f8defc2d373247115e35d49c1b6ee9db8d0
MD5 6749e7c7f8b77de04bbcc3044ba48332
SHA1 d982b4b410f3d174252aad01ccfa526ff52a912c
SHA512 edd93d4601715a1b2f406d9ee062f73199d499db5106464a8b1104c5e67795f64295af155ba105264983a217b61fab61ddd9a35b573603349fd58c45ef610519
SSDEEP 3072:rbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:rbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T13A847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mjecwuomje.sys

Path C:\Temp\mjecwuomje.sys
Size 293KB
SHA256 c98458b6fe7a5a447c524096dceb8ffd307c320510c22fabad005a840ba9c29b
MD5 e46bbb67817a8ed26c10711be93bc3f6
SHA1 57cb82742e8ba05d2be4f46de9b2ba957ade116f
SHA512 a7b2546c86d81df87b9ede771b11a7d2718d2960785f7140ad14a156c512134190b0e05f215491de257509a89cb15ba3d98be54757bdb42afc699b2ff1ca6373
SSDEEP 3072:ctKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:cIJjiJcbI03GBc3ucY5DCSj
TLSH
T19F545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnkicvsnkf.sys

Path C:\Temp\pnkicvsnkf.sys
Size 293KB
SHA256 a5c40e29a70f237367a4b96058acedab5a1feac4fc4968cd79099a53e2f31f55
MD5 e158543ee60e56b102657f1ce57e6fb7
SHA1 a9b276c6e0220f2649b33ef5467c5d594aac502c
SHA512 e4e08e6518866c437f46a367bd1a62e3e0c59d1e89cd42419402157046af533fb693a545dff829bc73360ec73e244445100b3fe059684586ad458b4482b2f9ea
SSDEEP 3072:atKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:aIJjiJcbI03GBc3ucY5DCSj
TLSH
T14F545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmjhbzurmj.exe

Path C:\Temp\rmjhbzurmj.exe
Size 384KB
SHA256 bcbabf57abe06186d10e216ab32023ff310dac0e78dab1748a81d1b924f65a80
MD5 bf1eebf30e699ee115a506fe872900d7
SHA1 0eff2f53e5e3a3e1d0498f0ef9019b0304ee6d21
SHA512 0f6db6b7698155aecca8953a273dba301e88197ac807c0e4151301fb77f080927dc1a2322cd78f33872e33e58c037b242f00bc026360d9fce84e99fb3229725a
SSDEEP 3072:3btF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:3btt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T17E847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ysqkidavtn.exe

Path C:\Temp\ysqkidavtn.exe
Size 384KB
SHA256 a07ceea3af8fa4f842985696d7225e4584a69f3b6bddf5a8e35309743c5c454f
MD5 d175be8e1f74c038b8a2718242ae0148
SHA1 9d599d2bc39200a6a9a27ff1b436320eb9ca4835
SHA512 9e214c1f8aea7a65950d8d04ea1ff03382afb41bc78872709c5264c31c31b911b8a1fa767cf6ab8a1ded1ef18dfe7bda85fc333b40611a2149078242ca3e7f46
SSDEEP 3072:PbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:Pbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T17E847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC3F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ytqljdbvtnlgdywq.exe

Path C:\Temp\ytqljdbvtnlgdywq.exe
Size 384KB
SHA256 e3151887d52e2fe39a4c3996e47d7bbbff9de4d84a038578f87591c26eb790e5
MD5 2d933db8ce295845a247e8400ba8f6d2
SHA1 6eba986d95fe52ba6d5a4c93eec7894a4187a636
SHA512 682f1dcaf7d4a3fbcfee96c25567dcc415f368826ccafddf9c844af2b3a0d32ba8239e3531659ef3f3fd08a29cbd5eb0413cdce6fa38649efc847e329287d457
SSDEEP 3072:TbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:Tbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T176847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ytqljdbvtnlgdywq.sys

Path C:\Temp\ytqljdbvtnlgdywq.sys
Size 293KB
SHA256 6f9fb6819594423cf9db16f5b2d002173ea4d7b60636c6d0ad208ff743e7f733
MD5 fd8614b1331b2026cb1e817c69c74a3e
SHA1 bcc9b369e6342118d68f040365d5609898358a69
SHA512 553e551a04b57d1e4866d329268fe61a4d1ab49d43e20ec11d33b22863563ee4176a6c416188374d252d41ff3fdabec321483a08d3f44047c8012a1e3b559f38
SSDEEP 3072:OtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:OIJjiJcbI03GBc3ucY5DCSj
TLSH
T159545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yvtolgdyvq.exe

Path C:\Temp\yvtolgdyvq.exe
Size 384KB
SHA256 a10c5afb1432bb21440cac556d70b5c5022d512e61d3bf85896b39b7eda2b58a
MD5 331156c56f53c79da9e95dd027b0f53c
SHA1 e430a995566eb3f3b2a564a3bf7348f572c3bfbb
SHA512 d8d1cd62d9681291412643f2883fd897f698bfc3567eefa51f4d343252c6eaded4a0ab0b68df4b2c5906077f523a6457c1b1f4029a4c489dac6659d8bbf8bbe2
SSDEEP 3072:hbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:hbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T12E847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC3F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zurpmhfcxu.sys

Path C:\Temp\zurpmhfcxu.sys
Size 293KB
SHA256 15cfcb8471dcc09c272ffecdf0ad1df89296871c5f7a818d52718faff06f6354
MD5 18ee25f1b997e0f8e738a92460251e9a
SHA1 93f2ccef2d65368bd33d833dc670c8b86fe67b4d
SHA512 af1ce7644420592baa65409a93b02883cad3f2d1520a20feb71d989402c6257b1be7e7ab52ec7d3f97d445ddd8b8eb0faed46fb5a6d77badba4dc8f095782027
SSDEEP 3072:KtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:KIJjiJcbI03GBc3ucY5DCSj
TLSH
T14A545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4123fa2cc2e73053b7602d1d53a57b01f3a6cd8872729fcd7ed66886082b1b99
MD5 5100dc5469c5151f9ac793573116a7fa
SHA1 a8ffca7210c348bef0d710a66e334809b7f58988
SHA512 ead3d81382dc13f1d89e928af9189e5eec6cf3fabfb91ed18d73f1fe38b5e9f76e77fae594633baf6da19747d70fbb17eb97a8a36df60510a930f6006986acfc
TLSH
T1F4D02B75E7EC8412C0C2207C015911A231A37E00D70802C00A05801C18001C20322F09
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a201096456be1e380b7687844e70aa8e2d987a06740acf66db0d56e000a3b50d
MD5 36c9bdf74494657a1636bbc59af48eb0
SHA1 aea8177ffde7e43fa1b4cc5ce6c7cf68c2431306
SHA512 2cf6da34ccb1c58e4f6d50681952d27ffc828c4ede6f38ca0a5e429a4f520e426913b04469e4272eed54102a541263bbb54c2628f542fbe357a4afac921bb49e
TLSH
T143D02B79E7DC8512C0C2207C015811A231B37E00EB0802C00905400C18001C20323F0D
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 2472f70e8bc4d10544f7d3a0708bd6a4cb18da06cdfd17017af92f73c04db6d1
MD5 74f7a3cebc42b856e9c100419d1907cd
SHA1 964c6aea74ce51b55318c42e9c048257fc11090c
SHA512 788087e58022a7b7f26b38e1530377e3f0883709b3d69164272f5990ce02935f84c806f296f72898881458510c036b793b80a5b2ff538b695a41c76f5d07ee6b
TLSH
T10C514FB145BC7222D3949C3541C72887F974E6B176C33EBA2BE6D5354F6B314B40682C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 d4187887ef0386d9f3df67f3a2c895ce92d24def4bb5d440accaf6c135e8439a
MD5 9323bc9a9d2f009d192c9c6360708b6f
SHA1 80908de0e0e6f3ce70666ee9648a1e8c4270383b
SHA512 c7311384eae23db173c141df0968c802b23dd61f8f6f419ed5147a43db3cc2b6bc20855cd3a8edb027ed1c85f2467bc17084d53cb47659014d05f233837ba22c
TLSH
T13C51AEF7C3E8866D891156F4AB186E1BCE2D0954832C3D5AC8E49F2B93E3471D14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 0f271024cb8ea8502e52a6a0e0547f404a577b924d8f434533a9dc3653891101
MD5 a1115bbf0f01ee5ef5e210e7e1d2f4af
SHA1 d3f1460c5c0b0c75e6589eed71346aeca90465fe
SHA512 797871b052ae69ba16eabe9edb342e3bad45d1357f9774b0435ea6073777740393b8ebd66b57dd922620d25f2ee092231efc5b3d66dbf50161e3e8c238ae223b
SSDEEP 192:sxRBR9CT/fOsi35ZCRLPzoA8p96/g6+WNCy+/YD/9GwIgVoJ:sxRBqT/fOs4XCIw/5S/kK
TLSH
T17442C805AD68A97F4CD7D209FB65BF53D2F95032A0911E48BAFC9A1C04EB6CD5207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 a2a547599c3d2c1ba2d85e5e83914cdb7b97e364d0255dfc6642369de730ae09
MD5 9f91ada46dcf59dec1e90c61765f3dc0
SHA1 e7bb377d35ee88fe3f690bfafc3231923d69642f
SHA512 66546d2af54a36f06c0b6048306a3fd58c6521c1d32b3446801b8f1e1d4923c339c67b8b2ef47534e286644153a5c9bc25ff74341c87ede1b2eeede0b6f522f8
SSDEEP 192:sxRCR9CT/fOslg35ZCRLPzoA8p96/g6+WNCy+/YD/9GwIgDi1oJ:sxRCqT/fOslSXCIw/5S/k+q
TLSH
T19742D805AD64A97F4CDBD219FB55BF53D2F95032A0911E48BAFC9A2C04EB6CD5207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 a6dd3d7b01351dfd4c98062f889b35add9acf121ee5e41eb57d8b02d2928ee27
MD5 08b667ce9308f589c2e7eca35cfd2bab
SHA1 c10ea08b21558867a8225bf45cc1f396c18ccee5
SHA512 4167a214422931308324f85d29d586c9203d5350dd22a26f04ea025ef8d478400206cdee0bb3cbf8e480cd8fa2dbd7da6b7f1c153b40af75261a4deb69e41d79
SSDEEP 192:sxRCR9CT/fOslL35ZCRLPzoA8p96/g6+WNCy+/YDx9GwIgDiPoJ:sxRCqT/fOsljXCIw/5S/4+0
TLSH
T1FC42C755AD64A97F4CDBD209FA55BF53D2F95032A0911E48BAFCCA2C04EB6CD5207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 59286677f69184d1b36458805168978df5fdd85358a555dcb92f794697b1b94b
MD5 9b06cc40acf0ca85a3feefed4e5f62ca
SHA1 334491edb5bfbc8a3456bed44b72e95f24ebc676
SHA512 5997c54863bcd6d9b8044b9dc5c00514cc202e404db8aeb4986c5b16f570a6eae24967bcdc06168b828b83c3972452daa33b89aaf0f2e79c8dc2bd00f3f2b80b
SSDEEP 768:SzYbMR7pLuLbxUWgasfA68F1+UoAYDCx9Tuqh0VfUC9xbog/OVkbw8WSAroG686E:SzYbMHEbxUWgasfA6u1jaTbwtSLe6E
TLSH
T143D2D97B640CCB7F4F804ADDEC1A7A9A6D6802CB96D8C98447FE941C02C67EF511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 fc7d28fa8fdd15695937e58e5a4d69d2f9362020a3a2836278e6bcc96e532db6
MD5 88cc2e6ec1f2773c894fbf3575308cb4
SHA1 7870bf6aadfc57619d2db76ca3ad4471c425f87f
SHA512 54ce8ce2514621606c6dd4bf3e641f5d31de31641705468c233b1f23278746e418dcd3f24226902388a7c39bea5f5871e3217c7b3b179bfa35367d365319d2f3
SSDEEP 48:KoLIdKUU4jyZSI/KzS4Ah4jnhTzBaHacIBPBKYoghBEpRLiPTCyKoH0Y26P:KoLCKUU26SEKzSEScKTqaE
TLSH
T1DE915E5171BB069038BE34498564C72E578135A7351CEA7B3BBC04764F2BE062EFE9CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a86a6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a86a6.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 83da8afd85ee6b0448e591eea810fa0f27def5ae2c94af5da8b6768ce104c18a
MD5 9db02d5fb100a60bdcb5709a4095f3e3
SHA1 ad2d0a0860245c56e3d51a3609f3a9a91bead0f7
SHA512 5e6e831c7c736e835534214d05a38f91b06b1b453c59a836c1b631dcdb0ba3df95125942225b2a7338c589b7980b16e89d61ea3c673bd2d383803f183bcbfa3d
SSDEEP 768:z/UxvxjgC+k3IZpybNbgrOeRFZD1fTos7RzY/+Pu:GZj3+k3IzoY1fT/RkKu
TLSH
T15C03CF3AF8D46D338CF6E244B20A764BBFF455B385C91A9809ED6F0E158B79D130781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 464a3f697c4c833310a0a60ef5d0b42c75ea56e72f0e8873bbf7423190ce3354
MD5 ccd894141e165a6d6f516de278719d8d
SHA1 9a1b60e7ea4ed8c4b40921809607d9a94e0fa1a2
SHA512 036f79cef05df4b423e339c668adfbc0d01d607ce4650fb697f25808ce0eea8ca424c3e8ca088017ce6d0097b76639087be705be46e48c0d95dcf19310b8753e
SSDEEP 768:3FQF3Rwg5JlSg+lOeRFZD1fTos7Rjl2sbN:KF3JfY1fT/RJ2sbN
TLSH
T1181329F5A8D38977D8AD9343A33D6D42AEBCC163B5895884B7885D0DCC876BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 06963ab8ae02d6bbd60f0b727974075479a23dc16b6bf6c227b16e44f9619b20
MD5 10dc4fb29b18e176870339b283332bed
SHA1 760ba06cc08984dd048b323e505a41566e771b4c
SHA512 5737151177c6d09c5ca0319ea477eeaddb65a23c60d9bfd781f0eb24ced422358b4588cba2ab40f10ec0d13a05f4aff584e35cd5a9c7acc6b7286f7a5ab9352c
SSDEEP 768:J/UxvxjgC+83W29ybNbg+gOeRFZD1fTos7RjlrK:8Zj3+83WgIY1fT/RJrK
TLSH
T1B603BF39B8E46D334CFAE144B24A7BC7BFF415B388C91D9849D99E0E058779D134B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 599b6c787a45dc928fb2d0003a571ba67999442a0cbdec627e32905fb0e0b8bb
MD5 8fe2e43fcd0fcfab61745a4ab7128686
SHA1 1674017207c69e31bf81896a38fb615f6acb533e
SHA512 a891d30e10cdd927f3959206b6c598d12ca9a2f620a5f552fb21ef2fa0e6f7f9fd89f4110f2ede7b10fb9108100ee784a949fd5d95d83272e82367c920474f26
SSDEEP 384:nsZcI138Ny56Q5VrNp9xfIbNbpCCHgOc1RMOLLZyW6efTov+He0DUYRjligOIwZy:6137z9ybNbg+gOeRFZD1fTos7Rjl2sbN
TLSH
T11DF2BF35B8E49D734CEAE245F24A7A837FB45563C9C9098885DC9F0E0497BDE134BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 52143ef25c331d34dd22c937ef461897d087eb3a66bb93dc7d1443d765c7ac5b
MD5 c6beeccb261ec120e5ae66c1efc352bd
SHA1 4da8e56e92b00e3ae4b5e3a0dc11b0a034f82a22
SHA512 82bd790a290afcb7bc013795bed871c7ba0405f447e449023e68dc9eac7471e03e2d22937c90bfca7cf2d5ef43db34cd6dfe34ff27fd39fa63e109f2ba486870
SSDEEP 384:ntZcI138NyU6Q5VrNp9xfIbNbpCCHgOc1RMOLLZyW6efTov+He0DUYRjligOIwZy:113Wz9ybNbg+gOeRFZD1fTos7Rjl2sbN
TLSH
T18BF2BF35B8E49D734CEAE245F24A7A837FB45573C9C9098894DC9F0E0497BDA134BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

c2455735-e8dc-49d6-a6e5-363433cbae17.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c2455735-e8dc-49d6-a6e5-363433cbae17.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2868_1581234593\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 b525fb5c64ff472057ff2a0b58a8f09cccde494ed75d43169b2ad376807b9644
MD5 78f59adb6bbde41599d04685ffd2d858
SHA1 6ffa444111e168074a3f6b4f27bb4a8e767f8efe
SHA512 65e38291132e2f4dd9e78626c3c57826e2b34cda6012dd528c752aebd357c799ce9e1a1c3c0273306fcb2e18be9eeed79b5716fb074155e0ae6368d4ac85335f
TLSH
T1437100835AA9CAB2C29E5BF102839244F6FB2238076330200B955586AB30A3A54B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/504-482-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1056-331-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1116-234-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1212-312-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2120-231-0x0000012FC2360000-0x0000012FC271B000-memory.dmp

Download

memory/2120-222-0x0000012FC2360000-0x0000012FC271B000-memory.dmp

Download

memory/2636-461-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2904-185-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3328-380-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3404-271-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3576-360-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3660-259-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4424-284-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4444-393-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4484-308-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4492-436-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4668-60-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4692-327-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4816-440-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5572-427-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5704-465-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6072-404-0x0000000000010000-0x00000000000AB000-memory.dmp

Download