systex | c4a5343fc7798e99594ce38c1692ed95b7162e84e30cbd4962e2fdffe5489a48

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 23:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_8b325dcdfcb9401a522667145c544faf_amadey_darkgate_elex_smoke-loader_stop.exe
Size 384KB
Sample260814-3ezpystfke
SHA256 c4a5343fc7798e99594ce38c1692ed95b7162e84e30cbd4962e2fdffe5489a48
MD5 8b325dcdfcb9401a522667145c544faf
SHA1 da0712acd900e4d4de40cf373c6b68419993cfb0
SHA512 947d67d2b26c8f1249b553b2361570d9b28068020452c45d936aa79c9b5c091a9b2a6eed8893e70a809bf9b3fb8beec0b4202812ee42cd67e3a0db0dbd0d038d
SSDEEP 3072:U9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:uctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T19F847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
6004	olgebwtrljdbywto.exe
4620	olgebwtrljdbywto.sys
900	CreateProcess.exe
5916	wtrlgbytqj.exe
1660	CreateProcess.exe
4748	CreateProcess.exe
3856	i_wtrlgbytqj.exe
1000	bvtnljdbvt.sys
3140	CreateProcess.exe
2344	vqoigdywtn.exe
3152	CreateProcess.exe
1248	CreateProcess.exe
4636	i_vqoigdywtn.exe
4832	nljdavtnlx.sys
4888	CreateProcess.exe
3420	xvqnlfdyvq.exe
2444	CreateProcess.exe
3752	CreateProcess.exe
5964	i_xvqnlfdyvq.exe
2116	xvqnlfcays.sys
2256	CreateProcess.exe
2480	ysqkicankf.exe
1052	CreateProcess.exe
2936	CreateProcess.exe
5324	i_ysqkicankf.exe
3764	snkfcxvpnh.sys
4768	CreateProcess.exe
4924	nkfdxvpnif.exe
5600	CreateProcess.exe
4372	CreateProcess.exe
2312	i_nkfdxvpnif.exe
5444	fcwusmkhfz.sys
4188	CreateProcess.exe
2292	ecwuspkhcw.exe
896	CreateProcess.exe
3020	CreateProcess.exe
5964	i_ecwuspkhcw.exe
6020	rpjhczusmh.sys
4804	CreateProcess.exe
3848	hezurmjecw.exe
1804	CreateProcess.exe
2340	CreateProcess.exe
1644	i_hezurmjecw.exe
2788	pjhbzwromg.sys
4324	CreateProcess.exe
3980	mjebwuomhe.exe
1584	CreateProcess.exe
5744	CreateProcess.exe
3264	i_mjebwuomhe.exe
4364	omjdbwtomg.sys
304	CreateProcess.exe
5400	ebwuomgeyt.exe
3008	CreateProcess.exe
4992	CreateProcess.exe
2508	i_ebwuomgeyt.exe
2772	bytqljdbvt.sys
5140	CreateProcess.exe
2656	vtoigeywqo.exe
1556	CreateProcess.exe
4808	CreateProcess.exe
4244	i_vtoigeywqo.exe
5256	daywqoigbv.sys
4132	CreateProcess.exe
5852	qolfdyvqoi.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5172_524699615\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5172_1060559238\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5172_1060559238\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5172_850942332\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5172_850942332\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5172_1451057595\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5172_524699615\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5172_850942332\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5172_850942332\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wupmhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vqoigdywtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkfdxvpnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjebwuomhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjebwuomhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qolfdyvqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wupmhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oljebztrlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtrlgbytqj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnlfcxvsnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kecxusnkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebwuomgeyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtoigeywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igaytqolga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vqoigdywtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwuspkhcw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnlfcxvsnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_olgdyvtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_8b325dcdfcb9401a522667145c544faf_amadey_darkgate_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hezurmjecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqkidavpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qlfdxvqnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtrlgbytqj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkfdxvpnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hezurmjecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpjhezxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpjhezxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	olgdyvtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igaytqolga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	olgebwtrljdbywto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvqnlfdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqkicankf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qolfdyvqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqkidavpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kecxusnkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oljebztrlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvqnlfdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqkicankf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwuspkhcw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebwuomgeyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtoigeywqo.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1788	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
936	ipconfig.exe
1988	ipconfig.exe
3544	ipconfig.exe
5652	ipconfig.exe
788	ipconfig.exe
2728	ipconfig.exe
2400	ipconfig.exe
2544	ipconfig.exe
5960	ipconfig.exe
4192	ipconfig.exe
1804	ipconfig.exe
3952	ipconfig.exe
4964	ipconfig.exe
5152	ipconfig.exe
3772	ipconfig.exe
2976	ipconfig.exe
3804	ipconfig.exe
4108	ipconfig.exe
4960	ipconfig.exe
4364	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134312235948926843"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3611646547-550105268-947503007-1000\{E96F0DE5-7AAC-4057-B479-09ECED7B89D1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3828	2026-08-14_8b325dcdfcb9401a522667145c544faf_amadey_darkgate_elex_smoke-loader_stop.exe
3828	2026-08-14_8b325dcdfcb9401a522667145c544faf_amadey_darkgate_elex_smoke-loader_stop.exe
3828	2026-08-14_8b325dcdfcb9401a522667145c544faf_amadey_darkgate_elex_smoke-loader_stop.exe
3828	2026-08-14_8b325dcdfcb9401a522667145c544faf_amadey_darkgate_elex_smoke-loader_stop.exe
3828	2026-08-14_8b325dcdfcb9401a522667145c544faf_amadey_darkgate_elex_smoke-loader_stop.exe
3828	2026-08-14_8b325dcdfcb9401a522667145c544faf_amadey_darkgate_elex_smoke-loader_stop.exe
3828	2026-08-14_8b325dcdfcb9401a522667145c544faf_amadey_darkgate_elex_smoke-loader_stop.exe
3828	2026-08-14_8b325dcdfcb9401a522667145c544faf_amadey_darkgate_elex_smoke-loader_stop.exe
3828	2026-08-14_8b325dcdfcb9401a522667145c544faf_amadey_darkgate_elex_smoke-loader_stop.exe
3828	2026-08-14_8b325dcdfcb9401a522667145c544faf_amadey_darkgate_elex_smoke-loader_stop.exe
3828	2026-08-14_8b325dcdfcb9401a522667145c544faf_amadey_darkgate_elex_smoke-loader_stop.exe
3828	2026-08-14_8b325dcdfcb9401a522667145c544faf_amadey_darkgate_elex_smoke-loader_stop.exe
3828	2026-08-14_8b325dcdfcb9401a522667145c544faf_amadey_darkgate_elex_smoke-loader_stop.exe
3828	2026-08-14_8b325dcdfcb9401a522667145c544faf_amadey_darkgate_elex_smoke-loader_stop.exe
3828	2026-08-14_8b325dcdfcb9401a522667145c544faf_amadey_darkgate_elex_smoke-loader_stop.exe
3828	2026-08-14_8b325dcdfcb9401a522667145c544faf_amadey_darkgate_elex_smoke-loader_stop.exe
3828	2026-08-14_8b325dcdfcb9401a522667145c544faf_amadey_darkgate_elex_smoke-loader_stop.exe
3828	2026-08-14_8b325dcdfcb9401a522667145c544faf_amadey_darkgate_elex_smoke-loader_stop.exe
3828	2026-08-14_8b325dcdfcb9401a522667145c544faf_amadey_darkgate_elex_smoke-loader_stop.exe
3828	2026-08-14_8b325dcdfcb9401a522667145c544faf_amadey_darkgate_elex_smoke-loader_stop.exe
3828	2026-08-14_8b325dcdfcb9401a522667145c544faf_amadey_darkgate_elex_smoke-loader_stop.exe
3828	2026-08-14_8b325dcdfcb9401a522667145c544faf_amadey_darkgate_elex_smoke-loader_stop.exe
3828	2026-08-14_8b325dcdfcb9401a522667145c544faf_amadey_darkgate_elex_smoke-loader_stop.exe
3828	2026-08-14_8b325dcdfcb9401a522667145c544faf_amadey_darkgate_elex_smoke-loader_stop.exe
3828	2026-08-14_8b325dcdfcb9401a522667145c544faf_amadey_darkgate_elex_smoke-loader_stop.exe
3828	2026-08-14_8b325dcdfcb9401a522667145c544faf_amadey_darkgate_elex_smoke-loader_stop.exe
3828	2026-08-14_8b325dcdfcb9401a522667145c544faf_amadey_darkgate_elex_smoke-loader_stop.exe
3828	2026-08-14_8b325dcdfcb9401a522667145c544faf_amadey_darkgate_elex_smoke-loader_stop.exe
3828	2026-08-14_8b325dcdfcb9401a522667145c544faf_amadey_darkgate_elex_smoke-loader_stop.exe
3828	2026-08-14_8b325dcdfcb9401a522667145c544faf_amadey_darkgate_elex_smoke-loader_stop.exe
3828	2026-08-14_8b325dcdfcb9401a522667145c544faf_amadey_darkgate_elex_smoke-loader_stop.exe
3828	2026-08-14_8b325dcdfcb9401a522667145c544faf_amadey_darkgate_elex_smoke-loader_stop.exe
3828	2026-08-14_8b325dcdfcb9401a522667145c544faf_amadey_darkgate_elex_smoke-loader_stop.exe
3828	2026-08-14_8b325dcdfcb9401a522667145c544faf_amadey_darkgate_elex_smoke-loader_stop.exe
3828	2026-08-14_8b325dcdfcb9401a522667145c544faf_amadey_darkgate_elex_smoke-loader_stop.exe
3828	2026-08-14_8b325dcdfcb9401a522667145c544faf_amadey_darkgate_elex_smoke-loader_stop.exe
3828	2026-08-14_8b325dcdfcb9401a522667145c544faf_amadey_darkgate_elex_smoke-loader_stop.exe
3828	2026-08-14_8b325dcdfcb9401a522667145c544faf_amadey_darkgate_elex_smoke-loader_stop.exe
3828	2026-08-14_8b325dcdfcb9401a522667145c544faf_amadey_darkgate_elex_smoke-loader_stop.exe
3828	2026-08-14_8b325dcdfcb9401a522667145c544faf_amadey_darkgate_elex_smoke-loader_stop.exe
3828	2026-08-14_8b325dcdfcb9401a522667145c544faf_amadey_darkgate_elex_smoke-loader_stop.exe
3828	2026-08-14_8b325dcdfcb9401a522667145c544faf_amadey_darkgate_elex_smoke-loader_stop.exe
3828	2026-08-14_8b325dcdfcb9401a522667145c544faf_amadey_darkgate_elex_smoke-loader_stop.exe
3828	2026-08-14_8b325dcdfcb9401a522667145c544faf_amadey_darkgate_elex_smoke-loader_stop.exe
3828	2026-08-14_8b325dcdfcb9401a522667145c544faf_amadey_darkgate_elex_smoke-loader_stop.exe
3828	2026-08-14_8b325dcdfcb9401a522667145c544faf_amadey_darkgate_elex_smoke-loader_stop.exe
3828	2026-08-14_8b325dcdfcb9401a522667145c544faf_amadey_darkgate_elex_smoke-loader_stop.exe
3828	2026-08-14_8b325dcdfcb9401a522667145c544faf_amadey_darkgate_elex_smoke-loader_stop.exe
3828	2026-08-14_8b325dcdfcb9401a522667145c544faf_amadey_darkgate_elex_smoke-loader_stop.exe
3828	2026-08-14_8b325dcdfcb9401a522667145c544faf_amadey_darkgate_elex_smoke-loader_stop.exe
3828	2026-08-14_8b325dcdfcb9401a522667145c544faf_amadey_darkgate_elex_smoke-loader_stop.exe
3828	2026-08-14_8b325dcdfcb9401a522667145c544faf_amadey_darkgate_elex_smoke-loader_stop.exe
3828	2026-08-14_8b325dcdfcb9401a522667145c544faf_amadey_darkgate_elex_smoke-loader_stop.exe
3828	2026-08-14_8b325dcdfcb9401a522667145c544faf_amadey_darkgate_elex_smoke-loader_stop.exe
3828	2026-08-14_8b325dcdfcb9401a522667145c544faf_amadey_darkgate_elex_smoke-loader_stop.exe
3828	2026-08-14_8b325dcdfcb9401a522667145c544faf_amadey_darkgate_elex_smoke-loader_stop.exe
6004	olgebwtrljdbywto.exe
6004	olgebwtrljdbywto.exe
6004	olgebwtrljdbywto.exe
6004	olgebwtrljdbywto.exe
6004	olgebwtrljdbywto.exe
6004	olgebwtrljdbywto.exe
6004	olgebwtrljdbywto.exe
6004	olgebwtrljdbywto.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	3856	i_wtrlgbytqj.exe
Token: SeDebugPrivilege	4636	i_vqoigdywtn.exe
Token: SeDebugPrivilege	5964	i_xvqnlfdyvq.exe
Token: SeDebugPrivilege	5324	i_ysqkicankf.exe
Token: SeDebugPrivilege	2312	i_nkfdxvpnif.exe
Token: SeDebugPrivilege	5964	i_ecwuspkhcw.exe
Token: SeDebugPrivilege	1644	i_hezurmjecw.exe
Token: SeDebugPrivilege	3264	i_mjebwuomhe.exe
Token: SeDebugPrivilege	2508	i_ebwuomgeyt.exe
Token: SeDebugPrivilege	4244	i_vtoigeywqo.exe
Token: SeDebugPrivilege	2624	i_qolfdyvqoi.exe
Token: SeDebugPrivilege	2764	i_ysqkidavpn.exe
Token: SeDebugPrivilege	4320	i_pnlfcxvsnk.exe
Token: SeDebugPrivilege	5068	i_kecxusnkec.exe
Token: SeDebugPrivilege	3012	i_wupmhfzxrp.exe
Token: SeDebugPrivilege	2848	i_xrpjhezxrp.exe
Token: SeDebugPrivilege	4552	i_oljebztrlg.exe
Token: SeDebugPrivilege	4880	i_olgdyvtolg.exe
Token: SeDebugPrivilege	3540	i_igaytqolga.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5172	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3828 wrote to memory of 6004	3828	2026-08-14_8b325dcdfcb9401a522667145c544faf_amadey_darkgate_elex_smoke-loader_stop.exe	89
PID 3828 wrote to memory of 1748	3828	2026-08-14_8b325dcdfcb9401a522667145c544faf_amadey_darkgate_elex_smoke-loader_stop.exe	90
PID 1748 wrote to memory of 5172	1748	iexplore.exe	91
PID 5172 wrote to memory of 5028	5172	msedge.exe	92
PID 5172 wrote to memory of 1108	5172	msedge.exe	93
PID 5172 wrote to memory of 1788	5172	msedge.exe	95
PID 5172 wrote to memory of 1108	5172	msedge.exe	93
PID 5172 wrote to memory of 1108	5172	msedge.exe	93
PID 5172 wrote to memory of 1252	5172	msedge.exe	96
PID 5172 wrote to memory of 1252	5172	msedge.exe	96
PID 5172 wrote to memory of 2712	5172	msedge.exe	97
PID 5172 wrote to memory of 2712	5172	msedge.exe	97
PID 5172 wrote to memory of 2712	5172	msedge.exe	97
PID 5172 wrote to memory of 2012	5172	msedge.exe	98
PID 5172 wrote to memory of 2012	5172	msedge.exe	98
PID 5172 wrote to memory of 2012	5172	msedge.exe	98
PID 5172 wrote to memory of 5124	5172	msedge.exe	99
PID 5172 wrote to memory of 5124	5172	msedge.exe	99
PID 5172 wrote to memory of 5124	5172	msedge.exe	99
PID 5172 wrote to memory of 940	5172	msedge.exe	100
PID 5172 wrote to memory of 940	5172	msedge.exe	100
PID 5172 wrote to memory of 940	5172	msedge.exe	100
PID 5172 wrote to memory of 1556	5172	msedge.exe	101
PID 5172 wrote to memory of 1556	5172	msedge.exe	101
PID 5172 wrote to memory of 4508	5172	msedge.exe	105
PID 5172 wrote to memory of 464	5172	msedge.exe	106
PID 5172 wrote to memory of 4508	5172	msedge.exe	105
PID 5172 wrote to memory of 464	5172	msedge.exe	106
PID 5172 wrote to memory of 4768	5172	msedge.exe	108
PID 6004 wrote to memory of 900	6004	olgebwtrljdbywto.exe	109
PID 5172 wrote to memory of 4832	5172	msedge.exe	111
PID 5172 wrote to memory of 4832	5172	msedge.exe	111
PID 5916 wrote to memory of 1660	5916	wtrlgbytqj.exe	113
PID 5172 wrote to memory of 4328	5172	msedge.exe	116
PID 5172 wrote to memory of 4328	5172	msedge.exe	116
PID 6004 wrote to memory of 4748	6004	olgebwtrljdbywto.exe	119
PID 6004 wrote to memory of 3140	6004	olgebwtrljdbywto.exe	123
PID 2344 wrote to memory of 3152	2344	vqoigdywtn.exe	125
PID 6004 wrote to memory of 1248	6004	olgebwtrljdbywto.exe	128
PID 6004 wrote to memory of 4888	6004	olgebwtrljdbywto.exe	132
PID 3420 wrote to memory of 2444	3420	xvqnlfdyvq.exe	134
PID 6004 wrote to memory of 3752	6004	olgebwtrljdbywto.exe	137
PID 6004 wrote to memory of 2256	6004	olgebwtrljdbywto.exe	142
PID 2480 wrote to memory of 1052	2480	ysqkicankf.exe	144
PID 6004 wrote to memory of 2936	6004	olgebwtrljdbywto.exe	147
PID 5172 wrote to memory of 5544	5172	msedge.exe	149
PID 5172 wrote to memory of 1984	5172	msedge.exe	150
PID 5172 wrote to memory of 5440	5172	msedge.exe	151
PID 6004 wrote to memory of 4768	6004	olgebwtrljdbywto.exe	154
PID 4924 wrote to memory of 5600	4924	nkfdxvpnif.exe	156
PID 6004 wrote to memory of 4372	6004	olgebwtrljdbywto.exe	159
PID 6004 wrote to memory of 4188	6004	olgebwtrljdbywto.exe	163
PID 2292 wrote to memory of 896	2292	ecwuspkhcw.exe	165
PID 6004 wrote to memory of 3020	6004	olgebwtrljdbywto.exe	168
PID 6004 wrote to memory of 4804	6004	olgebwtrljdbywto.exe	172
PID 3848 wrote to memory of 1804	3848	hezurmjecw.exe	174
PID 6004 wrote to memory of 2340	6004	olgebwtrljdbywto.exe	177
PID 6004 wrote to memory of 4324	6004	olgebwtrljdbywto.exe	181
PID 3980 wrote to memory of 1584	3980	mjebwuomhe.exe	183
PID 6004 wrote to memory of 5744	6004	olgebwtrljdbywto.exe	186
PID 5172 wrote to memory of 3812	5172	msedge.exe	188
PID 5172 wrote to memory of 3812	5172	msedge.exe	188
PID 6004 wrote to memory of 304	6004	olgebwtrljdbywto.exe	194
PID 5400 wrote to memory of 3008	5400	ebwuomgeyt.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-08-14_8b325dcdfcb9401a522667145c544faf_amadey_darkgate_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_8b325dcdfcb9401a522667145c544faf_amadey_darkgate_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3828
- C:\Temp\olgebwtrljdbywto.exe
  C:\Temp\olgebwtrljdbywto.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:6004
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wtrlgbytqj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:900
  - - C:\Temp\wtrlgbytqj.exe
      C:\Temp\wtrlgbytqj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5916
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1660
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4960
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wtrlgbytqj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4748
  - - C:\Temp\i_wtrlgbytqj.exe
      C:\Temp\i_wtrlgbytqj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3856
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vqoigdywtn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3140
  - - C:\Temp\vqoigdywtn.exe
      C:\Temp\vqoigdywtn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2344
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3152
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2976
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vqoigdywtn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1248
  - - C:\Temp\i_vqoigdywtn.exe
      C:\Temp\i_vqoigdywtn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4636
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvqnlfdyvq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4888
  - - C:\Temp\xvqnlfdyvq.exe
      C:\Temp\xvqnlfdyvq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3420
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2444
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4364
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xvqnlfdyvq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3752
  - - C:\Temp\i_xvqnlfdyvq.exe
      C:\Temp\i_xvqnlfdyvq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5964
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ysqkicankf.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2256
  - - C:\Temp\ysqkicankf.exe
      C:\Temp\ysqkicankf.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2480
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1052
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1804
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ysqkicankf.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2936
  - - C:\Temp\i_ysqkicankf.exe
      C:\Temp\i_ysqkicankf.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5324
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nkfdxvpnif.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4768
  - - C:\Temp\nkfdxvpnif.exe
      C:\Temp\nkfdxvpnif.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4924
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5600
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:936
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nkfdxvpnif.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4372
  - - C:\Temp\i_nkfdxvpnif.exe
      C:\Temp\i_nkfdxvpnif.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2312
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ecwuspkhcw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4188
  - - C:\Temp\ecwuspkhcw.exe
      C:\Temp\ecwuspkhcw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2292
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:896
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3952
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ecwuspkhcw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3020
  - - C:\Temp\i_ecwuspkhcw.exe
      C:\Temp\i_ecwuspkhcw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5964
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hezurmjecw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4804
  - - C:\Temp\hezurmjecw.exe
      C:\Temp\hezurmjecw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3848
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1804
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2400
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hezurmjecw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2340
  - - C:\Temp\i_hezurmjecw.exe
      C:\Temp\i_hezurmjecw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1644
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mjebwuomhe.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4324
  - - C:\Temp\mjebwuomhe.exe
      C:\Temp\mjebwuomhe.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3980
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1584
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3804
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mjebwuomhe.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5744
  - - C:\Temp\i_mjebwuomhe.exe
      C:\Temp\i_mjebwuomhe.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3264
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ebwuomgeyt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:304
  - - C:\Temp\ebwuomgeyt.exe
      C:\Temp\ebwuomgeyt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5400
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3008
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1988
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ebwuomgeyt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4992
  - - C:\Temp\i_ebwuomgeyt.exe
      C:\Temp\i_ebwuomgeyt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2508
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtoigeywqo.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5140
  - - C:\Temp\vtoigeywqo.exe
      C:\Temp\vtoigeywqo.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2656
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1556
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3544
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtoigeywqo.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4808
  - - C:\Temp\i_vtoigeywqo.exe
      C:\Temp\i_vtoigeywqo.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4244
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qolfdyvqoi.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4132
  - - C:\Temp\qolfdyvqoi.exe
      C:\Temp\qolfdyvqoi.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5852
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3156
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4964
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qolfdyvqoi.exe ups_ins
    3⤵
    PID:1124
  - - C:\Temp\i_qolfdyvqoi.exe
      C:\Temp\i_qolfdyvqoi.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2624
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ysqkidavpn.exe ups_run
    3⤵
    PID:5628
  - - C:\Temp\ysqkidavpn.exe
      C:\Temp\ysqkidavpn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4680
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3748
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5652
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ysqkidavpn.exe ups_ins
    3⤵
    PID:4608
  - - C:\Temp\i_ysqkidavpn.exe
      C:\Temp\i_ysqkidavpn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2764
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pnlfcxvsnk.exe ups_run
    3⤵
    PID:5840
  - - C:\Temp\pnlfcxvsnk.exe
      C:\Temp\pnlfcxvsnk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5272
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4244
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:788
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pnlfcxvsnk.exe ups_ins
    3⤵
    PID:2620
  - - C:\Temp\i_pnlfcxvsnk.exe
      C:\Temp\i_pnlfcxvsnk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4320
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kecxusnkec.exe ups_run
    3⤵
    PID:2840
  - - C:\Temp\kecxusnkec.exe
      C:\Temp\kecxusnkec.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5748
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4832
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2544
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kecxusnkec.exe ups_ins
    3⤵
    PID:3432
  - - C:\Temp\i_kecxusnkec.exe
      C:\Temp\i_kecxusnkec.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5068
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wupmhfzxrp.exe ups_run
    3⤵
    PID:5920
  - - C:\Temp\wupmhfzxrp.exe
      C:\Temp\wupmhfzxrp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3508
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5236
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2728
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wupmhfzxrp.exe ups_ins
    3⤵
    PID:4472
  - - C:\Temp\i_wupmhfzxrp.exe
      C:\Temp\i_wupmhfzxrp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3012
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xrpjhezxrp.exe ups_run
    3⤵
    PID:3460
  - - C:\Temp\xrpjhezxrp.exe
      C:\Temp\xrpjhezxrp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:620
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2672
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5960
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xrpjhezxrp.exe ups_ins
    3⤵
    PID:1644
  - - C:\Temp\i_xrpjhezxrp.exe
      C:\Temp\i_xrpjhezxrp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2848
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\oljebztrlg.exe ups_run
    3⤵
    PID:5624
  - - C:\Temp\oljebztrlg.exe
      C:\Temp\oljebztrlg.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4320
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4628
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4192
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_oljebztrlg.exe ups_ins
    3⤵
    PID:3044
  - - C:\Temp\i_oljebztrlg.exe
      C:\Temp\i_oljebztrlg.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4552
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\olgdyvtolg.exe ups_run
    3⤵
    PID:4912
  - - C:\Temp\olgdyvtolg.exe
      C:\Temp\olgdyvtolg.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:824
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4312
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5152
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_olgdyvtolg.exe ups_ins
    3⤵
    PID:3672
  - - C:\Temp\i_olgdyvtolg.exe
      C:\Temp\i_olgdyvtolg.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4880
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\igaytqolga.exe ups_run
    3⤵
    PID:5960
  - - C:\Temp\igaytqolga.exe
      C:\Temp\igaytqolga.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5072
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4348
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3772
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_igaytqolga.exe ups_ins
    3⤵
    PID:3212
  - - C:\Temp\i_igaytqolga.exe
      C:\Temp\i_igaytqolga.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3540
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qlfdxvqnlf.exe ups_run
    3⤵
    PID:3764
  - - C:\Temp\qlfdxvqnlf.exe
      C:\Temp\qlfdxvqnlf.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5972
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2988
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4108
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffd082bc188,0x7ffd082bc194,0x7ffd082bc1a0
      4⤵
      PID:5028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,7670582675042047190,10903020611239434587,262144 --field-trial-handle=2368,i,9468942485138003484,9966434836487151954,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:2
      4⤵
      PID:1108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,18154650433749802573,13877890926794926563,524288 --field-trial-handle=2368,i,9468942485138003484,9966434836487151954,262144 --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:11
      4⤵
      System Time Discovery
      PID:1788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2536,i,5018508328239272583,344106827710444519,524288 --field-trial-handle=2368,i,9468942485138003484,9966434836487151954,262144 --variations-seed-version --mojo-platform-channel-handle=3372 /prefetch:13
      4⤵
      PID:1252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3556,i,5044643454911889217,533525708508805622,2097152 --field-trial-handle=2368,i,9468942485138003484,9966434836487151954,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
      4⤵
      PID:2712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3560,i,15183833994219485018,16186299148077845979,2097152 --field-trial-handle=2368,i,9468942485138003484,9966434836487151954,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
      4⤵
      PID:2012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4200,i,7217992063073772022,6797704028179864280,2097152 --field-trial-handle=2368,i,9468942485138003484,9966434836487151954,262144 --variations-seed-version --mojo-platform-channel-handle=4708 /prefetch:9
      4⤵
      PID:5124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4188,i,13001890487047842870,14893590607080752299,2097152 --field-trial-handle=2368,i,9468942485138003484,9966434836487151954,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:1
      4⤵
      PID:940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,10423361477463730363,11663640533392541798,524288 --field-trial-handle=2368,i,9468942485138003484,9966434836487151954,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:14
      4⤵
      PID:1556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3644,i,15195245293319978991,382536231170421128,524288 --field-trial-handle=2368,i,9468942485138003484,9966434836487151954,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:14
      4⤵
      PID:4508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3632,i,724523968838504421,10297426729887337289,524288 --field-trial-handle=2368,i,9468942485138003484,9966434836487151954,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:14
      4⤵
      PID:464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,9573339006262009034,3213354444859226165,524288 --field-trial-handle=2368,i,9468942485138003484,9966434836487151954,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:14
      4⤵
      PID:1520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,9573339006262009034,3213354444859226165,524288 --field-trial-handle=2368,i,9468942485138003484,9966434836487151954,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:14
      4⤵
      PID:4768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,5178907382037000616,8153596130343581442,524288 --field-trial-handle=2368,i,9468942485138003484,9966434836487151954,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:14
      4⤵
      PID:4832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6552,i,765816208907691308,13723079696387304189,524288 --field-trial-handle=2368,i,9468942485138003484,9966434836487151954,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:14
      4⤵
      PID:4328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,15982412663648873086,752297369223637919,524288 --field-trial-handle=2368,i,9468942485138003484,9966434836487151954,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:14
      4⤵
      PID:5544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,6951555208544315005,18419833808041923569,524288 --field-trial-handle=2368,i,9468942485138003484,9966434836487151954,262144 --variations-seed-version --mojo-platform-channel-handle=744 /prefetch:14
      4⤵
      PID:1984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,16653174719866415189,3904553031585474360,524288 --field-trial-handle=2368,i,9468942485138003484,9966434836487151954,262144 --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:14
      4⤵
      PID:5440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5616,i,11819980339643577585,5525367895829885613,524288 --field-trial-handle=2368,i,9468942485138003484,9966434836487151954,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:14
      4⤵
      PID:3812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,16299298214667285166,1930732993009127727,524288 --field-trial-handle=2368,i,9468942485138003484,9966434836487151954,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
      4⤵
      PID:2580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=920,i,13792137597523866665,18075279320217982974,524288 --field-trial-handle=2368,i,9468942485138003484,9966434836487151954,262144 --variations-seed-version --mojo-platform-channel-handle=4700 /prefetch:14
      4⤵
      PID:2848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3540,i,8200890392255667606,10813865354983871587,524288 --field-trial-handle=2368,i,9468942485138003484,9966434836487151954,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:14
      4⤵
      PID:2508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4852,i,5463722731793936956,760899409506945184,262144 --field-trial-handle=2368,i,9468942485138003484,9966434836487151954,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:10
      4⤵
      PID:3108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,1544241217083218579,13743213979405095040,524288 --field-trial-handle=2368,i,9468942485138003484,9966434836487151954,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:14
      4⤵
      PID:4624

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5652

C:\Temp\olgebwtrljdbywto.sys
C:\Temp\olgebwtrljdbywto.sys
1⤵
- Executes dropped EXE
PID:4620

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4740

C:\Temp\bvtnljdbvt.sys
C:\Temp\bvtnljdbvt.sys
1⤵
- Executes dropped EXE
PID:1000

C:\Temp\nljdavtnlx.sys
C:\Temp\nljdavtnlx.sys
1⤵
- Executes dropped EXE
PID:4832

C:\Temp\xvqnlfcays.sys
C:\Temp\xvqnlfcays.sys
1⤵
- Executes dropped EXE
PID:2116

C:\Temp\snkfcxvpnh.sys
C:\Temp\snkfcxvpnh.sys
1⤵
- Executes dropped EXE
PID:3764

C:\Temp\fcwusmkhfz.sys
C:\Temp\fcwusmkhfz.sys
1⤵
- Executes dropped EXE
PID:5444

C:\Temp\rpjhczusmh.sys
C:\Temp\rpjhczusmh.sys
1⤵
- Executes dropped EXE
PID:6020

C:\Temp\pjhbzwromg.sys
C:\Temp\pjhbzwromg.sys
1⤵
- Executes dropped EXE
PID:2788

C:\Temp\omjdbwtomg.sys
C:\Temp\omjdbwtomg.sys
1⤵
- Executes dropped EXE
PID:4364

C:\Temp\bytqljdbvt.sys
C:\Temp\bytqljdbvt.sys
1⤵
- Executes dropped EXE
PID:2772

C:\Temp\daywqoigbv.sys
C:\Temp\daywqoigbv.sys
1⤵
- Executes dropped EXE
PID:5256

C:\Temp\yvtnlfdyvq.sys
C:\Temp\yvtnlfdyvq.sys
1⤵
PID:2684

C:\Temp\vsnkicaxvq.sys
C:\Temp\vsnkicaxvq.sys
1⤵
PID:5544

C:\Temp\khcausmkic.sys
C:\Temp\khcausmkic.sys
1⤵
PID:4192

C:\Temp\hczurpmhfc.sys
C:\Temp\hczurpmhfc.sys
1⤵
PID:5596

C:\Temp\zxupjhbzur.sys
C:\Temp\zxupjhbzur.sys
1⤵
PID:1972

C:\Temp\omgebwurpj.sys
C:\Temp\omgebwurpj.sys
1⤵
PID:5452

C:\Temp\rojgeywqoj.sys
C:\Temp\rojgeywqoj.sys
1⤵
PID:2544

C:\Temp\wtolgeywqo.sys
C:\Temp\wtolgeywqo.sys
1⤵
PID:700

C:\Temp\sqolgdyvqn.sys
C:\Temp\sqolgdyvqn.sys
1⤵
PID:1488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bvtnljdbvt.sys

Path C:\Temp\bvtnljdbvt.sys
Size 293KB
SHA256 1d0c62e1aed1876c1dff8df257ae29d890c12a6eb194dd0435017e576039831e
MD5 265f0635ce7d4247c653d06b14a00f02
SHA1 8f1b52684d98539de1aa4335a16cc38aaea88258
SHA512 b1fb6c5160abc3d5bd91f2eba74a50f3cb768926731128a8706b98d33f53fe5a3b53ed41fdd706c7d37401b68c446f5655167dd4a5dbeea876780c8a42d27007
SSDEEP 3072:utKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:uIJjiJcbI03GBc3ucY5DCSj
TLSH
T119545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecwuspkhcw.exe

Path C:\Temp\ecwuspkhcw.exe
Size 384KB
SHA256 84f3682ddfaa62381b9937ea140aa0e0679e3e62486b9e3e960043bc92957ff4
MD5 e912a6f8df473dcceaab8a44711be6a5
SHA1 8f8068918db34c0d7c56ae253f8a25314eab8138
SHA512 1d618674754763501016c1c2daa227bf0096e3cd3ec7ec7b9f7ee6bc1dbc1f509b0b0d94f06b51ae06d358e2c3a7faa485fec36aa5342f6cba28688708c0aa0c
SSDEEP 3072:w9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:CctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T13E847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fcwusmkhfz.sys

Path C:\Temp\fcwusmkhfz.sys
Size 293KB
SHA256 fd14a8097a886849a2ff124528ab104552c84cf691a8299a6b9c8b2cc550c915
MD5 1a13dd1cfbdcd235271137b5c20e5c5f
SHA1 f945922ac1fde0a8dd676df9153440f9fb794077
SHA512 98b6badadfa1b7dce20e691a4d38614578bd415052b7fb3d6ee529d38cfd6b5ef24ee89ec5161d55290037fe6c45dbe37ef64a39e8afbad58d232e3f22b388ea
SSDEEP 3072:FtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:FIJjiJcbI03GBc3ucY5DCSj
TLSH
T129545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nkfdxvpnif.exe

Path C:\Temp\i_nkfdxvpnif.exe
Size 384KB
SHA256 b3fcf2eb391467a70f734f5710137431d36f9c48f3f128f67f46e269946f7d8d
MD5 6818bd1fc054158fcf20fe64acf48491
SHA1 e380044442d3e65cf1a23e7c042967e7dddbf87a
SHA512 7fdf2e589825086d2eb53562072f09a7ad25a95ffeedc7b8c386fc804cdc19033ed25b739c5c4e5b8a14ac8d4691e4d738b096a202db05aca66df4301dafcb59
SSDEEP 3072:U9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:uctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1ED847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vqoigdywtn.exe

Path C:\Temp\i_vqoigdywtn.exe
Size 384KB
SHA256 e345755b6918f7118f76ba7a9f98451a1a79fd8eb66ec92f89f087f34cb7098e
MD5 e511f422e378909763f13ad067e75681
SHA1 9fae910844ac605e203ede2979b201bb8f307f0e
SHA512 0dd0525802371f52b8cb8a402bcdd3c9a15962dd6d6c18a075fa0f46cd6e35f19de3f0cb0573de2bda123a9ee5d80563daf81c25160649d90d1c6279e273ecbf
SSDEEP 3072:w9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:CctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A2847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wtrlgbytqj.exe

Path C:\Temp\i_wtrlgbytqj.exe
Size 384KB
SHA256 7239f9de82e374e721ac97a09f56e1f34d7a46231d460cb6a1237ce0fad63e6d
MD5 552fd557a09bc2dea9045d2ac2ac46f9
SHA1 27afc190ada62c6f41d99677f48cdeed7c9f2ad5
SHA512 2bed1e37595d037d0fd4ff67706da625ae1c3814d3402aac04d2b385ca0908242db853f8da9cf68993b307b1dd993bcb0d2f0da398163cc65718516324f70ae9
SSDEEP 3072:E9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:ectFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1DA847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xvqnlfdyvq.exe

Path C:\Temp\i_xvqnlfdyvq.exe
Size 384KB
SHA256 bdd5d11fbb38bf4ac476a8aac215e989c96d0fbfddfc3c25f97a34620fe07c15
MD5 20999e93eed7625a837678deeb5489b2
SHA1 b88623947974afd70a5deec9c3e03656134eb8c6
SHA512 60686a235b580c0b07b6e135617f97462d3b2bb0b4d2ff2d9157d74bfc5186f6d403ab7d8cccda5098ec56a51bca1c3ffb7de1072c258127ffe6cb0ba83df8eb
SSDEEP 3072:89ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:GctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T15C847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ysqkicankf.exe

Path C:\Temp\i_ysqkicankf.exe
Size 384KB
SHA256 70971420c75dcc358c2013b97346fe18fa93a5d637573ebd49fe3df142269e86
MD5 76ed4db7e5e701428a58b4dea10f8e09
SHA1 876bc0d9b4773c60e8bb57bb51e8402004566ae4
SHA512 d94af50521ef0c475e8f4e14feb19eb487e2de324a95639c407c669a17d1cf76c988ffc63c057b4a47d206bb5ae5e23b4773bf103e4d389c335da892336e7e16
SSDEEP 3072:e9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:8ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T156847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nkfdxvpnif.exe

Path C:\Temp\nkfdxvpnif.exe
Size 384KB
SHA256 d439253bd00eab341f9bf3e1f683bffbe54e4a1fcb8315ea737db725acd49d49
MD5 551dc0aca616935c7b982cab08e1f90b
SHA1 caa4e0e3253ef6806276c8eaa51f85732bc5154b
SHA512 6842f7c5ce88741a7ab6b526e368c1da6e3b32a6356b7a81244b44b694aba5e7759709a22ba483e949077f7fcae3526ebdda324ce769ac5f631a70d5b55ea7b8
SSDEEP 3072:F9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:nctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T188847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nljdavtnlx.sys

Path C:\Temp\nljdavtnlx.sys
Size 293KB
SHA256 8ea3f2dafddefaacd6f54738df0a89b5733c28cac73a5d4167d48a1fb8211a45
MD5 e673f5b7637fdae6ea3f1e98c07654a3
SHA1 f32382b599cc9ef705bd51ba6b56d879511bab14
SHA512 051b898a9cbf32b71aea3b18089bd535a6831f5cb83a9447f021394e0f4c85353f6f3501c29a464c9afe4c2955c777ac6dca84c95f775b40fb739eb223b12815
SSDEEP 3072:HtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:HIJjiJcbI03GBc3ucY5DCSj
TLSH
T14C545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

olgebwtrljdbywto.exe

Path C:\Temp\olgebwtrljdbywto.exe
Size 384KB
SHA256 5a6926791bd1638fdfb5f5dc2d75b9bf9760121139f551d294b9242af270e211
MD5 aa1f45e7e65456236035cf6151543997
SHA1 d658591d098b3f5cbd78bbd9d338cfdb14ae31bb
SHA512 59456755f6ba64a92f6aed0a4ef4eb86df9b08e13d444ae698f291298bd6d58977ab618fe99c5a7dbc339b7593f2647c1c6d9c2a3e08c3eb0f82fb2f22aa14c5
SSDEEP 3072:y9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:IctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1AE847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

olgebwtrljdbywto.sys

Path C:\Temp\olgebwtrljdbywto.sys
Size 293KB
SHA256 dbb50d4dd96ec26e2e5e26f872928aa441d1824cc39e13ffae39bc24bd35fcbc
MD5 225f2972ce8060edc01245bdb656a6d9
SHA1 4bee306f5275fc1ab2751f4d9e666b5cc363d4dc
SHA512 92fb56ef32a05ad5a1e07e8933b7fc0734292e3f60866ac45ef749e8ee9798ca2d012a8063059a13589a697d00d015bce73bffc54c6decd1698a39b408d4fbfa
SSDEEP 3072:gtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:gIJjiJcbI03GBc3ucY5DCSj
TLSH
T18F545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snkfcxvpnh.sys

Path C:\Temp\snkfcxvpnh.sys
Size 293KB
SHA256 5ad5d46663105d62cd9be91d4d148ee12a3697f94c55d44f10df86ff426a0b8c
MD5 8b9cf113272186e4b644661f947d67c3
SHA1 e1f83a5efc595d23838b5e7b891d3f1a9ade610f
SHA512 50e7ff0bc906de5ba8219b99e45f1b59d7f4a91d17ce77c6f09f4b7f3b047ef34c939f34cc2b4403798305da71f7925b59d1cfaed2235576f8e29a6a18dd1991
SSDEEP 3072:JtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:JIJjiJcbI03GBc3ucY5DCSj
TLSH
T11C545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vqoigdywtn.exe

Path C:\Temp\vqoigdywtn.exe
Size 384KB
SHA256 65e86ef315d4e2fb89d55faa7296b425c4210ac48088a48d6f81d1c08d164a04
MD5 095bc3ceabe11d0db99ffd1d56d76879
SHA1 b79667e9908c1241ec4382dcc8756072b3b90771
SHA512 45aa872f63f4e2915a94ab882cfe57ba9c7729dd88b2e31ae067c465a4bbbd31364abfc93fc01967bc6729c267afac4882a5f116769cd8b0c53ea410ef522af9
SSDEEP 3072:g9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:yctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T170847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wtrlgbytqj.exe

Path C:\Temp\wtrlgbytqj.exe
Size 384KB
SHA256 69f22e3b856ce3a55eb429d59e23f9572566753fcfac841fe941877c65dfefb5
MD5 bbb343b97e314398a2612ec437953698
SHA1 e7979bc93d62f86be259f0f308b3f98389a99d88
SHA512 0e5b252d8f09c3fb2ffab21cae7b14c7516996c6cd0358c15327796febf8a2f809e568bffe23cd1178909596b68d24de884105868af3d12a24e252e60940fcaf
SSDEEP 3072:49ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:6ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T151847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvqnlfcays.sys

Path C:\Temp\xvqnlfcays.sys
Size 293KB
SHA256 dc0f985c036ecafdbc2cc8bf7bd5cd1a6a9b1aa4cbfbdb5e26143721987d412e
MD5 bed9de8dbb833b7753d963f3d10d9fbc
SHA1 cd56307f0bdbb5dd2d6950b684073da2d2672941
SHA512 2a4f4a5fd2001cd111833eaf151c8675be41e6b12dc6b99b92228d976154ed3101b4e5024e5593fe3a5bb09c6d7cc1bf0ad68af9e55a4f27444988ca87862d8b
SSDEEP 3072:QtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:QIJjiJcbI03GBc3ucY5DCSj
TLSH
T166545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvqnlfdyvq.exe

Path C:\Temp\xvqnlfdyvq.exe
Size 384KB
SHA256 798bfe06e88665f2c21b7f5489d8ba176f4e4d7181be5fbcdcdbdf56ebeef45c
MD5 057bfda2c943f5ada0ad9276a92396a2
SHA1 27c28a22640bafdbb63d8694a18ea9f3d0482319
SHA512 38914eeacba224d78b1e39bf9e83477ac54f009262b64841f70b8e5ab40e2a2d47f40bb0621666e60d2f4bbfe600d0c105ed6711a6590f6580cead3922349c02
SSDEEP 3072:N9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:fctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T10E846B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ysqkicankf.exe

Path C:\Temp\ysqkicankf.exe
Size 384KB
SHA256 eb749384062e349b1c13df103c7d814e0dc151ea99d44b00fe4d6f595962e978
MD5 212275e2443e5526ed9f09f98c6cadf0
SHA1 93983401083db17c7ab7f28b039f3ff5095bb43b
SHA512 79b83e69794aa3346d27d19ca70d15e1c9b7aaa9a1366ab32eb24aa6ee9c5975be7588b1223789273e142d15abb51efb0f74d39f4052e1ce51748190d31c2d8d
SSDEEP 3072:k9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:+ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1FE847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 22c1d58ffa7df77a7e0440ce3b2c474b1e03f30b60355bbf5dd6392fefb641fd
MD5 b9f45a900b1f64efbf90731f41c6ad44
SHA1 0c28e85e464e328fbbc07373b05113d39f83bdcc
SHA512 132313545c55ea809da0e811d6d5d324ecf5b6cfaefadb3fa4a29df5e6266dfeca7cffa4daf21754b4b37771504d3692189b5660a468784b5eaf80bf92f59ae0
TLSH
T11ED02BA033044C0CCE40203215B9A210720484204849031A8E41F02C8C6FD4387161F7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ee3af991fa1719733ca1e3ac746d5b605f4205e269bf244bd9ae780ceadb9bd8
MD5 a044f6413820c4c3fbd300ee9b379ebc
SHA1 94fc91536a25274f06d3a6e89322dec7fde7912e
SHA512 ced4374c54d7b4ea2b76afe4ca5d8841dfb55d8cb5db96de4ed49e64bd3850a817db5301787c268756641c94c0bf85eb4ee188f04fc891fa2e45ad48284985a5
TLSH
T13AD02BA433044D0CCE40203215B8A210720484209C49031A8D41B01C8C6FD4387171FB
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 5187162c79d1588f98a318dff1215c95da2b7adfc7cfe2d5fe39c08cea907648
MD5 3fce71c7418e23493d22a9ee3684d54e
SHA1 884bd66f1ba056ecc977ff4761bb17991890d650
SHA512 04b39889cae75fe383521a83ea70268de743a0c0120daea33b63fe767b5c3dbf2d62cb74c2c287c8e7ecbd2298f1a8a36a04b39a88fa1602252a8997f86976d7
TLSH
T19051739143E31AD9F72D0BF262C71C5AF67777664683EE1200CAA9364C0E36E8321DD5
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59b963.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59b963.TMP
Size 2KB
SHA256 b9a58723f982ffb127b5247365687d986bc665d41c9ad87c677cb1470603d2eb
MD5 023bdaf4194ec78d294c5a3ee2ddfaec
SHA1 528c0fd86b46a71f697cfc866f3f0bf19d34c56d
SHA512 80accd0df00baef8e9de668b61f11b04b26bb8bfac286ec283e0bccdaacc19c9ff00e6f4358db0ec06a9a94e9c1968127489f57d8016928915cd97327cf85641
TLSH
T1A651739143E31AD9F72D0AF262C71C6AF677B7AA4683DE1304CA59364C0E32E9321DD5
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 97cf6b6cb2ea307ba47e47dd1bc0b7a05264cb9be7ba2d40d07ebfdf9d5734a8
MD5 193cc03b6ab59b7c607ad5e8a7ae4643
SHA1 5fd2058145e912e11c03706413ae96198ba944ca
SHA512 3cc2f5660e53dcab89966cc341f6ef4cb3454640c06f19c65254c885a4800c5e1cc9e997dce5bce2c1cdc23761b9a64a35a257e67b3ee2f947260c05b74ec1ea
TLSH
T1FD4190F3C3F4856E891156F0AA14AE1BCE2D0515431C7D5AC9E4AE2B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 718e362a3602371d16838fdb853b4abff02a9e3204a4a6fce4baf6e40835f33c
MD5 0011bddacbd25000948334c30b2ede7c
SHA1 70cf8ba50afdb0bc62b5ab152453cc89f8835e9f
SHA512 3551b9b35acced9fa056b2c358f6eea0ab67b810751ab4ebb725dda53207b280770bc72395bb83e1f64cc0ca19069bab04c102ca47bec3f3d1daee466d25c510
SSDEEP 192:sxRpRHCp/fwsmTMBZR4hzoD8p9g/g6+WNCxV4/YGebLk5GLIgViJ:sxRpkp/fwscMPR4Fu/5m4/BIw
TLSH
T1F542B8156D6869378CC7E21DBA55BF53D7F91073A0951E48BAFCCA0C04EB6DD221380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 3d74f38805673043d0a5e12dda05a2824da047d885998dc05750b4c2740af4a7
MD5 b6468b604428854d9068be8106b12527
SHA1 cb3bf127c43c713de5ae2f834535bfbe97eded96
SHA512 fac04b9f64543f5adeb15cfb65b27a5487e2b7788cdf36aa5dc88bcc0a631a5de381dec9b85b089134d3a952070039553eb04095f42a748ae5b8f6288737611f
SSDEEP 192:sxRyRHCp/fws+TMBZR4hzoD8p9g/g6+WNCxV4/YGebLk5GLIgD9iJ:sxRykp/fwsUMPR4Fu/5m4/BIs
TLSH
T1C342C8156D68693B8CCBE21DFA55BF53E7F91072A0951E48BAFCCA0C04EB6DD221340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 f0b242a5d0af9e59802a1b098a117c02f2618ec7a3785b21628d2c3bc317a476
MD5 f6299e4fdc01757654b3252c5d82283f
SHA1 94e075dd676b466cee70219f776752cd67d4e336
SHA512 f99d4e76ff103970cbaf9374d7beeb0e1946b1ba1662390c8f5d4fe95c5a6f7de568c8270e4299272ccd03dcbe2cc62c97a89eb321196546764367ffcaafaec2
SSDEEP 192:sxRyRHCp/fws+TuBZR4hzoD8p9g/g6+WNCxV4/YGK5k5GLIgDniJ:sxRykp/fwsUuPR4Fu/5m4/nIi
TLSH
T10442B8156D68693B8CDBE21DBA55BF53E3F9507260951E48BAFCCB0C04EB6DD221380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 7f15dcb38bdfc09b394514c6bf20bf5df2c67278d4a1b2a32eca7daa51dc967b
MD5 dc360778abc894a8f436dc247031b572
SHA1 89822ccd2f6ad48ce7bb0db57d24c66230d67741
SHA512 e47136be8d191a0f566196f4a67468c187f4b26ce9f590e7c1e8358c2341b81848bca92a4427a1b7e8239b58c2d9be5466db4d8515aa2aac210981927267a85a
SSDEEP 768:UQYiz37pLuL78NWgv7fxJ8F1+UoAYDCx9Tuqh0VfUC9xbog/OViW5pNKJroD:UQYizxE78NWgv7fxJu1ja5W5fKiD
TLSH
T15FD2DB7B740CCB7E4F804A9DAD197A9F6DA802CB96D8CD8047FE941C02C6BFB51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a5507.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a5507.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 2e5fcd96b4e64d84768bfa19ab58ecbd443e1cc77b34ea6765c25f080a7c2635
MD5 ed4f16b570bcecc5679c6e9be0594137
SHA1 2076f890252e2f01d674a67eb9c8f641cecf8cb1
SHA512 4b033bed3678cf7fe68c2ae8e2843827a6b39968b590d85ee53c3942e0daf6bb13445324fb8e9494e16d27dd3398d825d499d0fd0d063dfcf3d48a6ce1e20c38
SSDEEP 768:trv+4UNbdZ383jlYyJaC/7Hucys6BRvi82oP4/z6himo6y2bwn+7:tbsbP3mXO3imOz6Imoh0wM
TLSH
T11813AF31E454DD32ECFB9184B54A7BD37FF4127344C90A94EADA5B4E0187A5E232B863
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 baad099b8839567a422cbbf8992a4a03dcff22719519c5026a627b03925ba858
MD5 3d935dee7fdf19d31395c2c496fcc542
SHA1 c774b82319e74bd42b9ef8dfa5f789990c5813c5
SHA512 93c7d4e9a5e7481c1ffeabda2b586fac349db401071112bcfebc3bbf5368333436b6583fe098e9ea526fe14b5454ad06d5d4c9beba3a33cf4fcb18b34eb76cd3
SSDEEP 768:3K3X8jlYyJaC/7Hucys6BRvi82oP4/z6himo6yPi9PXt6:3K3GXO3imOz6ImohPgt6
TLSH
T12BF2A070E855DD62ECFBE289F58637927EE51273908C1E94DADEDB0D05C365E032B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 42b5b3f5f2b079b505c77ed7e6898eb759cdca441a1a6646aa1d6bed396bf5ad
MD5 e4edf7259eb7643d0a90730f8ab745de
SHA1 dd303f9e4df6f92b07c6dc67c29268415d9704f8
SHA512 382c9c97972076df3685ea8a48e44ce250befd261144499e8af516624312b5afaa6e7f3fab1ec7f033ca05864df39bca3be15f467a87dca1de2994cae9432620
SSDEEP 768:xGrv+4UNbdS328SlYyJab7Hucys6BRvi82oP4/z6himo+V2bwn+h:xGbsbw32PP3imOz6ImoW0w+
TLSH
T17503C035E4549D72ECF78288B54A7A933FF4522345C91AC0E6DE6F0E428B95E131BC63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 79f3971d2fa8cd8f20ea8bde8df56b755f9e879e8d53ab4afdd942ff4c6e4a38
MD5 d456e5a22d42289296665eb4c3107a3b
SHA1 16017531200f92543398b21f5611b5bd7ef1013f
SHA512 d118c3453f8fef88130a2c595f490bbadfbce5e1f5951ae2f70851f3dfcf70b0376678b351c9d9fb1113b7f768b5d598c75683b827054e0b94646d13c8d0b7a9
SSDEEP 768:Brv+4UNbdZ3G8jlYyJaC/7Hucys6BRvi82oP4/z6himo6yPi9PXto:BbsbP37XO3imOz6ImohPgto
TLSH
T15A13B030F458DE72ECF7D288B1463B937FF4127390891A94EADA9B0D06C755E132B862
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 1280e1d35e7e5eecfdb9a4e2da2b9e424ad5e2d08c74ea960e1f3e4c8cffa0bb
MD5 85ee42e9c5fc3591f47690401b929c4d
SHA1 56af031bb7031007a634cf92c9257d024528bdbc
SHA512 65354d1cdf3f15a25bc4026b37326eda032673a78fca5d99d06767f0c4dc61f29ea47ba50241e5d8abc3b45c1a046842888f2e7af48dfd0633453da59946ff12
SSDEEP 768:srv+4UNbdS30BlYyJaCr7Hucys6BRvi82oP4/z6himofy2bwn+h:sbsbw3oXC3imOz6Imo60w+
TLSH
T1BC03BF35E458DD72ECEB9188B44A7B937FF5127344C90E80EADA5B4E0187A5E231B863
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 00ca292d01dcc59778ad9bfccd28a9f934cfda8ac22fa4fa4207d5e7784c313a
MD5 1a23f568d5b488ea81964df078ddab1d
SHA1 237840733a7bd5d705c8209d10a2ca5a52be68c3
SHA512 91e00c0c665049190b8a9921a2f59686d5757038479a9080ec3783c9754fcf6a09c0245b08cecf617f5a870c360dcb80c06e4360b89b8b0dd85aae8c68d21075
SSDEEP 768:hFQM3jwgjViyVaCU7Hucys6BRvi82oP4/z6himo6yPi9PXt6:wM3RXh3imOz6ImohPgt6
TLSH
T1A61339F5D4D38936E8AE9787A77D6E425AFCC163B0885994BBD94E0CCC8257FC30A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

bd6b5e8d-4067-47f8-90a1-f235909af252.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\bd6b5e8d-4067-47f8-90a1-f235909af252.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5172_546466426\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 86550ed5610a4edbb31cc7732025bdf446a79a284d332ae8c597a4f7c674a88f
MD5 ff14d7cc9f6368c2b3f96a84938134f3
SHA1 79cda93995c9fd8552a96b203b948616f5da027a
SHA512 c24745a4b6738b0e9cec190b1bcd215cc180a6a9c9266fd9da7852d7ba3185c77898d9bd68df9fb23c9fa4a0cb439962d3cf42023e6bbe927dfb628da0e7266b
TLSH
T1AD71238357E9D6B2C1DE9FF412835644F5FB2238073330200B95598BEB30A7A58B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/700-474-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1000-181-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1488-491-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1972-445-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2116-258-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2544-470-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2684-390-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2772-341-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2788-314-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3764-270-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4192-414-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4364-337-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4620-62-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4832-228-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5256-370-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5444-291-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5452-450-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5544-410-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5596-434-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6020-310-0x0000000000010000-0x00000000000AB000-memory.dmp

Download