systex | d7f739b7e3cfd58fe48060f0e03a3870a29351dd23d86fa6adab1cfa13b8877b

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 18:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_35fe198c8720e551c8ea5484a6263320_amadey_darkgate_elex_smoke-loader_stop.exe
Size 384KB
Sample260910-wt52ystdnf
SHA256 d7f739b7e3cfd58fe48060f0e03a3870a29351dd23d86fa6adab1cfa13b8877b
MD5 35fe198c8720e551c8ea5484a6263320
SHA1 99144c43ee22e7a6c4e28898e50086142183a9ec
SHA512 541a181150b0cab4f655a5946edaa3728e7fa842841293431b05f45f9f7e1e24c445bf520814b1c48a31580b7af06993eb6e82225bd85caa6b65e5e3421df963
SSDEEP 3072:o9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:qctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T14E847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
4592	ytrljdbvtolgeywq.exe
2464	ytrljdbvtolgeywq.sys
1444	CreateProcess.exe
1692	wlgeywqoig.exe
3136	CreateProcess.exe
1448	CreateProcess.exe
1244	i_wlgeywqoig.exe
2408	gdyvqoljdb.sys
1464	CreateProcess.exe
2512	dbvtnlfdyv.exe
1736	CreateProcess.exe
4316	CreateProcess.exe
624	i_dbvtnlfdyv.exe
4044	qkidavsqki.sys
2696	CreateProcess.exe
6024	igaysnlfdx.exe
6128	CreateProcess.exe
5292	CreateProcess.exe
5820	i_igaysnlfdx.exe
5992	xvpnkfdavs.sys
5904	CreateProcess.exe
5956	xusnhfaxvp.exe
5884	CreateProcess.exe
3012	CreateProcess.exe
5692	i_xusnhfaxvp.exe
6124	faxsqkicau.sys
2688	CreateProcess.exe
5236	smkecusmke.exe
1832	CreateProcess.exe
5288	CreateProcess.exe
1196	i_smkecusmke.exe
1500	pkhcausmke.sys
4860	CreateProcess.exe
4800	pjhczurmke.exe
2344	CreateProcess.exe
252	CreateProcess.exe
2852	i_pjhczurmke.exe
2932	kecwuomhez.sys
5092	CreateProcess.exe
1700	ezwuomhezw.exe
1300	CreateProcess.exe
1960	CreateProcess.exe
2364	i_ezwuomhezw.exe
3492	bzwromjdbz.sys
4908	CreateProcess.exe
3824	gbztrljdbz.exe
5012	CreateProcess.exe
5692	CreateProcess.exe
2192	i_gbztrljdbz.exe
624	wqojgbytrl.sys
1952	CreateProcess.exe
908	gaytqoigby.exe
760	CreateProcess.exe
2812	CreateProcess.exe
2264	i_gaytqoigby.exe
756	gbytrligay.sys
1476	CreateProcess.exe
4148	dywqoigayt.exe
2312	CreateProcess.exe
3140	CreateProcess.exe
1740	i_dywqoigayt.exe
1212	gaxvqnigay.sys
2200	CreateProcess.exe
4568	dxvtnlfdyv.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1760_333308474\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1760_719854014\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1760_1756363301\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1760_1591074585\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1760_333308474\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1760_719854014\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1760_1756363301\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1760_1756363301\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1760_1756363301\office_endpoints_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ytrljdbvtolgeywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wlgeywqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igaysnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezwuomhezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqkicavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gaytqoigby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dywqoigayt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzwurpjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzwurpjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnljdbywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnljdbywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkecusmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhczurmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbztrljdbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dxvtnlfdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pkicausmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgeywqoigb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvtnlfdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xusnhfaxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dywqoigayt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqkicavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgeywqoigb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlfdxvqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wlgeywqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igaysnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smkecusmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaytqoigby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pkicausmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebztrpjebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhczurmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbztrljdbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxvtnlfdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebztrpjebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqlidays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-10_35fe198c8720e551c8ea5484a6263320_amadey_darkgate_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecxupnhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecxupnhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvtnlfdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xusnhfaxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezwuomhezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqlidays.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2988	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3556	ipconfig.exe
1792	ipconfig.exe
5664	ipconfig.exe
4372	ipconfig.exe
3488	ipconfig.exe
3864	ipconfig.exe
260	ipconfig.exe
4292	ipconfig.exe
2644	ipconfig.exe
3084	ipconfig.exe
2708	ipconfig.exe
1936	ipconfig.exe
4776	ipconfig.exe
2200	ipconfig.exe
5252	ipconfig.exe
2520	ipconfig.exe
3084	ipconfig.exe
3120	ipconfig.exe
1620	ipconfig.exe
2796	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335376390678374"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{EE6D98CA-ADAB-403C-81C4-FDBE70BCB994}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
552	2026-09-10_35fe198c8720e551c8ea5484a6263320_amadey_darkgate_elex_smoke-loader_stop.exe
552	2026-09-10_35fe198c8720e551c8ea5484a6263320_amadey_darkgate_elex_smoke-loader_stop.exe
552	2026-09-10_35fe198c8720e551c8ea5484a6263320_amadey_darkgate_elex_smoke-loader_stop.exe
552	2026-09-10_35fe198c8720e551c8ea5484a6263320_amadey_darkgate_elex_smoke-loader_stop.exe
552	2026-09-10_35fe198c8720e551c8ea5484a6263320_amadey_darkgate_elex_smoke-loader_stop.exe
552	2026-09-10_35fe198c8720e551c8ea5484a6263320_amadey_darkgate_elex_smoke-loader_stop.exe
552	2026-09-10_35fe198c8720e551c8ea5484a6263320_amadey_darkgate_elex_smoke-loader_stop.exe
552	2026-09-10_35fe198c8720e551c8ea5484a6263320_amadey_darkgate_elex_smoke-loader_stop.exe
552	2026-09-10_35fe198c8720e551c8ea5484a6263320_amadey_darkgate_elex_smoke-loader_stop.exe
552	2026-09-10_35fe198c8720e551c8ea5484a6263320_amadey_darkgate_elex_smoke-loader_stop.exe
552	2026-09-10_35fe198c8720e551c8ea5484a6263320_amadey_darkgate_elex_smoke-loader_stop.exe
552	2026-09-10_35fe198c8720e551c8ea5484a6263320_amadey_darkgate_elex_smoke-loader_stop.exe
552	2026-09-10_35fe198c8720e551c8ea5484a6263320_amadey_darkgate_elex_smoke-loader_stop.exe
552	2026-09-10_35fe198c8720e551c8ea5484a6263320_amadey_darkgate_elex_smoke-loader_stop.exe
552	2026-09-10_35fe198c8720e551c8ea5484a6263320_amadey_darkgate_elex_smoke-loader_stop.exe
552	2026-09-10_35fe198c8720e551c8ea5484a6263320_amadey_darkgate_elex_smoke-loader_stop.exe
552	2026-09-10_35fe198c8720e551c8ea5484a6263320_amadey_darkgate_elex_smoke-loader_stop.exe
552	2026-09-10_35fe198c8720e551c8ea5484a6263320_amadey_darkgate_elex_smoke-loader_stop.exe
552	2026-09-10_35fe198c8720e551c8ea5484a6263320_amadey_darkgate_elex_smoke-loader_stop.exe
552	2026-09-10_35fe198c8720e551c8ea5484a6263320_amadey_darkgate_elex_smoke-loader_stop.exe
552	2026-09-10_35fe198c8720e551c8ea5484a6263320_amadey_darkgate_elex_smoke-loader_stop.exe
552	2026-09-10_35fe198c8720e551c8ea5484a6263320_amadey_darkgate_elex_smoke-loader_stop.exe
552	2026-09-10_35fe198c8720e551c8ea5484a6263320_amadey_darkgate_elex_smoke-loader_stop.exe
552	2026-09-10_35fe198c8720e551c8ea5484a6263320_amadey_darkgate_elex_smoke-loader_stop.exe
552	2026-09-10_35fe198c8720e551c8ea5484a6263320_amadey_darkgate_elex_smoke-loader_stop.exe
552	2026-09-10_35fe198c8720e551c8ea5484a6263320_amadey_darkgate_elex_smoke-loader_stop.exe
552	2026-09-10_35fe198c8720e551c8ea5484a6263320_amadey_darkgate_elex_smoke-loader_stop.exe
552	2026-09-10_35fe198c8720e551c8ea5484a6263320_amadey_darkgate_elex_smoke-loader_stop.exe
552	2026-09-10_35fe198c8720e551c8ea5484a6263320_amadey_darkgate_elex_smoke-loader_stop.exe
552	2026-09-10_35fe198c8720e551c8ea5484a6263320_amadey_darkgate_elex_smoke-loader_stop.exe
552	2026-09-10_35fe198c8720e551c8ea5484a6263320_amadey_darkgate_elex_smoke-loader_stop.exe
552	2026-09-10_35fe198c8720e551c8ea5484a6263320_amadey_darkgate_elex_smoke-loader_stop.exe
552	2026-09-10_35fe198c8720e551c8ea5484a6263320_amadey_darkgate_elex_smoke-loader_stop.exe
552	2026-09-10_35fe198c8720e551c8ea5484a6263320_amadey_darkgate_elex_smoke-loader_stop.exe
552	2026-09-10_35fe198c8720e551c8ea5484a6263320_amadey_darkgate_elex_smoke-loader_stop.exe
552	2026-09-10_35fe198c8720e551c8ea5484a6263320_amadey_darkgate_elex_smoke-loader_stop.exe
552	2026-09-10_35fe198c8720e551c8ea5484a6263320_amadey_darkgate_elex_smoke-loader_stop.exe
552	2026-09-10_35fe198c8720e551c8ea5484a6263320_amadey_darkgate_elex_smoke-loader_stop.exe
552	2026-09-10_35fe198c8720e551c8ea5484a6263320_amadey_darkgate_elex_smoke-loader_stop.exe
552	2026-09-10_35fe198c8720e551c8ea5484a6263320_amadey_darkgate_elex_smoke-loader_stop.exe
552	2026-09-10_35fe198c8720e551c8ea5484a6263320_amadey_darkgate_elex_smoke-loader_stop.exe
552	2026-09-10_35fe198c8720e551c8ea5484a6263320_amadey_darkgate_elex_smoke-loader_stop.exe
552	2026-09-10_35fe198c8720e551c8ea5484a6263320_amadey_darkgate_elex_smoke-loader_stop.exe
552	2026-09-10_35fe198c8720e551c8ea5484a6263320_amadey_darkgate_elex_smoke-loader_stop.exe
552	2026-09-10_35fe198c8720e551c8ea5484a6263320_amadey_darkgate_elex_smoke-loader_stop.exe
552	2026-09-10_35fe198c8720e551c8ea5484a6263320_amadey_darkgate_elex_smoke-loader_stop.exe
552	2026-09-10_35fe198c8720e551c8ea5484a6263320_amadey_darkgate_elex_smoke-loader_stop.exe
552	2026-09-10_35fe198c8720e551c8ea5484a6263320_amadey_darkgate_elex_smoke-loader_stop.exe
552	2026-09-10_35fe198c8720e551c8ea5484a6263320_amadey_darkgate_elex_smoke-loader_stop.exe
552	2026-09-10_35fe198c8720e551c8ea5484a6263320_amadey_darkgate_elex_smoke-loader_stop.exe
552	2026-09-10_35fe198c8720e551c8ea5484a6263320_amadey_darkgate_elex_smoke-loader_stop.exe
552	2026-09-10_35fe198c8720e551c8ea5484a6263320_amadey_darkgate_elex_smoke-loader_stop.exe
552	2026-09-10_35fe198c8720e551c8ea5484a6263320_amadey_darkgate_elex_smoke-loader_stop.exe
552	2026-09-10_35fe198c8720e551c8ea5484a6263320_amadey_darkgate_elex_smoke-loader_stop.exe
552	2026-09-10_35fe198c8720e551c8ea5484a6263320_amadey_darkgate_elex_smoke-loader_stop.exe
552	2026-09-10_35fe198c8720e551c8ea5484a6263320_amadey_darkgate_elex_smoke-loader_stop.exe
4592	ytrljdbvtolgeywq.exe
4592	ytrljdbvtolgeywq.exe
4592	ytrljdbvtolgeywq.exe
4592	ytrljdbvtolgeywq.exe
4592	ytrljdbvtolgeywq.exe
4592	ytrljdbvtolgeywq.exe
4592	ytrljdbvtolgeywq.exe
4592	ytrljdbvtolgeywq.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe
1760	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	1244	i_wlgeywqoig.exe
Token: SeDebugPrivilege	624	i_dbvtnlfdyv.exe
Token: SeDebugPrivilege	5820	i_igaysnlfdx.exe
Token: SeDebugPrivilege	5692	i_xusnhfaxvp.exe
Token: SeDebugPrivilege	1196	i_smkecusmke.exe
Token: SeDebugPrivilege	2852	i_pjhczurmke.exe
Token: SeDebugPrivilege	2364	i_ezwuomhezw.exe
Token: SeDebugPrivilege	2192	i_gbztrljdbz.exe
Token: SeDebugPrivilege	2264	i_gaytqoigby.exe
Token: SeDebugPrivilege	1740	i_dywqoigayt.exe
Token: SeDebugPrivilege	3684	i_dxvtnlfdyv.exe
Token: SeDebugPrivilege	800	i_aysqkicavs.exe
Token: SeDebugPrivilege	924	i_pkicausmke.exe
Token: SeDebugPrivilege	1904	i_ecxupnhfzx.exe
Token: SeDebugPrivilege	1180	i_fzwurpjhbz.exe
Token: SeDebugPrivilege	5668	i_ebztrpjebw.exe
Token: SeDebugPrivilege	2064	i_jgeywqoigb.exe
Token: SeDebugPrivilege	5572	i_tnljdbywqo.exe
Token: SeDebugPrivilege	3560	i_aysqlidays.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1760	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 552 wrote to memory of 4592	552	2026-09-10_35fe198c8720e551c8ea5484a6263320_amadey_darkgate_elex_smoke-loader_stop.exe	89
PID 552 wrote to memory of 2660	552	2026-09-10_35fe198c8720e551c8ea5484a6263320_amadey_darkgate_elex_smoke-loader_stop.exe	90
PID 2660 wrote to memory of 1760	2660	iexplore.exe	91
PID 1760 wrote to memory of 4916	1760	msedge.exe	92
PID 1760 wrote to memory of 2428	1760	msedge.exe	93
PID 1760 wrote to memory of 2988	1760	msedge.exe	94
PID 1760 wrote to memory of 2428	1760	msedge.exe	93
PID 1760 wrote to memory of 2428	1760	msedge.exe	93
PID 1760 wrote to memory of 4956	1760	msedge.exe	95
PID 1760 wrote to memory of 4956	1760	msedge.exe	95
PID 1760 wrote to memory of 1404	1760	msedge.exe	96
PID 1760 wrote to memory of 4652	1760	msedge.exe	97
PID 1760 wrote to memory of 1404	1760	msedge.exe	96
PID 1760 wrote to memory of 1404	1760	msedge.exe	96
PID 1760 wrote to memory of 4652	1760	msedge.exe	97
PID 1760 wrote to memory of 4652	1760	msedge.exe	97
PID 1760 wrote to memory of 2612	1760	msedge.exe	99
PID 1760 wrote to memory of 5560	1760	msedge.exe	100
PID 1760 wrote to memory of 2612	1760	msedge.exe	99
PID 1760 wrote to memory of 2612	1760	msedge.exe	99
PID 1760 wrote to memory of 5560	1760	msedge.exe	100
PID 1760 wrote to memory of 5560	1760	msedge.exe	100
PID 1760 wrote to memory of 5824	1760	msedge.exe	104
PID 1760 wrote to memory of 5824	1760	msedge.exe	104
PID 1760 wrote to memory of 1276	1760	msedge.exe	105
PID 1760 wrote to memory of 1276	1760	msedge.exe	105
PID 1760 wrote to memory of 2708	1760	msedge.exe	106
PID 1760 wrote to memory of 2708	1760	msedge.exe	106
PID 1760 wrote to memory of 716	1760	msedge.exe	108
PID 4592 wrote to memory of 1444	4592	ytrljdbvtolgeywq.exe	109
PID 1692 wrote to memory of 3136	1692	wlgeywqoig.exe	112
PID 1760 wrote to memory of 1144	1760	msedge.exe	115
PID 1760 wrote to memory of 1144	1760	msedge.exe	115
PID 1760 wrote to memory of 3172	1760	msedge.exe	116
PID 1760 wrote to memory of 3172	1760	msedge.exe	116
PID 4592 wrote to memory of 1448	4592	ytrljdbvtolgeywq.exe	119
PID 4592 wrote to memory of 1464	4592	ytrljdbvtolgeywq.exe	123
PID 2512 wrote to memory of 1736	2512	dbvtnlfdyv.exe	125
PID 4592 wrote to memory of 4316	4592	ytrljdbvtolgeywq.exe	128
PID 4592 wrote to memory of 2696	4592	ytrljdbvtolgeywq.exe	132
PID 6024 wrote to memory of 6128	6024	igaysnlfdx.exe	134
PID 4592 wrote to memory of 5292	4592	ytrljdbvtolgeywq.exe	137
PID 4592 wrote to memory of 5904	4592	ytrljdbvtolgeywq.exe	142
PID 5956 wrote to memory of 5884	5956	xusnhfaxvp.exe	144
PID 4592 wrote to memory of 3012	4592	ytrljdbvtolgeywq.exe	147
PID 1760 wrote to memory of 3504	1760	msedge.exe	149
PID 1760 wrote to memory of 4908	1760	msedge.exe	150
PID 1760 wrote to memory of 3116	1760	msedge.exe	151
PID 4592 wrote to memory of 2688	4592	ytrljdbvtolgeywq.exe	154
PID 5236 wrote to memory of 1832	5236	smkecusmke.exe	156
PID 4592 wrote to memory of 5288	4592	ytrljdbvtolgeywq.exe	159
PID 4592 wrote to memory of 4860	4592	ytrljdbvtolgeywq.exe	163
PID 4800 wrote to memory of 2344	4800	pjhczurmke.exe	165
PID 4592 wrote to memory of 252	4592	ytrljdbvtolgeywq.exe	168
PID 4592 wrote to memory of 5092	4592	ytrljdbvtolgeywq.exe	172
PID 1700 wrote to memory of 1300	1700	ezwuomhezw.exe	174
PID 4592 wrote to memory of 1960	4592	ytrljdbvtolgeywq.exe	177
PID 4592 wrote to memory of 4908	4592	ytrljdbvtolgeywq.exe	181
PID 3824 wrote to memory of 5012	3824	gbztrljdbz.exe	183
PID 4592 wrote to memory of 5692	4592	ytrljdbvtolgeywq.exe	186
PID 1760 wrote to memory of 1120	1760	msedge.exe	188
PID 1760 wrote to memory of 1120	1760	msedge.exe	188
PID 4592 wrote to memory of 1952	4592	ytrljdbvtolgeywq.exe	194
PID 908 wrote to memory of 760	908	gaytqoigby.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-09-10_35fe198c8720e551c8ea5484a6263320_amadey_darkgate_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_35fe198c8720e551c8ea5484a6263320_amadey_darkgate_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:552
- C:\Temp\ytrljdbvtolgeywq.exe
  C:\Temp\ytrljdbvtolgeywq.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4592
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wlgeywqoig.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1444
  - - C:\Temp\wlgeywqoig.exe
      C:\Temp\wlgeywqoig.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1692
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3136
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3488
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wlgeywqoig.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1448
  - - C:\Temp\i_wlgeywqoig.exe
      C:\Temp\i_wlgeywqoig.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1244
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbvtnlfdyv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1464
  - - C:\Temp\dbvtnlfdyv.exe
      C:\Temp\dbvtnlfdyv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2512
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1736
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3864
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbvtnlfdyv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4316
  - - C:\Temp\i_dbvtnlfdyv.exe
      C:\Temp\i_dbvtnlfdyv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:624
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\igaysnlfdx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2696
  - - C:\Temp\igaysnlfdx.exe
      C:\Temp\igaysnlfdx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6024
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6128
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2708
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_igaysnlfdx.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5292
  - - C:\Temp\i_igaysnlfdx.exe
      C:\Temp\i_igaysnlfdx.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5820
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xusnhfaxvp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5904
  - - C:\Temp\xusnhfaxvp.exe
      C:\Temp\xusnhfaxvp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5956
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5884
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1936
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xusnhfaxvp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3012
  - - C:\Temp\i_xusnhfaxvp.exe
      C:\Temp\i_xusnhfaxvp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5692
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\smkecusmke.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2688
  - - C:\Temp\smkecusmke.exe
      C:\Temp\smkecusmke.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5236
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1832
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2520
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_smkecusmke.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5288
  - - C:\Temp\i_smkecusmke.exe
      C:\Temp\i_smkecusmke.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1196
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pjhczurmke.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4860
  - - C:\Temp\pjhczurmke.exe
      C:\Temp\pjhczurmke.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4800
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2344
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4776
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pjhczurmke.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:252
  - - C:\Temp\i_pjhczurmke.exe
      C:\Temp\i_pjhczurmke.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2852
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ezwuomhezw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5092
  - - C:\Temp\ezwuomhezw.exe
      C:\Temp\ezwuomhezw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1700
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1300
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:260
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ezwuomhezw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1960
  - - C:\Temp\i_ezwuomhezw.exe
      C:\Temp\i_ezwuomhezw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2364
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gbztrljdbz.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4908
  - - C:\Temp\gbztrljdbz.exe
      C:\Temp\gbztrljdbz.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3824
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5012
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2200
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gbztrljdbz.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5692
  - - C:\Temp\i_gbztrljdbz.exe
      C:\Temp\i_gbztrljdbz.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2192
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gaytqoigby.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1952
  - - C:\Temp\gaytqoigby.exe
      C:\Temp\gaytqoigby.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:908
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:760
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3084
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gaytqoigby.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2812
  - - C:\Temp\i_gaytqoigby.exe
      C:\Temp\i_gaytqoigby.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2264
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dywqoigayt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1476
  - - C:\Temp\dywqoigayt.exe
      C:\Temp\dywqoigayt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4148
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2312
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4292
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dywqoigayt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3140
  - - C:\Temp\i_dywqoigayt.exe
      C:\Temp\i_dywqoigayt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1740
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dxvtnlfdyv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2200
  - - C:\Temp\dxvtnlfdyv.exe
      C:\Temp\dxvtnlfdyv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4568
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2636
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3120
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dxvtnlfdyv.exe ups_ins
    3⤵
    PID:4892
  - - C:\Temp\i_dxvtnlfdyv.exe
      C:\Temp\i_dxvtnlfdyv.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3684
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\aysqkicavs.exe ups_run
    3⤵
    PID:5404
  - - C:\Temp\aysqkicavs.exe
      C:\Temp\aysqkicavs.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5988
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5660
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5664
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_aysqkicavs.exe ups_ins
    3⤵
    PID:756
  - - C:\Temp\i_aysqkicavs.exe
      C:\Temp\i_aysqkicavs.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:800
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pkicausmke.exe ups_run
    3⤵
    PID:4120
  - - C:\Temp\pkicausmke.exe
      C:\Temp\pkicausmke.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6140
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4392
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4372
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pkicausmke.exe ups_ins
    3⤵
    PID:1764
  - - C:\Temp\i_pkicausmke.exe
      C:\Temp\i_pkicausmke.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:924
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ecxupnhfzx.exe ups_run
    3⤵
    PID:4572
  - - C:\Temp\ecxupnhfzx.exe
      C:\Temp\ecxupnhfzx.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2136
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4500
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2644
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ecxupnhfzx.exe ups_ins
    3⤵
    PID:2400
  - - C:\Temp\i_ecxupnhfzx.exe
      C:\Temp\i_ecxupnhfzx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1904
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fzwurpjhbz.exe ups_run
    3⤵
    PID:3868
  - - C:\Temp\fzwurpjhbz.exe
      C:\Temp\fzwurpjhbz.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4656
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4528
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3084
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fzwurpjhbz.exe ups_ins
    3⤵
    PID:3236
  - - C:\Temp\i_fzwurpjhbz.exe
      C:\Temp\i_fzwurpjhbz.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1180
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ebztrpjebw.exe ups_run
    3⤵
    PID:3644
  - - C:\Temp\ebztrpjebw.exe
      C:\Temp\ebztrpjebw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4328
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5296
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5252
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ebztrpjebw.exe ups_ins
    3⤵
    PID:5316
  - - C:\Temp\i_ebztrpjebw.exe
      C:\Temp\i_ebztrpjebw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5668
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jgeywqoigb.exe ups_run
    3⤵
    PID:3448
  - - C:\Temp\jgeywqoigb.exe
      C:\Temp\jgeywqoigb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5740
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2024
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1620
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jgeywqoigb.exe ups_ins
    3⤵
    PID:2720
  - - C:\Temp\i_jgeywqoigb.exe
      C:\Temp\i_jgeywqoigb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2064
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tnljdbywqo.exe ups_run
    3⤵
    PID:2056
  - - C:\Temp\tnljdbywqo.exe
      C:\Temp\tnljdbywqo.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4984
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3076
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2796
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tnljdbywqo.exe ups_ins
    3⤵
    PID:4796
  - - C:\Temp\i_tnljdbywqo.exe
      C:\Temp\i_tnljdbywqo.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5572
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\aysqlidays.exe ups_run
    3⤵
    PID:4604
  - - C:\Temp\aysqlidays.exe
      C:\Temp\aysqlidays.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2260
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5420
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3556
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_aysqlidays.exe ups_ins
    3⤵
    PID:1200
  - - C:\Temp\i_aysqlidays.exe
      C:\Temp\i_aysqlidays.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3560
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtnlfdxvqn.exe ups_run
    3⤵
    PID:4996
  - - C:\Temp\vtnlfdxvqn.exe
      C:\Temp\vtnlfdxvqn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6112
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3740
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1792
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffdcc21c188,0x7ffdcc21c194,0x7ffdcc21c1a0
      4⤵
      PID:4916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,8417221523291815206,4597214520919803363,262144 --field-trial-handle=2204,i,6150617433582622847,12588149393228333894,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:2
      4⤵
      PID:2428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,90927318377180075,12172093908680252966,524288 --field-trial-handle=2204,i,6150617433582622847,12588149393228333894,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:11
      4⤵
      System Time Discovery
      PID:2988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2396,i,14421919551875394481,13639010135624246161,524288 --field-trial-handle=2204,i,6150617433582622847,12588149393228333894,262144 --variations-seed-version --mojo-platform-channel-handle=3248 /prefetch:13
      4⤵
      PID:4956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3536,i,16205529422985875186,7334262532582211185,2097152 --field-trial-handle=2204,i,6150617433582622847,12588149393228333894,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
      4⤵
      PID:1404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3544,i,16054919483975252401,230562396833962909,2097152 --field-trial-handle=2204,i,6150617433582622847,12588149393228333894,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
      4⤵
      PID:4652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,10945653417591838805,11753673137683244159,2097152 --field-trial-handle=2204,i,6150617433582622847,12588149393228333894,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:1
      4⤵
      PID:2612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,4324897456147113814,1212003452118418047,2097152 --field-trial-handle=2204,i,6150617433582622847,12588149393228333894,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:9
      4⤵
      PID:5560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3732,i,13739326708950232801,6105355363835890783,524288 --field-trial-handle=2204,i,6150617433582622847,12588149393228333894,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:14
      4⤵
      PID:5824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3744,i,801888802423253648,4993024119000666162,524288 --field-trial-handle=2204,i,6150617433582622847,12588149393228333894,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
      4⤵
      PID:1276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,15039607435469036941,16516367614981097571,524288 --field-trial-handle=2204,i,6150617433582622847,12588149393228333894,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:14
      4⤵
      PID:2708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,16662480712184845440,3321093785049362751,524288 --field-trial-handle=2204,i,6150617433582622847,12588149393228333894,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:14
      4⤵
      PID:2192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,16662480712184845440,3321093785049362751,524288 --field-trial-handle=2204,i,6150617433582622847,12588149393228333894,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:14
      4⤵
      PID:716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,11094325242559299575,13654520448729338875,524288 --field-trial-handle=2204,i,6150617433582622847,12588149393228333894,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:14
      4⤵
      PID:1144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3224,i,3263917504592590567,16911421525915279305,524288 --field-trial-handle=2204,i,6150617433582622847,12588149393228333894,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:14
      4⤵
      PID:3172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4956,i,8450107629435803079,9417637072307286653,524288 --field-trial-handle=2204,i,6150617433582622847,12588149393228333894,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:14
      4⤵
      PID:3504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,2785185252669523142,4998610348813377887,524288 --field-trial-handle=2204,i,6150617433582622847,12588149393228333894,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:14
      4⤵
      PID:4908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,8115967426393108745,10097813110022870253,524288 --field-trial-handle=2204,i,6150617433582622847,12588149393228333894,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:14
      4⤵
      PID:3116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3524,i,1756416037732638161,6694288359787398328,524288 --field-trial-handle=2204,i,6150617433582622847,12588149393228333894,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:14
      4⤵
      PID:1120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=744,i,16242253227490136575,15891042396667197291,524288 --field-trial-handle=2204,i,6150617433582622847,12588149393228333894,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:14
      4⤵
      PID:4372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,5035611628196954293,13838344426020976732,524288 --field-trial-handle=2204,i,6150617433582622847,12588149393228333894,262144 --variations-seed-version --mojo-platform-channel-handle=924 /prefetch:14
      4⤵
      PID:5284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5696,i,3355064717435501883,986951203898439508,524288 --field-trial-handle=2204,i,6150617433582622847,12588149393228333894,262144 --variations-seed-version --mojo-platform-channel-handle=6888 /prefetch:14
      4⤵
      PID:4792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4920,i,14678466309606791518,18099740836656632389,262144 --field-trial-handle=2204,i,6150617433582622847,12588149393228333894,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:10
      4⤵
      PID:6112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6516,i,10408503432881935138,2679021936256896280,524288 --field-trial-handle=2204,i,6150617433582622847,12588149393228333894,262144 --variations-seed-version --mojo-platform-channel-handle=3840 /prefetch:14
      4⤵
      PID:5608

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2952

C:\Temp\ytrljdbvtolgeywq.sys
C:\Temp\ytrljdbvtolgeywq.sys
1⤵
- Executes dropped EXE
PID:2464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1476

C:\Temp\gdyvqoljdb.sys
C:\Temp\gdyvqoljdb.sys
1⤵
- Executes dropped EXE
PID:2408

C:\Temp\qkidavsqki.sys
C:\Temp\qkidavsqki.sys
1⤵
- Executes dropped EXE
PID:4044

C:\Temp\xvpnkfdavs.sys
C:\Temp\xvpnkfdavs.sys
1⤵
- Executes dropped EXE
PID:5992

C:\Temp\faxsqkicau.sys
C:\Temp\faxsqkicau.sys
1⤵
- Executes dropped EXE
PID:6124

C:\Temp\pkhcausmke.sys
C:\Temp\pkhcausmke.sys
1⤵
- Executes dropped EXE
PID:1500

C:\Temp\kecwuomhez.sys
C:\Temp\kecwuomhez.sys
1⤵
- Executes dropped EXE
PID:2932

C:\Temp\bzwromjdbz.sys
C:\Temp\bzwromjdbz.sys
1⤵
- Executes dropped EXE
PID:3492

C:\Temp\wqojgbytrl.sys
C:\Temp\wqojgbytrl.sys
1⤵
- Executes dropped EXE
PID:624

C:\Temp\gbytrligay.sys
C:\Temp\gbytrligay.sys
1⤵
- Executes dropped EXE
PID:756

C:\Temp\gaxvqnigay.sys
C:\Temp\gaxvqnigay.sys
1⤵
- Executes dropped EXE
PID:1212

C:\Temp\dxvpnifaxv.sys
C:\Temp\dxvpnifaxv.sys
1⤵
PID:5684

C:\Temp\ausnkicaus.sys
C:\Temp\ausnkicaus.sys
1⤵
PID:864

C:\Temp\hcausmkfcx.sys
C:\Temp\hcausmkfcx.sys
1⤵
PID:2868

C:\Temp\fzxrpmkecz.sys
C:\Temp\fzxrpmkecz.sys
1⤵
PID:5076

C:\Temp\eywuomgezw.sys
C:\Temp\eywuomgezw.sys
1⤵
PID:5036

C:\Temp\rojhbztrlj.sys
C:\Temp\rojhbztrlj.sys
1⤵
PID:616

C:\Temp\toljdbytqo.sys
C:\Temp\toljdbytqo.sys
1⤵
PID:560

C:\Temp\bysqlidbvt.sys
C:\Temp\bysqlidbvt.sys
1⤵
PID:4308

C:\Temp\idbvtnlfvs.sys
C:\Temp\idbvtnlfvs.sys
1⤵
PID:3776

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dbvtnlfdyv.exe

Path C:\Temp\dbvtnlfdyv.exe
Size 384KB
SHA256 6ea328c1e502b8b1b3e60b9f801a6b786101a669799fe18f06a2c210b9374262
MD5 cad628f0a988f3f883a55d32eeedc6ee
SHA1 4378188a5a9eeeea2385b34dfb81427f013e69c2
SHA512 f68296851bd948cd4dca021d885e4274c2b9fb023b4054e4d4f95ea48a6fe370b3dae4a6725334b2300528266b5d4afca3015493513c056e94cbb596b753d4d1
SSDEEP 3072:q9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:QctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T11E847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

faxsqkicau.sys

Path C:\Temp\faxsqkicau.sys
Size 293KB
SHA256 15d4ff18a1cb99865f0eaab3c100033491b0e826238736740fb98c789b0ab3f2
MD5 37c266c1120c880e4756245925a49e71
SHA1 a79957230e6a2eae94f3d8337d061e5d00e22c5e
SHA512 05f3b935223caf850898e6047ccf200e1ba4787f6a37794b0226d8d36cd4bc329469b8b474a7893ea473d1ee91b6b97d35ba3155974e3b6c1936e7e93705f21a
SSDEEP 3072:atKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:aIJjiJcbI03GBc3ucY5DCSj
TLSH
T10D545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gdyvqoljdb.sys

Path C:\Temp\gdyvqoljdb.sys
Size 293KB
SHA256 f1d4e728df3ef371c56b0e981c3ddc9d22dced1a35a36bcd8481d00202cfd5c0
MD5 a8aa461e2b068e3a53954757a814fb1b
SHA1 fa0add384aa14b06603781b86930affc23e79c75
SHA512 0aa470af009e81ffadd4d4c5ccae954ac66b9b90462f49a88d4b5495d79c299854b4804264148b463954a1714b7d1634a9016418cc3c5e27bd3ff7278edd3272
SSDEEP 3072:1tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:1IJjiJcbI03GBc3ucY5DCSj
TLSH
T15B545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dbvtnlfdyv.exe

Path C:\Temp\i_dbvtnlfdyv.exe
Size 384KB
SHA256 7b8bd96ddd2e074b59e4b1a7dd0f0cc7bfe78aa0810dc24b4553ba81773fe38d
MD5 261d92dbd44f83654a9b4e8215b1d09b
SHA1 8792ebdd98833ad23bb11e2d13bf7751448215b1
SHA512 384fc62234a0fc513221a76694f51df58d630ba23c786824c8a7d29eaa06cb60908d839739e389efc9c0678b32b6d06a6cd285aca05bcc79ed85852f59094796
SSDEEP 3072:99ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:PctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E5847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_igaysnlfdx.exe

Path C:\Temp\i_igaysnlfdx.exe
Size 384KB
SHA256 f718d9ddcb7adca53ca56f48800748f5243ac6e3e15d5acc7aae295ab341ed6f
MD5 90f6b9b71ba5a79c1f64773a644009da
SHA1 45745f54bc9e870714184c2e6aff8ef8115f3b2d
SHA512 da439ed8c0a9066484073cc4fe8d389a024bf948f2c04cb3c6a7a5f3374fb13e6556104c170120ce757692094f41349edd8f1562032509cd5987d8e0e87db33f
SSDEEP 3072:Z9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:zctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T17D847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_smkecusmke.exe

Path C:\Temp\i_smkecusmke.exe
Size 384KB
SHA256 96ea3a1a213d480ca556719464a90ead3b7557221220766ec677192f373edc37
MD5 428a0f811d37c5c43ebd777e953ec6ed
SHA1 abae6fd9e6e630469e458fbed48193779f1da8cd
SHA512 4d05f1f1246c0b5e9b1c60aa42edbe789c863e589497e62999f3ff61e6507af1656e36f714a56265be092771d53f2eaf2b02d21424ccc7d53afc7194ce8f3cc6
SSDEEP 3072:V9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:3ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T185847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wlgeywqoig.exe

Path C:\Temp\i_wlgeywqoig.exe
Size 384KB
SHA256 abed767c646b1bd5b50d0e029e21dd0f784348418901f9d4c0e3b7cfb07acd78
MD5 9d9812ab464d752a33a79b3a7bfb8f20
SHA1 55bc07ea49dfda25c57941d848f5f955a3ff198b
SHA512 1f6c2bc307ca2a450b15c6e45b9540371cd6a0eec7f6db6c6249fc61aa15800f0fd1dc23fc132a35d1db0aa6574855fb883397e3afd96288b9855cbb0f6d59eb
SSDEEP 3072:z9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:RctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T100846A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xusnhfaxvp.exe

Path C:\Temp\i_xusnhfaxvp.exe
Size 384KB
SHA256 ed341d119ec6a2a53919971c51e4431108fefedb49f1e6504fa7c7b960399096
MD5 fdaf00828701d1888dfa8da7d8789040
SHA1 3ee4d552e3302ce199f2f7a838d50dcba18b28bf
SHA512 e9b187a5aaa14421e88ec94fa9e28d13b1e7a165669178b0ffe7e213495d3f8908937e10b4427b339b2cd8c64ac687d555da48816328e0069e95132b8f18fa0b
SSDEEP 3072:e9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:8ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F3847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igaysnlfdx.exe

Path C:\Temp\igaysnlfdx.exe
Size 384KB
SHA256 a8a71ccf8fdb38c8d7ca6c9ecfd32bdd52851dab740fb4aefd1002f6ec35f435
MD5 ebd9490bf5ebca00bb0925316c2b6775
SHA1 d09b137347ed3423f648fe14d88390cebd1f5a80
SHA512 c6aa0151bbeb360d27bb7c84f8ac2cafcead8a3e6cf88100472896e9e8f264cc3e8a17d54af0a7b985bc39a12029817f5d34a457431573e61772472029b89b52
SSDEEP 3072:x9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:7ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T19F847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pjhczurmke.exe

Path C:\Temp\pjhczurmke.exe
Size 384KB
SHA256 1008e0a4d8d0b2b82656cc98d8ed3033e99663dfcadcae583ade7624de593519
MD5 f99f47143fba10d16e573c6916329ab1
SHA1 4fbd3e38f209c718c9063e27dd2e687ffc14c5e0
SHA512 127e68796e4b69ae5aa4a096e8e85e3a0a9a4105aec929f15194b457c8e72f15f31f03e4800425bb8f37caaeb58c7965ae6a254688808fb468cff2f58c353ccc
SSDEEP 3072:u9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:MctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B5847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkhcausmke.sys

Path C:\Temp\pkhcausmke.sys
Size 293KB
SHA256 4d2bc649af8a88780c5dcd4e6c9867b9ccae3e5dc8ba991e0325f102e3ebd733
MD5 f023c3f13e48515ce3a34e2311263900
SHA1 c9ca4160fca2df91a6382e6a4455207c19873c98
SHA512 f77275bc9a078b9720bf211fa1a1524d94c75dd9e75597e1ee8f06e473c5276018f7f18a497562fc0d85a09c3aa4df7def5310d1ab846b6bc62f74df03977f42
SSDEEP 3072:GtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:GIJjiJcbI03GBc3ucY5DCSj
TLSH
T14A545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qkidavsqki.sys

Path C:\Temp\qkidavsqki.sys
Size 293KB
SHA256 f720926decb6272783b78e192d9b29bcc9ad35ab2070da75e34e52a125270bc2
MD5 71636687fd79f012afb17705e0ef2261
SHA1 dc779c2e61d4e6f53cd5cbbe04aea288c5ea781e
SHA512 b4c7875f161c8025d8ccb1bd5f2ffe763611e46ae1662706e56d728884586d0e4124d5f8cfcea2634cc45a2cb028a2620435247f8b52c16c94bc6c049a209a0f
SSDEEP 3072:htKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:hIJjiJcbI03GBc3ucY5DCSj
TLSH
T1E1545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

smkecusmke.exe

Path C:\Temp\smkecusmke.exe
Size 384KB
SHA256 7ee2e01559459485a99bd2fedefae8650a0096bda77e218eb79594bd7e5fb473
MD5 6ae7d8f6ab29c8644d684ab2ee4156b7
SHA1 3835496fc68d0a4faadf411db578c45411a25319
SHA512 04ecb00e8f25209952c3d4ed707b6e6c33f2cb66a8955f465907b579143d89dd7daecd2a447f9fc0bcfd031592ced8a6b94e130b7e90a33f5ae1f42198b18b74
SSDEEP 3072:Z9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:zctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T12E847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wlgeywqoig.exe

Path C:\Temp\wlgeywqoig.exe
Size 384KB
SHA256 1f2ae38038545e118df23811f87f9638bbd767c86ae4f58324c21e004c82588e
MD5 56af70ae2602e8e0aa9c9462e484c3ae
SHA1 252c81dd40ea37925ecd392d1c9614b45c6c8229
SHA512 ace7c401b541f0d3c0cd6d1197b2a9f330210bf7990a11c58205174beada29c23bd90f11e7d5758bc93676b14042b43ffb76c2a8db32e0df5a6d5f1f0bfcf809
SSDEEP 3072:X9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:tctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T19E846A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xusnhfaxvp.exe

Path C:\Temp\xusnhfaxvp.exe
Size 384KB
SHA256 40685ccbd9d490bd2ccb895b75500b5caf493409ae022f23ef765919cbe163ec
MD5 8eb05bb10182f567244dedf5d343de34
SHA1 aa4673e2e15f201e32b0ff946e64f8103c9789e1
SHA512 fcfdd19fbd1d6e069abdcd481914363194864df4fbce4837adda22501e984a1f12b8550409d4541593bb73e33678a32a277025ab6500dddb762e233705fac430
SSDEEP 3072:B9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:LctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T14B847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvpnkfdavs.sys

Path C:\Temp\xvpnkfdavs.sys
Size 293KB
SHA256 0a17d2d0d13f8ca4255fcb1d16520f75fa969598b0d9d086fcddeb572a7e04ab
MD5 cec791f2764745a0ec4f4127fef53fff
SHA1 98eb3c10e520090b7bbea23bc701c599b09d529b
SHA512 246ba44e0a0428b12a7f05ad653dc7022c9d981f988149e765ee35e20479a578de6ed9f9eb30b67281d84185146d69d173fff887ee1bcce8362b8d7cb7c22b7d
SSDEEP 3072:9tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:9IJjiJcbI03GBc3ucY5DCSj
TLSH
T196545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ytrljdbvtolgeywq.exe

Path C:\Temp\ytrljdbvtolgeywq.exe
Size 384KB
SHA256 7c582a265745934ffe39d9a6de7199803668eb9c555ded539635c129d930ce39
MD5 8e8574d7f8988d1307b2b4529463565c
SHA1 a62cb2125869773a66a6b1e63bde0bb481696933
SHA512 c99188de183ecc8597e1e80b9f053b6f6aeac1da9952e2bf3e6b0f7426219aa28b5e3eba7b7c7518fc9a76c69ac38e5b1d0f43f237f518aee429cfb35864a808
SSDEEP 3072:O9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:sctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D5847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ytrljdbvtolgeywq.sys

Path C:\Temp\ytrljdbvtolgeywq.sys
Size 293KB
SHA256 3f77d15f166217759de21b0d185ddb1aecabf41b3c9bd56e8314673fd7994d89
MD5 3583536dba6f7bbe14b2baf673a5c149
SHA1 4acbc8c47ef96e9d921f24c96004248355f50619
SHA512 3339314eb7cf7612ecc0aec9855c510d74aac5ffc668614cb9d62143ea2518a67a6d022cd385fc05d9265ba0d50cb4d7b6551f9fb2609111abfaba9e54245edd
SSDEEP 3072:AtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:AIJjiJcbI03GBc3ucY5DCSj
TLSH
T1C7545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

549bf3da-58f9-47e0-bbc3-d2fc7de4b546.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\549bf3da-58f9-47e0-bbc3-d2fc7de4b546.tmp
Size 11KB
SHA256 8c008a816ed613dea08bde3c9e96eb3a8c7ffbf71717f841afc07c9afe42fc4b
MD5 999a9fc245dc806c5f5e7ebd351f9e6d
SHA1 2122b9b4ab4a174af9c78d963787c81bbfe5a4d2
SHA512 69aced5f4a97fc611fd1eac7ec9c7bbfe4ce8323ecc97741313b7a89f6e694ba710b04f1869792e5395ff53beb2568be4c0c8586e7288a6d1617933b80e8ea6f
SSDEEP 192:sxRUX6RpCC5g/fVSs5tknZCf9tTrzoD8p9UT/g6+WNCUvQw/YC0cUIuOpiGb2HId:sxRUX6b15g/fVSs5aZA9RTGT/5X4w/C+
TLSH
T1C942D816AD28A97B9CC7D20DBB65BF53D2F95032A1D41E48ABFC8A1C14E76DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 be7f2fe9647268b07ac8912c4ef9d3d0aad08266360a82db31b9908f05d16186
MD5 6cc96e8abb44be88b399df8f39a1ff80
SHA1 6f3b8cb3662759357613b87574b78ad8cf944c43
SHA512 adcf8e1ae3778e3c61ccce7f53dedb70601f938f1c4b8b1057b231908142e1b11bd65376cc655a86570b9d57ffe73e2377d59f438e4a7f502187f466c3849c89
TLSH
T1A841DAD41BE90AC2DBFC8EF560E166DD37F0D4AE41176E8164422E701B0AF9791D2973
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59cba3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59cba3.TMP
Size 2KB
SHA256 1589e2377c168922d7a8d99f5acc67313d054bfca6e7934d5542c70e9c82bb3a
MD5 caf1078ae91495c77a6fd21b4342f079
SHA1 36f6592c0eb8ac1ee958f40ee7286450e5afaa3b
SHA512 caec8b15fe9a8c63f981fa2e3bbb3d256cfb3f637d8f5069c045ab920b27e62d86186245442a7df46a8a3da89df150f2ceebaed7d464d78e266dbe2151791a2d
TLSH
T1B341F8D40BE90AC2DBFC8EF560E16ADD33F0C4AE00176E8164422E701B0AF9791D2973
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 d6e58fd8d41ced3fc95c058775d4c3aee71735cc1bd9f04aab0f042e5c7c4ead
MD5 2769bde0cb8d71a0ff024b144d1261bd
SHA1 85fea317476fe94ea32385e11bb770d13edf3095
SHA512 69898adbafb24688bb68f41016aa369becb3c99e866d540c91ded3db9f37932e8d0d5803f8df56325964f8a78b0cecea7756cfce52e6476eb01241b3dab2661e
TLSH
T16141AEF383F4853ECE1196F4AA086E2FCE2D0515432C7D9A85E49E2B93E3471D180A9F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 4e109064736f00e9a0b4ea06a26aa63af637b0a37b7c9c0951caa73decfa2832
MD5 3a092d46daa2368052181912d506c877
SHA1 70e3b0add4d85067fd84ad9fea1265ad49437634
SHA512 355f12a886e11227eabe2205d9b8164abee439e1885a628d5a7af9a3b51fe2d87cc8c115f3335d744313beb73b6c2c49db1f466cbf5602897088a345e89e6081
SSDEEP 192:sxRUm6RpCC5g/fVSs8knZCf9tTrzoD8p9UT/g6+WNCUvQw/YC0cUIuOpiGb2HIga:sxRUm6b15g/fVSsxZA9RTGT/5X4w/CFC
TLSH
T17A42C816AD28A97B9CC7D20DBB65BF53D2FD5032A1D41E48ABFC8A1C14E76DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 fca62f575b7a54684e14ef5a7d76b5ffa1e32c8c327d027860c85a1c7f1ed5ef
MD5 3e8ae7114791b9485368be25ec6a6244
SHA1 93da22ce6d37ff3a3ccd6764d3c91035f3102693
SHA512 e06fe91c8021bfbdc48bda95526ae08ee0c84349b0fd8a61dcf31906c6bfa7dd0a7420ea2fcd1b67ca948c8bfce7495268ff1717f9fb9fd627c6a0143f345e64
SSDEEP 384:sxRUX6b15g/fVSs5GWZA9RTGT/5X4w/CsApR2HiZ:s3pS/fDH/5tEj
TLSH
T10B42C816AD28A97B9CC7D209BB65BF53D2F95032A1D51E48ABFC8B1C14E76CD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 34697986cb38ac48eb9f76e70605426316f2ecb42cc0e3c041900a017137adfe
MD5 5158d4076245a3e6882011e4398085b1
SHA1 2e9f01fbdf17911a9febdef3ad4ea7661dc9ddfe
SHA512 6c672198c1c08ef05157fb8ce2463d6505c46cd4263e8219c49be832f515eb69131631bed2e62e1ee1f75f767124c4ad2b083f573fe52033a6b18a603ef84eca
SSDEEP 768:jC+vPN7pLuL7JQWgQ+f4+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXa0QqcEroZ9:jC+vP7E7JQWgQ+f4+u1ja8a0VcP/
TLSH
T171D2EB7B640DCB7F4F804ADDAC197E9F6DA802CB9698CD4047FA941C02C6BEB52194DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 ff1af0dc10cd0a687169b596f528d0dd974885e18ab6b973f8b397c4fa7c4b61
MD5 c709828608d9d9e73267e3a1f40ad634
SHA1 9b69490c6850487d2354470b68df5141acf02542
SHA512 46461677328595b0116019f002bb50fd8d6479f0d547b3d796c851e5a7cf7c1fd5ec8111a0164611e9a84e42d0d61156fedf688c9864a3bb5b2b2f14aae34a73
SSDEEP 96:KRbEBVj5J1WdSIg91K4EgT1c7j6dJOHFSr/VPTXWbAOgHXK42gZXc9lIhiKyMCK0:CbEBVj5JAdSp9/EgTK7j6dJOHFSr/VPA
TLSH
T1C9916211307B028078BD650CC1B9992E92C130B3341AE66F3FA919AB4F66E565EFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

802c70e1-429d-4bbd-b343-0722c30e90e0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\802c70e1-429d-4bbd-b343-0722c30e90e0.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 253627369782fb608be82c8924b4b9476816b4f98a2101f11d71f9c8ffe84f60
MD5 1088e044a37ebbe2582907bda4cb640c
SHA1 42af90026f88d5e6c6435226ab6fc6ab26307e5b
SHA512 78ed4b4f6aeea09a31e7ca7530bc29e24737bee4884aaab214a02cf6c88797776ca93b73249b47037fef235926263deaf98e2f8d2c5d44b86e8c8ec8740d5b55
SSDEEP 768:Irv+4UNbdD3EcQVTNp8+p3bd66j+4BRv86aLIir2bwCl1:Ibsbp36L8+p3Z6n4y90ww
TLSH
T14A03BE33E9A899739CF6C648B2467B433FF851A396C10AC4D5DD2B4E419A19E230BC77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 af7065800d19ce907b7054365abc79dab8db46a7a7a1f77afb67c223e71a30a8
MD5 a39f5a0523d21f3c10a9b6fb5fa4c0cf
SHA1 3ab4a448568894f2842c6d63b76880cc42cfee28
SHA512 bbff73edaf3e15c43efaff6eb94bf99e4fa70bbe912009ab5fa18be9fa133d17be040c7db787283e4bc47a46049e893db7aee0201e2b37f97498269d10feda3f
SSDEEP 768:lo3UviiQVHrp8+p3bd66j+4BRv86aLIW5D184paB:lo3VN8+p3Z6n4yPWZB
TLSH
T149F2AF71ECA99D739CFAD248B69637436EF4506399C44E94D9D86B0D009326E270FC3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 77e1a9b4a0d443147dc67b44d07220941f8d4b062e560bd6fd54ba60061c4681
MD5 b10ca45ba82b89a418bc85c2b5752fb5
SHA1 4383930c463815fa38552cb511b8a127e962b1b2
SHA512 057c4c6d6a8ccdb255bbf177c4254e22b7a181fab13c89f8897038389889b4b6d6dcc25843d818c8ae125c1ee5e97e5b408ca86b86b5a118e7bad3531a083026
SSDEEP 768:qrv+4UNbdn3TvziQVHrp8+p3bd66j+4BRv86aLIW5D184pu:qbsb139N8+p3Z6n4yPW/
TLSH
T10303BE71F869AD739CFAC644B19737837EF8106359C00E94E9C96B4D41971AE270FC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 c5b3436afcbd81c18932d2407b80ced02c039fdfc0d5c95a5431b164955eb818
MD5 546c5db7da93365e90825e6cb39f833a
SHA1 f0c510447316c0ff5db6329ab7b66d7220c80d46
SHA512 7ec08f4ecb3f28faf1b166ab5437ee50e2abe32e4c70ff690697f512b338060f2221a920fe50efe5f6f2441c92f8b7d960203380e99ca96a5b578a29cbea28c3
SSDEEP 768:uo3hviiQVHrp8+p3bd66j+4BRv86aLIW5D184paB:uo3IN8+p3Z6n4yPWZB
TLSH
T1F7F2AF71ECA99D739CFAD248B69637436EF4506399C45E94D8D86B0D009326E270FC3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 3050d3d7b6645026bd4e6ef6011a86fbf8b46cd71b859a9964dd3ac8ecfa9d03
MD5 5b7d905c79b0c3ea12f970a9ae5ab71f
SHA1 c0a03724072ffcdbb634638184f4e138191322a6
SHA512 fc01cf111ad248a34cbaab1b26758b5307aa869c844d955c5b297ebc7cb2820ea4719d40d349628916d82dce8ee9d8cf49ff3ca47d62f13a7d331b40a5b6180f
SSDEEP 768:oFQi3UwgzvQhRV5p8+p3bd66j+4BRv86aLIW5D184paB:Li3V8+p3Z6n4yPWZB
TLSH
T1D81306F198D79976E8AE8787A77D6E429DBCC063B5884890B7C45E0CCC821BFD70A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 faeb0f4dc56dfcb474475e42a832d7335cbd23ec6aa2cb37ccd4fe3b697d179a
MD5 a3bc1ab24bca2ffb295c00ce6e674464
SHA1 872859a9f2e09f6422be96476a1d01f89bb708c9
SHA512 fca085cdc56f25e774a01b0ad035d3740b0038d05efd7d001a8d69b1670c4e7e01c128d2fd0673f4fa3df797168f649f48c27195a78398659cfe5554a0792fd6
SSDEEP 768:crv+4UNbdD3UQQVHNp8+p3bd66j+4BRv86aLIT52bwCl1:cbsbp3OL8+p3Z6n4y80ww
TLSH
T12D03BE72E4A899339CE7C644B28677837FF811A395C10E94E4D96B4E409B29E370F937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e1fd22f6-4330-4a39-aaa1-bc1d2839b801.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\e1fd22f6-4330-4a39-aaa1-bc1d2839b801.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

0bb44020-f3bc-492d-a636-37adfd78bd85.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\0bb44020-f3bc-492d-a636-37adfd78bd85.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1760_636497854\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 db518e78c0d63c3fdad2644f1d228621870ffa946efb42596c993bda52500bfb
MD5 ff79e8b6aa2ca4ae870886d41e5bf4c9
SHA1 25ba0822b35f0124ce326c8fb6abf25da2e780a7
SHA512 17314f8b1486b8185a55baa9b8b7361d72bf07acc79cf39b44a53822d796a0ed2790edfe83d63edcbae072abf59ca9bf9228e3c9f3efb39db10d6ae6fe0e3d13
TLSH
T18571008357A9D6B3C1DA5BF102835644F6BB223C076360240B91598AEB70A7A64B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/560-463-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/616-442-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/624-328-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/756-332-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/864-401-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1212-361-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1500-284-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2408-185-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2464-61-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2868-427-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2868-405-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2932-309-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3492-313-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3776-484-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4044-232-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4308-467-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5036-437-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5076-425-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5684-381-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5992-260-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6124-272-0x0000000000010000-0x00000000000AB000-memory.dmp

Download