systex | d43fe9e080d25da48d81adefc36007392fd6426cfc43eaf1ab705c430a1298ef

Analysis

max time kernel
149s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 03:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_ecfeedcd591dfa969148716522b39a31_amadey_darkgate_elex_smoke-loader_stop.exe
Size 384KB
Sample260819-eg46fswdnd
SHA256 d43fe9e080d25da48d81adefc36007392fd6426cfc43eaf1ab705c430a1298ef
MD5 ecfeedcd591dfa969148716522b39a31
SHA1 1cdf6a7f2241bb75113e569776223708c9327080
SHA512 e4aa2bec2431e8992ad3ca1912be040ab00a6c6ffb936ac7a1f29a843c5e1a5025282bb05fb2df0b0d1f1fe4c70223c98af5188e1501bd8ae52ca19f97356d11
SSDEEP 3072:S9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:octFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F3847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
4908	oigaysqligaytqoi.exe
4012	oigaysqligaytqoi.sys
4276	CreateProcess.exe
5732	qolgdyvqol.exe
2704	CreateProcess.exe
3204	CreateProcess.exe
3416	i_qolgdyvqol.exe
1000	nlfdxvtnlf.sys
5944	CreateProcess.exe
2576	ifdxvqniga.exe
4764	CreateProcess.exe
3316	CreateProcess.exe
5528	i_ifdxvqniga.exe
2044	tnlfdxvpnl.sys
3956	CreateProcess.exe
2560	fcausnkfdx.exe
2836	CreateProcess.exe
4584	CreateProcess.exe
480	i_fcausnkfdx.exe
4920	icauspkica.sys
600	CreateProcess.exe
4372	fcausmkfcx.exe
1864	CreateProcess.exe
3432	CreateProcess.exe
3884	i_fcausmkfcx.exe
4212	kecwupmhec.sys
4288	CreateProcess.exe
5084	hcwupnhfzx.exe
2568	CreateProcess.exe
4988	CreateProcess.exe
5708	i_hcwupnhfzx.exe
3716	xuomkhbzwr.sys
2288	CreateProcess.exe
6044	wurpjhbzur.exe
4440	CreateProcess.exe
1080	CreateProcess.exe
4552	i_wurpjhbzur.exe
1120	ebwuomgezw.sys
4432	CreateProcess.exe
3188	wtrljebwto.exe
3596	CreateProcess.exe
5180	CreateProcess.exe
992	i_wtrljebwto.exe
5960	gebwuoljge.sys
3164	CreateProcess.exe
5264	jgbztrljdb.exe
1572	CreateProcess.exe
2696	CreateProcess.exe
4452	i_jgbztrljdb.exe
3600	ljdbywtolg.sys
2632	CreateProcess.exe
6092	dbytqljgby.exe
5588	CreateProcess.exe
3908	CreateProcess.exe
3896	i_dbytqljgby.exe
5288	vtnlgdyvqn.sys
3412	CreateProcess.exe
2784	nlidxvqnig.exe
5960	CreateProcess.exe
3016	CreateProcess.exe
4904	i_nlidxvqnig.exe
4452	qnigaysqki.sys
1600	CreateProcess.exe
1252	icavsnkfdx.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1264_1643034572\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1264_1379149641\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1264_1643034572\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1264_1643034572\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1264_1643034572\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1264_860970089\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1264_1379149641\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1264_378481857\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1264_378481857\nav_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifdxvqniga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hcwupnhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfaxsqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bzxrpjhczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fcausnkfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wurpjhbzur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdyvtnlfvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifdxvqniga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlidxvqnig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtrljebwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlidxvqnig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjzwuomgez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywqojgbytr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_ecfeedcd591dfa969148716522b39a31_amadey_darkgate_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qolgdyvqol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fcausmkfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hcwupnhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wurpjhbzur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtrljebwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbytqljgby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzxrpjhczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qolgdyvqol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcausnkfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icavsnkfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_causpkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jebwuomgez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdyvtnlfvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgbztrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbytqljgby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjzwuomgez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jebwuomgez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvtnlfdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcausmkfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgbztrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icavsnkfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfaxsqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqojgbytr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvtnlfdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxvsqkifay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causpkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigaysqligaytqoi.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3200	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
248	ipconfig.exe
5444	ipconfig.exe
1344	ipconfig.exe
4888	ipconfig.exe
5332	ipconfig.exe
2912	ipconfig.exe
2448	ipconfig.exe
5196	ipconfig.exe
4664	ipconfig.exe
5768	ipconfig.exe
5024	ipconfig.exe
1872	ipconfig.exe
5656	ipconfig.exe
5940	ipconfig.exe
6120	ipconfig.exe
3584	ipconfig.exe
2412	ipconfig.exe
5700	ipconfig.exe
1904	ipconfig.exe
4124	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315853494960241"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1079202589-886135813-2527035092-1000\{E97DF828-6F43-4883-AE37-30E80190CA09}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6052	2026-08-19_ecfeedcd591dfa969148716522b39a31_amadey_darkgate_elex_smoke-loader_stop.exe
6052	2026-08-19_ecfeedcd591dfa969148716522b39a31_amadey_darkgate_elex_smoke-loader_stop.exe
6052	2026-08-19_ecfeedcd591dfa969148716522b39a31_amadey_darkgate_elex_smoke-loader_stop.exe
6052	2026-08-19_ecfeedcd591dfa969148716522b39a31_amadey_darkgate_elex_smoke-loader_stop.exe
6052	2026-08-19_ecfeedcd591dfa969148716522b39a31_amadey_darkgate_elex_smoke-loader_stop.exe
6052	2026-08-19_ecfeedcd591dfa969148716522b39a31_amadey_darkgate_elex_smoke-loader_stop.exe
6052	2026-08-19_ecfeedcd591dfa969148716522b39a31_amadey_darkgate_elex_smoke-loader_stop.exe
6052	2026-08-19_ecfeedcd591dfa969148716522b39a31_amadey_darkgate_elex_smoke-loader_stop.exe
6052	2026-08-19_ecfeedcd591dfa969148716522b39a31_amadey_darkgate_elex_smoke-loader_stop.exe
6052	2026-08-19_ecfeedcd591dfa969148716522b39a31_amadey_darkgate_elex_smoke-loader_stop.exe
6052	2026-08-19_ecfeedcd591dfa969148716522b39a31_amadey_darkgate_elex_smoke-loader_stop.exe
6052	2026-08-19_ecfeedcd591dfa969148716522b39a31_amadey_darkgate_elex_smoke-loader_stop.exe
6052	2026-08-19_ecfeedcd591dfa969148716522b39a31_amadey_darkgate_elex_smoke-loader_stop.exe
6052	2026-08-19_ecfeedcd591dfa969148716522b39a31_amadey_darkgate_elex_smoke-loader_stop.exe
6052	2026-08-19_ecfeedcd591dfa969148716522b39a31_amadey_darkgate_elex_smoke-loader_stop.exe
6052	2026-08-19_ecfeedcd591dfa969148716522b39a31_amadey_darkgate_elex_smoke-loader_stop.exe
6052	2026-08-19_ecfeedcd591dfa969148716522b39a31_amadey_darkgate_elex_smoke-loader_stop.exe
6052	2026-08-19_ecfeedcd591dfa969148716522b39a31_amadey_darkgate_elex_smoke-loader_stop.exe
6052	2026-08-19_ecfeedcd591dfa969148716522b39a31_amadey_darkgate_elex_smoke-loader_stop.exe
6052	2026-08-19_ecfeedcd591dfa969148716522b39a31_amadey_darkgate_elex_smoke-loader_stop.exe
6052	2026-08-19_ecfeedcd591dfa969148716522b39a31_amadey_darkgate_elex_smoke-loader_stop.exe
6052	2026-08-19_ecfeedcd591dfa969148716522b39a31_amadey_darkgate_elex_smoke-loader_stop.exe
6052	2026-08-19_ecfeedcd591dfa969148716522b39a31_amadey_darkgate_elex_smoke-loader_stop.exe
6052	2026-08-19_ecfeedcd591dfa969148716522b39a31_amadey_darkgate_elex_smoke-loader_stop.exe
6052	2026-08-19_ecfeedcd591dfa969148716522b39a31_amadey_darkgate_elex_smoke-loader_stop.exe
6052	2026-08-19_ecfeedcd591dfa969148716522b39a31_amadey_darkgate_elex_smoke-loader_stop.exe
6052	2026-08-19_ecfeedcd591dfa969148716522b39a31_amadey_darkgate_elex_smoke-loader_stop.exe
6052	2026-08-19_ecfeedcd591dfa969148716522b39a31_amadey_darkgate_elex_smoke-loader_stop.exe
6052	2026-08-19_ecfeedcd591dfa969148716522b39a31_amadey_darkgate_elex_smoke-loader_stop.exe
6052	2026-08-19_ecfeedcd591dfa969148716522b39a31_amadey_darkgate_elex_smoke-loader_stop.exe
6052	2026-08-19_ecfeedcd591dfa969148716522b39a31_amadey_darkgate_elex_smoke-loader_stop.exe
6052	2026-08-19_ecfeedcd591dfa969148716522b39a31_amadey_darkgate_elex_smoke-loader_stop.exe
6052	2026-08-19_ecfeedcd591dfa969148716522b39a31_amadey_darkgate_elex_smoke-loader_stop.exe
6052	2026-08-19_ecfeedcd591dfa969148716522b39a31_amadey_darkgate_elex_smoke-loader_stop.exe
6052	2026-08-19_ecfeedcd591dfa969148716522b39a31_amadey_darkgate_elex_smoke-loader_stop.exe
6052	2026-08-19_ecfeedcd591dfa969148716522b39a31_amadey_darkgate_elex_smoke-loader_stop.exe
6052	2026-08-19_ecfeedcd591dfa969148716522b39a31_amadey_darkgate_elex_smoke-loader_stop.exe
6052	2026-08-19_ecfeedcd591dfa969148716522b39a31_amadey_darkgate_elex_smoke-loader_stop.exe
6052	2026-08-19_ecfeedcd591dfa969148716522b39a31_amadey_darkgate_elex_smoke-loader_stop.exe
6052	2026-08-19_ecfeedcd591dfa969148716522b39a31_amadey_darkgate_elex_smoke-loader_stop.exe
6052	2026-08-19_ecfeedcd591dfa969148716522b39a31_amadey_darkgate_elex_smoke-loader_stop.exe
6052	2026-08-19_ecfeedcd591dfa969148716522b39a31_amadey_darkgate_elex_smoke-loader_stop.exe
6052	2026-08-19_ecfeedcd591dfa969148716522b39a31_amadey_darkgate_elex_smoke-loader_stop.exe
6052	2026-08-19_ecfeedcd591dfa969148716522b39a31_amadey_darkgate_elex_smoke-loader_stop.exe
6052	2026-08-19_ecfeedcd591dfa969148716522b39a31_amadey_darkgate_elex_smoke-loader_stop.exe
6052	2026-08-19_ecfeedcd591dfa969148716522b39a31_amadey_darkgate_elex_smoke-loader_stop.exe
6052	2026-08-19_ecfeedcd591dfa969148716522b39a31_amadey_darkgate_elex_smoke-loader_stop.exe
6052	2026-08-19_ecfeedcd591dfa969148716522b39a31_amadey_darkgate_elex_smoke-loader_stop.exe
6052	2026-08-19_ecfeedcd591dfa969148716522b39a31_amadey_darkgate_elex_smoke-loader_stop.exe
6052	2026-08-19_ecfeedcd591dfa969148716522b39a31_amadey_darkgate_elex_smoke-loader_stop.exe
6052	2026-08-19_ecfeedcd591dfa969148716522b39a31_amadey_darkgate_elex_smoke-loader_stop.exe
6052	2026-08-19_ecfeedcd591dfa969148716522b39a31_amadey_darkgate_elex_smoke-loader_stop.exe
6052	2026-08-19_ecfeedcd591dfa969148716522b39a31_amadey_darkgate_elex_smoke-loader_stop.exe
6052	2026-08-19_ecfeedcd591dfa969148716522b39a31_amadey_darkgate_elex_smoke-loader_stop.exe
6052	2026-08-19_ecfeedcd591dfa969148716522b39a31_amadey_darkgate_elex_smoke-loader_stop.exe
6052	2026-08-19_ecfeedcd591dfa969148716522b39a31_amadey_darkgate_elex_smoke-loader_stop.exe
4908	oigaysqligaytqoi.exe
4908	oigaysqligaytqoi.exe
4908	oigaysqligaytqoi.exe
4908	oigaysqligaytqoi.exe
4908	oigaysqligaytqoi.exe
4908	oigaysqligaytqoi.exe
4908	oigaysqligaytqoi.exe
4908	oigaysqligaytqoi.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	3416	i_qolgdyvqol.exe
Token: SeDebugPrivilege	5528	i_ifdxvqniga.exe
Token: SeDebugPrivilege	480	i_fcausnkfdx.exe
Token: SeDebugPrivilege	3884	i_fcausmkfcx.exe
Token: SeDebugPrivilege	5708	i_hcwupnhfzx.exe
Token: SeDebugPrivilege	4552	i_wurpjhbzur.exe
Token: SeDebugPrivilege	992	i_wtrljebwto.exe
Token: SeDebugPrivilege	4452	i_jgbztrljdb.exe
Token: SeDebugPrivilege	3896	i_dbytqljgby.exe
Token: SeDebugPrivilege	4904	i_nlidxvqnig.exe
Token: SeDebugPrivilege	1560	i_icavsnkfdx.exe
Token: SeDebugPrivilege	296	i_hfaxsqkica.exe
Token: SeDebugPrivilege	4888	i_causpkhcau.exe
Token: SeDebugPrivilege	4260	i_bzxrpjhczu.exe
Token: SeDebugPrivilege	256	i_pjzwuomgez.exe
Token: SeDebugPrivilege	4648	i_jebwuomgez.exe
Token: SeDebugPrivilege	2500	i_ywqojgbytr.exe
Token: SeDebugPrivilege	1032	i_yvtnlfdyvq.exe
Token: SeDebugPrivilege	3248	i_fdyvtnlfvq.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1264	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6052 wrote to memory of 4908	6052	2026-08-19_ecfeedcd591dfa969148716522b39a31_amadey_darkgate_elex_smoke-loader_stop.exe	89
PID 6052 wrote to memory of 1720	6052	2026-08-19_ecfeedcd591dfa969148716522b39a31_amadey_darkgate_elex_smoke-loader_stop.exe	90
PID 1720 wrote to memory of 1264	1720	iexplore.exe	91
PID 1264 wrote to memory of 4364	1264	msedge.exe	92
PID 1264 wrote to memory of 3200	1264	msedge.exe	93
PID 1264 wrote to memory of 4760	1264	msedge.exe	96
PID 1264 wrote to memory of 4760	1264	msedge.exe	96
PID 1264 wrote to memory of 5540	1264	msedge.exe	94
PID 1264 wrote to memory of 5540	1264	msedge.exe	94
PID 1264 wrote to memory of 5540	1264	msedge.exe	94
PID 1264 wrote to memory of 2612	1264	msedge.exe	97
PID 1264 wrote to memory of 5072	1264	msedge.exe	98
PID 1264 wrote to memory of 2612	1264	msedge.exe	97
PID 1264 wrote to memory of 2612	1264	msedge.exe	97
PID 1264 wrote to memory of 5072	1264	msedge.exe	98
PID 1264 wrote to memory of 5072	1264	msedge.exe	98
PID 1264 wrote to memory of 4160	1264	msedge.exe	99
PID 1264 wrote to memory of 4160	1264	msedge.exe	99
PID 1264 wrote to memory of 4160	1264	msedge.exe	99
PID 1264 wrote to memory of 4940	1264	msedge.exe	100
PID 1264 wrote to memory of 4940	1264	msedge.exe	100
PID 1264 wrote to memory of 4940	1264	msedge.exe	100
PID 1264 wrote to memory of 1108	1264	msedge.exe	102
PID 1264 wrote to memory of 1108	1264	msedge.exe	102
PID 1264 wrote to memory of 3580	1264	msedge.exe	105
PID 1264 wrote to memory of 768	1264	msedge.exe	106
PID 1264 wrote to memory of 3580	1264	msedge.exe	105
PID 1264 wrote to memory of 768	1264	msedge.exe	106
PID 1264 wrote to memory of 5492	1264	msedge.exe	108
PID 1264 wrote to memory of 2736	1264	msedge.exe	109
PID 1264 wrote to memory of 2736	1264	msedge.exe	109
PID 4908 wrote to memory of 4276	4908	oigaysqligaytqoi.exe	110
PID 5732 wrote to memory of 2704	5732	qolgdyvqol.exe	115
PID 1264 wrote to memory of 3188	1264	msedge.exe	118
PID 1264 wrote to memory of 3188	1264	msedge.exe	118
PID 4908 wrote to memory of 3204	4908	oigaysqligaytqoi.exe	119
PID 4908 wrote to memory of 5944	4908	oigaysqligaytqoi.exe	123
PID 2576 wrote to memory of 4764	2576	ifdxvqniga.exe	125
PID 4908 wrote to memory of 3316	4908	oigaysqligaytqoi.exe	128
PID 4908 wrote to memory of 3956	4908	oigaysqligaytqoi.exe	132
PID 2560 wrote to memory of 2836	2560	fcausnkfdx.exe	134
PID 4908 wrote to memory of 4584	4908	oigaysqligaytqoi.exe	137
PID 4908 wrote to memory of 600	4908	oigaysqligaytqoi.exe	142
PID 4372 wrote to memory of 1864	4372	fcausmkfcx.exe	144
PID 4908 wrote to memory of 3432	4908	oigaysqligaytqoi.exe	147
PID 1264 wrote to memory of 4692	1264	msedge.exe	149
PID 1264 wrote to memory of 1572	1264	msedge.exe	150
PID 1264 wrote to memory of 4312	1264	msedge.exe	151
PID 4908 wrote to memory of 4288	4908	oigaysqligaytqoi.exe	154
PID 5084 wrote to memory of 2568	5084	hcwupnhfzx.exe	156
PID 4908 wrote to memory of 4988	4908	oigaysqligaytqoi.exe	159
PID 4908 wrote to memory of 2288	4908	oigaysqligaytqoi.exe	163
PID 6044 wrote to memory of 4440	6044	wurpjhbzur.exe	165
PID 4908 wrote to memory of 1080	4908	oigaysqligaytqoi.exe	168
PID 4908 wrote to memory of 4432	4908	oigaysqligaytqoi.exe	172
PID 3188 wrote to memory of 3596	3188	wtrljebwto.exe	174
PID 4908 wrote to memory of 5180	4908	oigaysqligaytqoi.exe	177
PID 4908 wrote to memory of 3164	4908	oigaysqligaytqoi.exe	181
PID 5264 wrote to memory of 1572	5264	jgbztrljdb.exe	183
PID 4908 wrote to memory of 2696	4908	oigaysqligaytqoi.exe	186
PID 1264 wrote to memory of 3288	1264	msedge.exe	188
PID 1264 wrote to memory of 3288	1264	msedge.exe	188
PID 4908 wrote to memory of 2632	4908	oigaysqligaytqoi.exe	194
PID 6092 wrote to memory of 5588	6092	dbytqljgby.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-08-19_ecfeedcd591dfa969148716522b39a31_amadey_darkgate_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_ecfeedcd591dfa969148716522b39a31_amadey_darkgate_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6052
- C:\Temp\oigaysqligaytqoi.exe
  C:\Temp\oigaysqligaytqoi.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4908
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qolgdyvqol.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4276
  - - C:\Temp\qolgdyvqol.exe
      C:\Temp\qolgdyvqol.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5732
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2704
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5332
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qolgdyvqol.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3204
  - - C:\Temp\i_qolgdyvqol.exe
      C:\Temp\i_qolgdyvqol.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3416
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ifdxvqniga.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5944
  - - C:\Temp\ifdxvqniga.exe
      C:\Temp\ifdxvqniga.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2576
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4764
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2412
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ifdxvqniga.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3316
  - - C:\Temp\i_ifdxvqniga.exe
      C:\Temp\i_ifdxvqniga.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5528
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fcausnkfdx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3956
  - - C:\Temp\fcausnkfdx.exe
      C:\Temp\fcausnkfdx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2560
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2836
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5656
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fcausnkfdx.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4584
  - - C:\Temp\i_fcausnkfdx.exe
      C:\Temp\i_fcausnkfdx.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:480
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fcausmkfcx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:600
  - - C:\Temp\fcausmkfcx.exe
      C:\Temp\fcausmkfcx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4372
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1864
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2912
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fcausmkfcx.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3432
  - - C:\Temp\i_fcausmkfcx.exe
      C:\Temp\i_fcausmkfcx.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3884
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hcwupnhfzx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4288
  - - C:\Temp\hcwupnhfzx.exe
      C:\Temp\hcwupnhfzx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5084
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2568
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5444
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hcwupnhfzx.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4988
  - - C:\Temp\i_hcwupnhfzx.exe
      C:\Temp\i_hcwupnhfzx.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5708
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wurpjhbzur.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2288
  - - C:\Temp\wurpjhbzur.exe
      C:\Temp\wurpjhbzur.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6044
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4440
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2448
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wurpjhbzur.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1080
  - - C:\Temp\i_wurpjhbzur.exe
      C:\Temp\i_wurpjhbzur.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4552
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wtrljebwto.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4432
  - - C:\Temp\wtrljebwto.exe
      C:\Temp\wtrljebwto.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3188
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3596
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5700
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wtrljebwto.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5180
  - - C:\Temp\i_wtrljebwto.exe
      C:\Temp\i_wtrljebwto.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:992
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jgbztrljdb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3164
  - - C:\Temp\jgbztrljdb.exe
      C:\Temp\jgbztrljdb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5264
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1572
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5940
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jgbztrljdb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2696
  - - C:\Temp\i_jgbztrljdb.exe
      C:\Temp\i_jgbztrljdb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4452
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbytqljgby.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2632
  - - C:\Temp\dbytqljgby.exe
      C:\Temp\dbytqljgby.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6092
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5588
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6120
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbytqljgby.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3908
  - - C:\Temp\i_dbytqljgby.exe
      C:\Temp\i_dbytqljgby.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3896
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nlidxvqnig.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3412
  - - C:\Temp\nlidxvqnig.exe
      C:\Temp\nlidxvqnig.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2784
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5960
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5196
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nlidxvqnig.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3016
  - - C:\Temp\i_nlidxvqnig.exe
      C:\Temp\i_nlidxvqnig.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4904
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\icavsnkfdx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1600
  - - C:\Temp\icavsnkfdx.exe
      C:\Temp\icavsnkfdx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1252
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1948
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4664
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_icavsnkfdx.exe ups_ins
    3⤵
    PID:2044
  - - C:\Temp\i_icavsnkfdx.exe
      C:\Temp\i_icavsnkfdx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1560
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hfaxsqkica.exe ups_run
    3⤵
    PID:5456
  - - C:\Temp\hfaxsqkica.exe
      C:\Temp\hfaxsqkica.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3580
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1732
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1904
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hfaxsqkica.exe ups_ins
    3⤵
    PID:5508
  - - C:\Temp\i_hfaxsqkica.exe
      C:\Temp\i_hfaxsqkica.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:296
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\causpkhcau.exe ups_run
    3⤵
    PID:3228
  - - C:\Temp\causpkhcau.exe
      C:\Temp\causpkhcau.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3988
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2956
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5768
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_causpkhcau.exe ups_ins
    3⤵
    PID:4012
  - - C:\Temp\i_causpkhcau.exe
      C:\Temp\i_causpkhcau.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4888
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bzxrpjhczu.exe ups_run
    3⤵
    PID:1232
  - - C:\Temp\bzxrpjhczu.exe
      C:\Temp\bzxrpjhczu.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4932
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5064
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5024
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bzxrpjhczu.exe ups_ins
    3⤵
    PID:5868
  - - C:\Temp\i_bzxrpjhczu.exe
      C:\Temp\i_bzxrpjhczu.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4260
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pjzwuomgez.exe ups_run
    3⤵
    PID:5384
  - - C:\Temp\pjzwuomgez.exe
      C:\Temp\pjzwuomgez.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5004
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4628
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1344
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pjzwuomgez.exe ups_ins
    3⤵
    PID:4428
  - - C:\Temp\i_pjzwuomgez.exe
      C:\Temp\i_pjzwuomgez.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:256
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jebwuomgez.exe ups_run
    3⤵
    PID:4616
  - - C:\Temp\jebwuomgez.exe
      C:\Temp\jebwuomgez.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4820
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1776
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1872
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jebwuomgez.exe ups_ins
    3⤵
    PID:3456
  - - C:\Temp\i_jebwuomgez.exe
      C:\Temp\i_jebwuomgez.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4648
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ywqojgbytr.exe ups_run
    3⤵
    PID:2612
  - - C:\Temp\ywqojgbytr.exe
      C:\Temp\ywqojgbytr.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3764
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1792
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4888
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ywqojgbytr.exe ups_ins
    3⤵
    PID:1068
  - - C:\Temp\i_ywqojgbytr.exe
      C:\Temp\i_ywqojgbytr.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2500
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\yvtnlfdyvq.exe ups_run
    3⤵
    PID:2024
  - - C:\Temp\yvtnlfdyvq.exe
      C:\Temp\yvtnlfdyvq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1288
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5024
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4124
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_yvtnlfdyvq.exe ups_ins
    3⤵
    PID:4980
  - - C:\Temp\i_yvtnlfdyvq.exe
      C:\Temp\i_yvtnlfdyvq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1032
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fdyvtnlfvq.exe ups_run
    3⤵
    PID:5976
  - - C:\Temp\fdyvtnlfvq.exe
      C:\Temp\fdyvtnlfvq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3464
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:256
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:248
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fdyvtnlfvq.exe ups_ins
    3⤵
    PID:1872
  - - C:\Temp\i_fdyvtnlfvq.exe
      C:\Temp\i_fdyvtnlfvq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3248
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dxvsqkifay.exe ups_run
    3⤵
    PID:5988
  - - C:\Temp\dxvsqkifay.exe
      C:\Temp\dxvsqkifay.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5172
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5272
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3584
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2c8,0x300,0x7ffdb696c188,0x7ffdb696c194,0x7ffdb696c1a0
      4⤵
      PID:4364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,14589240862766543455,359825556140365220,524288 --field-trial-handle=2328,i,1278957701159813692,16587142849877788696,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:11
      4⤵
      System Time Discovery
      PID:3200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1692,i,16093704679554085462,10658054226467139805,262144 --field-trial-handle=2328,i,1278957701159813692,16587142849877788696,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:2
      4⤵
      PID:5540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2496,i,18352083042549021557,4166349646600833612,524288 --field-trial-handle=2328,i,1278957701159813692,16587142849877788696,262144 --variations-seed-version --mojo-platform-channel-handle=2948 /prefetch:13
      4⤵
      PID:4760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3580,i,15265434488007222423,838801369247159695,2097152 --field-trial-handle=2328,i,1278957701159813692,16587142849877788696,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
      4⤵
      PID:2612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3584,i,6684609529710099263,13296584157847587749,2097152 --field-trial-handle=2328,i,1278957701159813692,16587142849877788696,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
      4⤵
      PID:5072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4260,i,5432158688589003937,16791590075533191978,2097152 --field-trial-handle=2328,i,1278957701159813692,16587142849877788696,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:1
      4⤵
      PID:4160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4316,i,8742491288625779932,5378842982701168486,2097152 --field-trial-handle=2328,i,1278957701159813692,16587142849877788696,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:9
      4⤵
      PID:4940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,10982172332962276561,14062246243470773785,524288 --field-trial-handle=2328,i,1278957701159813692,16587142849877788696,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:14
      4⤵
      PID:1108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,1422333878332937559,8348005441788731329,524288 --field-trial-handle=2328,i,1278957701159813692,16587142849877788696,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:14
      4⤵
      PID:3580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,3830425545405865373,4327797175490801720,524288 --field-trial-handle=2328,i,1278957701159813692,16587142849877788696,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:14
      4⤵
      PID:768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,10596136393553962020,15792293413046943356,524288 --field-trial-handle=2328,i,1278957701159813692,16587142849877788696,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:14
      4⤵
      PID:3448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,10596136393553962020,15792293413046943356,524288 --field-trial-handle=2328,i,1278957701159813692,16587142849877788696,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:14
      4⤵
      PID:5492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,12748832853758260686,10207117018841244237,524288 --field-trial-handle=2328,i,1278957701159813692,16587142849877788696,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:14
      4⤵
      PID:2736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6452,i,14271743205615136833,6715829053170656768,524288 --field-trial-handle=2328,i,1278957701159813692,16587142849877788696,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:14
      4⤵
      PID:3188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,11260823835649100063,15182294181129548978,524288 --field-trial-handle=2328,i,1278957701159813692,16587142849877788696,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:14
      4⤵
      PID:4692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,5108704839085669606,9133066744241847031,524288 --field-trial-handle=2328,i,1278957701159813692,16587142849877788696,262144 --variations-seed-version --mojo-platform-channel-handle=4624 /prefetch:14
      4⤵
      PID:1572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,11798087381474219530,4450432177080895769,524288 --field-trial-handle=2328,i,1278957701159813692,16587142849877788696,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:14
      4⤵
      PID:4312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,14111714826505631902,293373926941494908,524288 --field-trial-handle=2328,i,1278957701159813692,16587142849877788696,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:14
      4⤵
      PID:3288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2772,i,17823114734888811661,10660763906548413869,524288 --field-trial-handle=2328,i,1278957701159813692,16587142849877788696,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:14
      4⤵
      PID:4780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5600,i,10249472162537869810,11051755697780293179,524288 --field-trial-handle=2328,i,1278957701159813692,16587142849877788696,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14
      4⤵
      PID:5884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,7733104701487137145,7409363156542137793,524288 --field-trial-handle=2328,i,1278957701159813692,16587142849877788696,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:14
      4⤵
      PID:2512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5548,i,15622894274612733455,2011259160773876972,524288 --field-trial-handle=2328,i,1278957701159813692,16587142849877788696,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:14
      4⤵
      PID:1120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5476,i,17895125522377258646,11116265763256654219,262144 --field-trial-handle=2328,i,1278957701159813692,16587142849877788696,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:10
      4⤵
      PID:4116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2756,i,2417163086089911313,2389421791603486758,524288 --field-trial-handle=2328,i,1278957701159813692,16587142849877788696,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:14
      4⤵
      PID:6108

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5000

C:\Temp\oigaysqligaytqoi.sys
C:\Temp\oigaysqligaytqoi.sys
1⤵
- Executes dropped EXE
PID:4012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4916

C:\Temp\nlfdxvtnlf.sys
C:\Temp\nlfdxvtnlf.sys
1⤵
- Executes dropped EXE
PID:1000

C:\Temp\tnlfdxvpnl.sys
C:\Temp\tnlfdxvpnl.sys
1⤵
- Executes dropped EXE
PID:2044

C:\Temp\icauspkica.sys
C:\Temp\icauspkica.sys
1⤵
- Executes dropped EXE
PID:4920

C:\Temp\kecwupmhec.sys
C:\Temp\kecwupmhec.sys
1⤵
- Executes dropped EXE
PID:4212

C:\Temp\xuomkhbzwr.sys
C:\Temp\xuomkhbzwr.sys
1⤵
- Executes dropped EXE
PID:3716

C:\Temp\ebwuomgezw.sys
C:\Temp\ebwuomgezw.sys
1⤵
- Executes dropped EXE
PID:1120

C:\Temp\gebwuoljge.sys
C:\Temp\gebwuoljge.sys
1⤵
- Executes dropped EXE
PID:5960

C:\Temp\ljdbywtolg.sys
C:\Temp\ljdbywtolg.sys
1⤵
- Executes dropped EXE
PID:3600

C:\Temp\vtnlgdyvqn.sys
C:\Temp\vtnlgdyvqn.sys
1⤵
- Executes dropped EXE
PID:5288

C:\Temp\qnigaysqki.sys
C:\Temp\qnigaysqki.sys
1⤵
- Executes dropped EXE
PID:4452

C:\Temp\fcausnkfda.sys
C:\Temp\fcausnkfda.sys
1⤵
PID:5004

C:\Temp\fcauspnhfz.sys
C:\Temp\fcauspnhfz.sys
1⤵
PID:1108

C:\Temp\ecxupmhfzx.sys
C:\Temp\ecxupmhfzx.sys
1⤵
PID:1028

C:\Temp\mkebzxupmh.sys
C:\Temp\mkebzxupmh.sys
1⤵
PID:4980

C:\Temp\ljhbzwrojh.sys
C:\Temp\ljhbzwrojh.sys
1⤵
PID:2556

C:\Temp\ebwtomgeyw.sys
C:\Temp\ebwtomgeyw.sys
1⤵
PID:1836

C:\Temp\dbvtqdaywq.sys
C:\Temp\dbvtqdaywq.sys
1⤵
PID:5404

C:\Temp\igayvqoiga.sys
C:\Temp\igayvqoiga.sys
1⤵
PID:3260

C:\Temp\davsqkifax.sys
C:\Temp\davsqkifax.sys
1⤵
PID:4648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

fcausmkfcx.exe

Path C:\Temp\fcausmkfcx.exe
Size 384KB
SHA256 b9faefd41fdad06994629b5f84bf711f5ce0b1f540c608969c58105eab5a5bd9
MD5 a035cf3032085de44d1e2be1b348af8a
SHA1 57df9ba645d9f39a5c1c75f8182b66d160da3c6a
SHA512 1736c9663403bdb376dc0baa51c6caee302ab6d7c43600e061bd7d00b590f6a32d209daf0caba7005b7e8d137e14946183b2024454da4f30189264ec43499591
SSDEEP 3072:s9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:2ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C2847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fcausnkfdx.exe

Path C:\Temp\fcausnkfdx.exe
Size 384KB
SHA256 5604f8816df0f7b985f56186d94227ebaf4d860fc568f145902d0969fab689d3
MD5 349ce7be44317825bfa5887fa206dde2
SHA1 e74365b07ac881a7879f70dd1f7c7bd08291c023
SHA512 7f09fc07a8fc275b3f932dd38ce0fe6bb43f91f48914580466ed0b993123935874145590a7305e77b7b5b1b885b164b99bbb4dccb2612addad5eda0605a9d892
SSDEEP 3072:g9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:yctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A3847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hcwupnhfzx.exe

Path C:\Temp\hcwupnhfzx.exe
Size 384KB
SHA256 d5196db780d859ef53e5f3eea530e08b477af4192eaa3c6514bf744db0a6b424
MD5 1593186645ea85affddfcb0e4a84c8f0
SHA1 26487ebb35bdc04872169c9e1665a6de87a09374
SHA512 3361212daa46ab870a14342dcbbf0410e69ca3cf3cf068532e94cfa34aa5c9572b673ea3b9ee19dfae7043ba2532bd4040c93c4d78caebfebd483d66db12c3fb
SSDEEP 3072:B9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:LctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T10F847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fcausmkfcx.exe

Path C:\Temp\i_fcausmkfcx.exe
Size 384KB
SHA256 21e9a93ff1c1ad7e25e6d0e903d798257a8adb3e8f9f6ee18b9e3768562879fa
MD5 07846ebd8d64eaed6681ddf57479dd23
SHA1 ff596640b118716843c6b78308657fb65451797a
SHA512 afb5dc83b2e862e1eb80c530fb5180b9d522904e16100e8fee8bd9eec95849996b17a439e3270abb1e23f7dfb76e087b06e3412449ecb1ef2ae20cf8e8ff0b80
SSDEEP 3072:d9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:vctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T182847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fcausnkfdx.exe

Path C:\Temp\i_fcausnkfdx.exe
Size 384KB
SHA256 444303646aaa53c058010638d7867c799725dc9923ff089a9ca584acfcf82d9d
MD5 9adbc1767411b922a853b2c2b78b3dc0
SHA1 096c5835af34842a8f6371c4c9285d4a69e87a56
SHA512 dd58dbe50f0b276ef0b88b9d2a52d03f44e4891486820705f18e3e660c9df4bd3c91723ae2a88b24333769a57c42c43e1eea31e008c184d1d4bf585bdb3f2c80
SSDEEP 3072:E9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:ectFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T15E847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hcwupnhfzx.exe

Path C:\Temp\i_hcwupnhfzx.exe
Size 384KB
SHA256 d569879f288552385177087d7ba9793576b4a507f6d36d3dc653d2decd9676b7
MD5 a230c50537edd158836486feb7cff9fc
SHA1 08493ef7617a38b3178e8332e7fdeb1118126684
SHA512 d29ec1f4ae49e485091978a45d72b2590ad7b4453a7df75c217908d22bae042793bf81bb53c335bd470d89f5dfb032eed0e7f86165646f589c33db8a8d3a9456
SSDEEP 3072:g9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:yctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D6847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ifdxvqniga.exe

Path C:\Temp\i_ifdxvqniga.exe
Size 384KB
SHA256 9e12243a2e076935abe8730262a2201b71bbb8fb92720aa40afbe9457181eaee
MD5 91001baa18c9edcecafe9a435c7f6b26
SHA1 0fe15d79e14e26d160a9e5f80ef4cf324f6bbb5a
SHA512 0aa4aa091dce7588334a2dddc5c28c29fad5a8593daa1920c7dace3ba81659634fd76bab177324334a2b91717bd78f0eda5c15a0d4a6014e189d757c5bb90f0c
SSDEEP 3072:W9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:EctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C2847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qolgdyvqol.exe

Path C:\Temp\i_qolgdyvqol.exe
Size 384KB
SHA256 4be97bd935f7116ab9a2f7ca03817118b62ba9509164be7d59e7b36db6e617c0
MD5 1e9c5439356f4cc35ff12b0336309cee
SHA1 5879b25add7ff69d82c8c713634c7aaaf29ebb51
SHA512 f219d7f64feb6c247f36c3de65fce1106d3cc6fd373d9fa0aeabaf81c73a7a3a7eb4929869645d754e388617df1ccce442b68f28d3a2a81a939a749ec6585838
SSDEEP 3072:99ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:PctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T15D847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icauspkica.sys

Path C:\Temp\icauspkica.sys
Size 293KB
SHA256 75af98e553035e7fa03d0dea8ab7f625aea50b86cdb49b8bda3068ea800df344
MD5 9d55b4689b7d73dcd829a42a7328e909
SHA1 e5d2a72d3efe371330faad2cc9dd903bcda75cf8
SHA512 8f249afd7c7a88d612e66d8a1dfee727dd9780dee3b90beb5a2f2255b1da323a757cc729518f9226c2d5c03ab044e5d180ea3f5ed8a6838d33224123a3131c87
SSDEEP 3072:XtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:XIJjiJcbI03GBc3ucY5DCSj
TLSH
T1AE545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ifdxvqniga.exe

Path C:\Temp\ifdxvqniga.exe
Size 384KB
SHA256 16417b81e9c48a1364c11524eb7429061f191345a0b9b2691766eacb11c8a6d0
MD5 e6869c8fcdfb3205e2b872556b8a833c
SHA1 6a8d8a2a70c8cb626a40c680302165bd3df67568
SHA512 0ba698a1d69de8bbdf9613eec1796114273b23fc5c79a20726123e032fb46bd44bad982ad0097c75fd57ad0502c7b539ef5d8ad3a8efb664b09c6656e97df504
SSDEEP 3072:q9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:QctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T14E847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kecwupmhec.sys

Path C:\Temp\kecwupmhec.sys
Size 293KB
SHA256 b80b25cf14b3fcb79f6b1eae3239dfa408aafc90240b5b2d5b03d37f2145cd57
MD5 f14c4601c5ad4a69d0798d64bb500e7b
SHA1 a714deba1e9f5ed5240f7f50c402becff6fc6209
SHA512 7f6f72ce3bcb0d40008ecf24bbc518da25412e3aaa87d5c86212c4516f2eb138ce6f1e28586c31cc2241e65156b31064761cfca89de15271fc8ce1e209c04d2c
SSDEEP 3072:BtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:BIJjiJcbI03GBc3ucY5DCSj
TLSH
T102545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlfdxvtnlf.sys

Path C:\Temp\nlfdxvtnlf.sys
Size 293KB
SHA256 6c90a5bf3b8cd33598472b24047d9f507ce25e2290b859437c1b1e9941b6ae11
MD5 d26753f79d9f6fdfec536720a579ff84
SHA1 60009090d339c6cf1f9eab93116488745ef1b8e5
SHA512 901921848b95d558daa761e1346a641583f4a69d382e28d96af98e5aba90dc047019a43dc0488fe88d219872ab0e34801ece23a5ae9c8f7fa16ef879c57f7686
SSDEEP 3072:NtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:NIJjiJcbI03GBc3ucY5DCSj
TLSH
T17D545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oigaysqligaytqoi.exe

Path C:\Temp\oigaysqligaytqoi.exe
Size 384KB
SHA256 055a62ce80b06ab7d8f95663348b955eb70e4163bf0c5eeea6eb3b8f42102e7a
MD5 8e53e9efad20fb98f0066e5844d01c72
SHA1 1328bb1e71748e2ba5afba6b2a38e80af5fefcd8
SHA512 f26f8e4df74558a632851b06c64b3669638b875d51904dcc98f7070f75b54a0f2300fe219a03f38118a2fcbff4195ec5728d98acdf3d80d6d34b180e40c6fe96
SSDEEP 3072:K9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:wctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1BE847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oigaysqligaytqoi.sys

Path C:\Temp\oigaysqligaytqoi.sys
Size 293KB
SHA256 a4d6261b788b2aab80951ea654776383691ce4154cecf96187deedc502e2d70a
MD5 f05999a86955b6c620ac40245ae8e259
SHA1 2580ebef05d057ca9b0508bd11be643955c058cd
SHA512 4d16431b6599054d40a768d60e404ee72bca393827c25de135d6a99d6f0618d1490249a484343672f289971ad7b1b96e7c44a49ae474674ebbc32de22b8933f8
SSDEEP 3072:ytKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:yIJjiJcbI03GBc3ucY5DCSj
TLSH
T149545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qolgdyvqol.exe

Path C:\Temp\qolgdyvqol.exe
Size 384KB
SHA256 d996d2c7cd483d67cf594fa9b5c678e25e61c7dc5c69ea12acf0f13552628968
MD5 8f1f9c38ed6a2a5a760a93e2047be931
SHA1 a947bccc98cd2e52c6d0c4b12c7bcaab79fbb56f
SHA512 81dabc4e0a544ab83e1d09f71c8c8805aa0357d62116709c5d0a5f6f63cbe0695329b64af59f03fc05a4ae675416589b177fb4eb1ab21ec1ee00942071c85893
SSDEEP 3072:V9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:3ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F6847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnlfdxvpnl.sys

Path C:\Temp\tnlfdxvpnl.sys
Size 293KB
SHA256 f842fee628b5d2eecf656c1cb792a2194b67526d3ed604d0ec771336566fd1e7
MD5 9a4612348fcabab95fc9789027e6e1a8
SHA1 de0d86b5c7dba64c64d8ff69c56098d24696904e
SHA512 4b12006b5d3e7b64fafde7168bd4068b21847fb38a5a6cf02b3c58f85e10f9aa8265bf7b53be7b4082fa9c7b98e86af21caebf361d60d3bf3c85e82859c1a1e1
SSDEEP 3072:PtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:PIJjiJcbI03GBc3ucY5DCSj
TLSH
T17D545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wurpjhbzur.exe

Path C:\Temp\wurpjhbzur.exe
Size 384KB
SHA256 420a984b5b99bc0701795768f2dea5820f7b0b90e1d690445a0498f3f966f9ae
MD5 e2bca1aebddd65694b5cdc0a7e64c469
SHA1 cef2e5c58291a41b59c908350b18150897e15ead
SHA512 ac9ef9a294c01bce486dd122b98ad915679947a0a24bcfc1613d8be3e721e3df54b06e6ea35b098f56edca5d5656140ae4b1c53a0970d45a7cc5a9c11813f8b8
SSDEEP 3072:K9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:wctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T19A847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xuomkhbzwr.sys

Path C:\Temp\xuomkhbzwr.sys
Size 293KB
SHA256 d0ab57db008b51bee001897dcfde46a3f3676dec56aad4ab81fa46cdb554ae69
MD5 50c94a0f2b1e66af17985163a35e8dec
SHA1 198ad0a327c495695424c1f139233e6d34e09a53
SHA512 e763b6b066fc60cca1f5f861019959b01d1c2263a3e0baa5275f89a8bf9ff338b532d8c947292b90ad2c13bc5b1e1078597b934c07faf887b85238f337f28e02
SSDEEP 3072:ptKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:pIJjiJcbI03GBc3ucY5DCSj
TLSH
T131545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0c59160a51f6f3c09faaf3593a45b43a14b1da3961c2cccaed8346e6543c20e0
MD5 a2b289a93fce671046a365170f24567f
SHA1 d545bd953aab467815db42a92fd1d54047d5e6af
SHA512 ce7bb8aa1a40366ad652feb8233f60cd807014cb9e8ca999c2c1931eeb40a4afa1dc2c94c60d58639e2cece8c73d3a46da7a30c651ca6da0834f57b890bd2572
TLSH
T1CFD092653BA04E08C5C4207628E1A6A6A2504A31642E024841A2F23CF8A5ED6073F4AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2d6015222f1312f2737e561f5cb789cba16ddda90131d3af679ca4d112ce8de9
MD5 c1a7f665f2c508cc6aaf2ab720e9bbac
SHA1 f10047340073ccfd0dfa0a1ac50f19824703c6c6
SHA512 3b4b2c7997cc3a8e382662b8ab84779147222db6dcf3b614fe3750efba14aade687800978cd24780f580eacb766daa34fe0e560c30dde1f463983613dda767cb
TLSH
T188D092693B904E08C5C4207228E0A6A6A2604A31B82E024840A2B23CF8A5ED6073F4AA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 191ae31d3f94c4cde335a60f33b6ecbbeeecbb0bb97a59fe605a4b54dda92ffa
MD5 0a70214aaef8456e669654efb68e2f96
SHA1 28789ee801c09dad26afa76aecb01782bd947f9b
SHA512 21f9e70b1726c458fbc83e24ca77c9208be929b92e1e62b8fa5adb5d6ea2c4d099a081d14cdcb4eaf146b5d382e0912983a7084869b77dea4ab360478fdbf576
TLSH
T12051ECA6F7290DC1D7E488B168D0548B32F8849A370F6E38A1145F785A87F9ADBD50E3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59db33.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59db33.TMP
Size 2KB
SHA256 50df0da2adfc853eecaac9ef084242120641e534839a941ac070358f06d619a4
MD5 252d4b1607a6ef9d9141df55c2099814
SHA1 c5759456e2eee55f52398eb7dc16808319b478bf
SHA512 373fed4aa07b08241e78bd10a648e223984f0514d4aa32305862523291b9c9c21f43851932b867097117698e7a127fa231584f691eceb9d89d7f7786b9ca41e0
TLSH
T1C3510EA5F7250DC1D7E488B168D0544B32F88499370F6E38A1141F784A87F9ADBD40E3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 b39cda2c45ef59296fd984e8e968fecec920a828767084b984128a3addc55105
MD5 4b10453509671aa7aa726154ca222b02
SHA1 67038aef06a9a0ea5198791e99368fccb7ad9702
SHA512 f786bcb075d67f6d9dffb74274e4f47dc9b5bb2a32b9c443edbc7ed5ccef7098d16bca883868ed411c7299a83b4fda067f1e207df845bcd9278a3db8f3a39164
TLSH
T174419EF783F4856E8D0196F4AA186E2FCE2D0911432C7D5AC9E4AE2B93F3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 83cda6e76e5d7d643db1c6932a07e7534e9b10a0f75364825cbb341d226a2838
MD5 0dbc05349274db41fae5d93a162cde15
SHA1 b5b9fe23d929b90c1af1cf4cf745bc05c57233e3
SHA512 13784cb13bc43e6566b08e31293e411c53ba05c0258855667addf61378a514a5859d7e2e265b9457f43996927f99beba0044adadd851e3dc28d28854ae34a681
SSDEEP 192:sxR6RnCU/fKswCvdYZzRizoA8p9T/g6+WNCW9/YbkhZ65GFIgVMJ:sxR6EU/fKsZvdm9vt/5B/P6Wa
TLSH
T1D542C8156E28A93B4CC7E719BB15BF53D2F95132A1D51E48FAFC8A1C04EA6DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 ddc1b19faa493d2a030b93aa939a43351f9096f85c3e4033eba329811e62be84
MD5 c53e90e06d17562135e14328ba547760
SHA1 3536c610d94fd21c13d95c1b69c90defbd6dfffe
SHA512 9b62853c5f2f01003830347dee505ab8a0f0a421ed90852bd5ee27b79f13b31d2122250a820eed21ba84949de21b81e6bc7f473d3f0988f5c9f1a13d139fb1e6
SSDEEP 192:sxRZRnCU/fKsYCvdYZzRizoA8p9T/g6+WNCW9/YbkhZ65GFIgDtMJ:sxRZEU/fKsRvdm9vt/5B/P6We
TLSH
T1CF42C8156E28693B4CCBE719BB55BF53D2F85132A1D41E48FAFC8A1C04EA6DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 73bf9d663be5a3f4e2f6a5407a08af528babfc5f2d348aaf928ab80534e2d4e0
MD5 932827667a0fd66329792f5724b8f1e9
SHA1 903b63b35b06a5182a2a01e2e6dfeb59e968eba2
SHA512 8d834f56396c2ceb4f5c972c17fd03f70c55fa5fe8dd2cfbad59749486228d2388bc4c10f48b516878eb8dc6f0a08c01a880492c3d469f72573003a6a0dd22a2
SSDEEP 192:sxRZRnCU/fKsYCUdYZzRizoA8p9T/g6+WNCW9/YbfNZ65GFIgDXMJ:sxRZEU/fKsRUdm9vt/5B/w6W8
TLSH
T16C42C8156E28693B5CC7E719BB55BF53E2F85132A1D51E48FAFC8A1C04EA6CD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 5de142ea64f908c8a4d3cd89a7078581b0d6e21c9f6d4f41f67dd7d6cd2d8a67
MD5 d4ef7f1145c1722c33ea0fb5c8a81a78
SHA1 2912454675f4d3b9dbfa2b8d1b0f7d13919918f5
SHA512 c7a7e78d10a9bb0ed595d4389fd93be86f95adb1a1ca8b0b3643cc38637f28926cc5d1de799481fa9521a6573030fc380203ce30d91413b48aa8c83699f17061
SSDEEP 768:Fb1phD7pLuL7otWgikfq48F1+UoAYDCx9Tuqh0VfUC9xbog/OVJUpJ8I0roSxU:Fb1ph1E7otWgikfq4u1ja+UpyIfl
TLSH
T182D2DA3B640CCB7F4F804ADDEC197A9E6DA802CB96D8CD8047FA951C02C6BFA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 4f61b612075ed7665a57696d957f2e6c52f6711f238441ab6f0e85d34293f905
MD5 12f580361253174f427de409a7633883
SHA1 e4a1fceec84924540d82342843f5e6ceef511715
SHA512 0ff984e7afb284229d016bc8f33df973939f5827c24cb48f7b31ef443ad9b5e6e20fad68ef5af86a97e14e2d18e6e1d8a1540dc9ceb847d71c381ceeed1ef998
SSDEEP 96:KR2r6WwYY+Wo9lg2+K4Lgk+ce2VUGfHfItpfd9xWJmsgRxKD4gKRC+uh+Kqa:C2r6WwYYZo9m22Lgkte2VUGfHfItpfd0
TLSH
T1DC91645434BA42543CBEB71C81BD892AC28134737118E82B3BE9555A1FABE464EFDCCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fc03e8af-de58-41f7-927e-2529980365ee.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\fc03e8af-de58-41f7-927e-2529980365ee.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 e233a127538e5e3a9fae2340375928836439b0a65f5a7fe1c59b965065f48053
MD5 039085edfaa853177bceb9d1dd737657
SHA1 af4247111a8b7c33b44d89e6336fadd28c29f9eb
SHA512 249f1bc1614f0223d21abc9cd50aca35eb9b6a53dc84f148e73e7ad0bc100fa7c62537a8f444ed729444cc7a5b797453317fd948e0bc14fbfec0fc8425f03750
SSDEEP 768:nrv+4UNbdV3KSoKBqobGEDeCtZu4aWADIidy8LuvrAF:nbsbD3KJCtZzaNsuVLE0F
TLSH
T16803AF35F859DE739CBA6684F1873A47BEF8516385C90AD4C8DD1B4E008B5AD130BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 b20141abecab74daccf45f81840c66f080019f094ca06ac21993a96eff813a39
MD5 4e1327b3942f69baf629e70d49300d64
SHA1 1b6062e00aa492d835a8eef6ae2386ee75227abb
SHA512 1c006dbc1d0f6791cdedee0fd0d2ab6f7e798845a1e4800a638a80f9ba24d0b8073879a4229997e8b0dedd84f21a91b02dd7d27ac8aee14edf641d455d07014f
SSDEEP 768:9q3ySwKBqobGEDeNtZu4aWADIidy8Luv4w1PBuQ:9q3yzNtZzaNsuVLEvPBR
TLSH
T194F2AE75FC52DE7788BAA684B187364AAEF89173C5CD0AD488DC1B0F14C75A9131BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 81085ca06a231332345ec7cfe9d69b4117401e03c8a19d9c34c6f4c7efbba6fc
MD5 7458c07ebbb0bc0167e355ce693b9189
SHA1 f06d75c515d3bfb742b0b6a3d2eeae6f5ee625e2
SHA512 0f6250bbfe7f43bb52090129aaf821d0eda56af8c18f5c386dd55e55090397cc54bf6433bb34141f2cd2db2c46a155b8cf41cfac0e7e8de18c4680068370a364
SSDEEP 768:9rv+4UNbdC3oVeBqobGEppZu4aWADIidy8LqteVH1S1C:9bsbw3dpZzaNsuVLmEH1d
TLSH
T1AB03BF36F859CA779CF79684B1877A0B7EF8926386880AD088DC1F4E46DB4AD1307D17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 e968acc4f84c91101baa627b34b9babbb0a8e9c036a082d7d73a4f108a65b485
MD5 10dfbc9c4ec0fbed910db122d4d1ac90
SHA1 a7476f54698dc56176b06cc45c012127be30d42f
SHA512 18bbf8578f4690e26b0844e918c799f9f688357a9f0eed38cc123057dd7a5cff4cec268f292e740b97c716cfedbd82f938ebef6837fcd1893cfa0e364f7f642c
SSDEEP 768:uq3NSwKBqobGEDeNtZu4aWADIidy8Luv4w1PBuQ:uq3NzNtZzaNsuVLEvPBR
TLSH
T1C2F2AE75FC52DE7788BAA684B187364AAEF89173C5CD0AD488EC1B0F14C75A9131BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 0c0a0cd6144d7c09221d9486f83782da3c7a249859165b81058710e01ae0149e
MD5 f33a66d795d0ea938c6e45280d897457
SHA1 7400bfb63e013c79393d5438a9663968cb5ca840
SHA512 a3f660b882e6ccf3c94bea9f0991381c058a0f73836ea8dc9850199e67c892d8ec62699217b8bdb6e33f05b57ef51b507407e6097961c186274a0ff904523736
SSDEEP 768:GFQD3mwguSZh4vEDevtZu4aWADIidy8Luv4w1PBuQ:ND3bfvtZzaNsuVLEvPBR
TLSH
T1411317F5A8D38977D8AE5783A37D2E469DBCC163B5884990BBD80E4DCC861BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 f9def5ce2b302413d0dbdc759c5dba2e7b08f51a6f5f43d0fd0b122e75ce79b9
MD5 456dda0daf1155819fe2eba38a99266f
SHA1 eccce6d421f73a127cc6cbe835fd2cd5b7c88658
SHA512 4cf1bdb42807d9bc99cee9bcf034da79fcf79138807d492ae0b2cb90d07f270b7b6c9165cd1c6abc045048c7eed3808c4c3e3e4c42e360158aafc332734683bf
SSDEEP 768:Wrv+4UNbdC3W+UBqobGEDeKtZu4aWADIidy8LbveVH1S1C:Wbsbw3xKtZzaNsuVLjEH1d
TLSH
T12C03BF36B85ACE735CFB9684B187764B7EF8616389890AD0C8DC1F4E458B49E130BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

0b91510c-9ba1-46e7-a2ef-47b17b0a681f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\0b91510c-9ba1-46e7-a2ef-47b17b0a681f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1264_275231991\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 82eecdbee232f0399bffb3c1e76c9b44da77747796acd749669b5079702414f0
MD5 a88f9be46800b7e7c8d383ca8e34540e
SHA1 418b6c9a606fa44bc2830e672a0a10630f79dc7b
SHA512 7ea9a56ab7feee1edd6527bff8145d0555863ebd1b8457122e755cecfca92174bbb10f05d76da88bdadc04c295b65fd15d223e88e262423eaad88c55f5b7930d
TLSH
T14071008356A9C6F2C19A5FF002835644F2FB2238076330240B91558BAA70E3A58B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1000-186-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1028-414-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1108-409-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1120-313-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1836-450-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2044-235-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2556-445-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3260-475-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3600-332-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3716-288-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4012-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4212-275-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4452-369-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4648-492-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4920-263-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4980-434-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5004-411-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5004-389-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5288-340-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5404-471-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5492-219-0x0000022735000000-0x00000227353BB000-memory.dmp

Download

memory/5492-232-0x0000022735000000-0x00000227353BB000-memory.dmp

Download

memory/5960-317-0x0000000000010000-0x00000000000AB000-memory.dmp

Download