systex | 9751972e6c3d508f8dea1a8b84dfa907cad2d46143522262b5272685df3f4f27

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 08:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-30_ad79ad625388ed6098b19068bbd2d0c2_amadey_darkgate_elex_smoke-loader_stop.exe
Size 384KB
Sample260930-klrzksba64
SHA256 9751972e6c3d508f8dea1a8b84dfa907cad2d46143522262b5272685df3f4f27
MD5 ad79ad625388ed6098b19068bbd2d0c2
SHA1 8923c80ea74861861da496f16fce9fa5cca8c098
SHA512 a825b5b0c1295b29949867a2fb301f9c62476e834756f97be6feb9e9c869c076e22ab952f81944b84a678571559dd71510b1953fd07cd3d949b2bde628d1670f
SSDEEP 3072:4btF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:4btt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T18E847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
4852	omhezwrpjhbzurmj.exe
1976	omhezwrpjhbzurmj.sys
6004	CreateProcess.exe
2696	rpmgezwroj.exe
4968	CreateProcess.exe
5808	CreateProcess.exe
5952	i_rpmgezwroj.exe
5348	ojgbztrljd.sys
3452	CreateProcess.exe
5820	dbytqolgdy.exe
5196	CreateProcess.exe
5496	CreateProcess.exe
4792	i_dbytqolgdy.exe
4364	ljdbvtrljg.sys
568	CreateProcess.exe
4292	bvtnlgdbyt.exe
5944	CreateProcess.exe
4976	CreateProcess.exe
5360	i_bvtnlgdbyt.exe
3440	wqolfdbytq.sys
3880	CreateProcess.exe
2552	yvtnligayt.exe
2380	CreateProcess.exe
4948	CreateProcess.exe
2256	i_yvtnligayt.exe
932	tnlfdavsnl.sys
1888	CreateProcess.exe
1068	nlfavsnlfd.exe
1312	CreateProcess.exe
2004	CreateProcess.exe
5664	i_nlfavsnlfd.exe
1268	kfdxvpnhfz.sys
3248	CreateProcess.exe
1432	faxvpnhfzx.exe
1996	CreateProcess.exe
3436	CreateProcess.exe
4616	i_faxvpnhfzx.exe
3380	kifaxspkhf.sys
1180	CreateProcess.exe
5336	causpkhcau.exe
3280	CreateProcess.exe
4132	CreateProcess.exe
5804	i_causpkhcau.exe
2064	kecwuspkhf.sys
1112	CreateProcess.exe
2184	mkhczxupnh.exe
5384	CreateProcess.exe
4956	CreateProcess.exe
3332	i_mkhczxupnh.exe
4320	mjhbzxrpmh.sys
2356	CreateProcess.exe
696	ecwuomhezw.exe
4884	CreateProcess.exe
760	CreateProcess.exe
4216	i_ecwuomhezw.exe
4764	uomgeywqoj.sys
5200	CreateProcess.exe
3368	omjebzwroj.exe
5624	CreateProcess.exe
4668	CreateProcess.exe
5132	i_omjebzwroj.exe
5968	trljdbwtrl.sys
3852	CreateProcess.exe
4556	lgeywqojgb.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_431211951\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_431211951\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_1616521528\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_1616521528\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_1616521528\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_1070001055\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_1616521528\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_518088011\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1692_1070001055\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlfavsnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtnlfdavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecausmkifz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfcwusmkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlfavsnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_causpkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkhczxupnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkhczxupnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwuomhezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwuomhezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kecwurmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bywqolgdby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpmgezwroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgeywqojgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nljdyvqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kecwurmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwtromgebz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpmgezwroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbytqolgdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvtnlgdbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvtnligayt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faxvpnhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecausmkifz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvtnligayt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causpkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lfdxvpnkfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfcwusmkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtrljebwqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-30_ad79ad625388ed6098b19068bbd2d0c2_amadey_darkgate_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbytqolgdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faxvpnhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgeywqojgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nljdyvqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omhezwrpjhbzurmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omjebzwroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lfdxvpnkfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwtromgebz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtrljebwqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtnlgdbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omjebzwroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvtnlfdavs.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5520	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3764	ipconfig.exe
4484	ipconfig.exe
1424	ipconfig.exe
3616	ipconfig.exe
1704	ipconfig.exe
1180	ipconfig.exe
5920	ipconfig.exe
4416	ipconfig.exe
940	ipconfig.exe
2540	ipconfig.exe
4772	ipconfig.exe
1724	ipconfig.exe
5924	ipconfig.exe
1412	ipconfig.exe
5864	ipconfig.exe
3260	ipconfig.exe
4384	ipconfig.exe
2812	ipconfig.exe
936	ipconfig.exe
5868	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-560646293-820748483-2532804640-1000\{5BD1C692-F764-4AE6-BD84-70CB8D2E7347}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6036	2026-09-30_ad79ad625388ed6098b19068bbd2d0c2_amadey_darkgate_elex_smoke-loader_stop.exe
6036	2026-09-30_ad79ad625388ed6098b19068bbd2d0c2_amadey_darkgate_elex_smoke-loader_stop.exe
6036	2026-09-30_ad79ad625388ed6098b19068bbd2d0c2_amadey_darkgate_elex_smoke-loader_stop.exe
6036	2026-09-30_ad79ad625388ed6098b19068bbd2d0c2_amadey_darkgate_elex_smoke-loader_stop.exe
6036	2026-09-30_ad79ad625388ed6098b19068bbd2d0c2_amadey_darkgate_elex_smoke-loader_stop.exe
6036	2026-09-30_ad79ad625388ed6098b19068bbd2d0c2_amadey_darkgate_elex_smoke-loader_stop.exe
6036	2026-09-30_ad79ad625388ed6098b19068bbd2d0c2_amadey_darkgate_elex_smoke-loader_stop.exe
6036	2026-09-30_ad79ad625388ed6098b19068bbd2d0c2_amadey_darkgate_elex_smoke-loader_stop.exe
6036	2026-09-30_ad79ad625388ed6098b19068bbd2d0c2_amadey_darkgate_elex_smoke-loader_stop.exe
6036	2026-09-30_ad79ad625388ed6098b19068bbd2d0c2_amadey_darkgate_elex_smoke-loader_stop.exe
6036	2026-09-30_ad79ad625388ed6098b19068bbd2d0c2_amadey_darkgate_elex_smoke-loader_stop.exe
6036	2026-09-30_ad79ad625388ed6098b19068bbd2d0c2_amadey_darkgate_elex_smoke-loader_stop.exe
6036	2026-09-30_ad79ad625388ed6098b19068bbd2d0c2_amadey_darkgate_elex_smoke-loader_stop.exe
6036	2026-09-30_ad79ad625388ed6098b19068bbd2d0c2_amadey_darkgate_elex_smoke-loader_stop.exe
6036	2026-09-30_ad79ad625388ed6098b19068bbd2d0c2_amadey_darkgate_elex_smoke-loader_stop.exe
6036	2026-09-30_ad79ad625388ed6098b19068bbd2d0c2_amadey_darkgate_elex_smoke-loader_stop.exe
6036	2026-09-30_ad79ad625388ed6098b19068bbd2d0c2_amadey_darkgate_elex_smoke-loader_stop.exe
6036	2026-09-30_ad79ad625388ed6098b19068bbd2d0c2_amadey_darkgate_elex_smoke-loader_stop.exe
6036	2026-09-30_ad79ad625388ed6098b19068bbd2d0c2_amadey_darkgate_elex_smoke-loader_stop.exe
6036	2026-09-30_ad79ad625388ed6098b19068bbd2d0c2_amadey_darkgate_elex_smoke-loader_stop.exe
6036	2026-09-30_ad79ad625388ed6098b19068bbd2d0c2_amadey_darkgate_elex_smoke-loader_stop.exe
6036	2026-09-30_ad79ad625388ed6098b19068bbd2d0c2_amadey_darkgate_elex_smoke-loader_stop.exe
6036	2026-09-30_ad79ad625388ed6098b19068bbd2d0c2_amadey_darkgate_elex_smoke-loader_stop.exe
6036	2026-09-30_ad79ad625388ed6098b19068bbd2d0c2_amadey_darkgate_elex_smoke-loader_stop.exe
6036	2026-09-30_ad79ad625388ed6098b19068bbd2d0c2_amadey_darkgate_elex_smoke-loader_stop.exe
6036	2026-09-30_ad79ad625388ed6098b19068bbd2d0c2_amadey_darkgate_elex_smoke-loader_stop.exe
6036	2026-09-30_ad79ad625388ed6098b19068bbd2d0c2_amadey_darkgate_elex_smoke-loader_stop.exe
6036	2026-09-30_ad79ad625388ed6098b19068bbd2d0c2_amadey_darkgate_elex_smoke-loader_stop.exe
6036	2026-09-30_ad79ad625388ed6098b19068bbd2d0c2_amadey_darkgate_elex_smoke-loader_stop.exe
6036	2026-09-30_ad79ad625388ed6098b19068bbd2d0c2_amadey_darkgate_elex_smoke-loader_stop.exe
6036	2026-09-30_ad79ad625388ed6098b19068bbd2d0c2_amadey_darkgate_elex_smoke-loader_stop.exe
6036	2026-09-30_ad79ad625388ed6098b19068bbd2d0c2_amadey_darkgate_elex_smoke-loader_stop.exe
6036	2026-09-30_ad79ad625388ed6098b19068bbd2d0c2_amadey_darkgate_elex_smoke-loader_stop.exe
6036	2026-09-30_ad79ad625388ed6098b19068bbd2d0c2_amadey_darkgate_elex_smoke-loader_stop.exe
6036	2026-09-30_ad79ad625388ed6098b19068bbd2d0c2_amadey_darkgate_elex_smoke-loader_stop.exe
6036	2026-09-30_ad79ad625388ed6098b19068bbd2d0c2_amadey_darkgate_elex_smoke-loader_stop.exe
6036	2026-09-30_ad79ad625388ed6098b19068bbd2d0c2_amadey_darkgate_elex_smoke-loader_stop.exe
6036	2026-09-30_ad79ad625388ed6098b19068bbd2d0c2_amadey_darkgate_elex_smoke-loader_stop.exe
6036	2026-09-30_ad79ad625388ed6098b19068bbd2d0c2_amadey_darkgate_elex_smoke-loader_stop.exe
6036	2026-09-30_ad79ad625388ed6098b19068bbd2d0c2_amadey_darkgate_elex_smoke-loader_stop.exe
6036	2026-09-30_ad79ad625388ed6098b19068bbd2d0c2_amadey_darkgate_elex_smoke-loader_stop.exe
6036	2026-09-30_ad79ad625388ed6098b19068bbd2d0c2_amadey_darkgate_elex_smoke-loader_stop.exe
6036	2026-09-30_ad79ad625388ed6098b19068bbd2d0c2_amadey_darkgate_elex_smoke-loader_stop.exe
6036	2026-09-30_ad79ad625388ed6098b19068bbd2d0c2_amadey_darkgate_elex_smoke-loader_stop.exe
6036	2026-09-30_ad79ad625388ed6098b19068bbd2d0c2_amadey_darkgate_elex_smoke-loader_stop.exe
6036	2026-09-30_ad79ad625388ed6098b19068bbd2d0c2_amadey_darkgate_elex_smoke-loader_stop.exe
6036	2026-09-30_ad79ad625388ed6098b19068bbd2d0c2_amadey_darkgate_elex_smoke-loader_stop.exe
6036	2026-09-30_ad79ad625388ed6098b19068bbd2d0c2_amadey_darkgate_elex_smoke-loader_stop.exe
6036	2026-09-30_ad79ad625388ed6098b19068bbd2d0c2_amadey_darkgate_elex_smoke-loader_stop.exe
6036	2026-09-30_ad79ad625388ed6098b19068bbd2d0c2_amadey_darkgate_elex_smoke-loader_stop.exe
6036	2026-09-30_ad79ad625388ed6098b19068bbd2d0c2_amadey_darkgate_elex_smoke-loader_stop.exe
6036	2026-09-30_ad79ad625388ed6098b19068bbd2d0c2_amadey_darkgate_elex_smoke-loader_stop.exe
6036	2026-09-30_ad79ad625388ed6098b19068bbd2d0c2_amadey_darkgate_elex_smoke-loader_stop.exe
6036	2026-09-30_ad79ad625388ed6098b19068bbd2d0c2_amadey_darkgate_elex_smoke-loader_stop.exe
6036	2026-09-30_ad79ad625388ed6098b19068bbd2d0c2_amadey_darkgate_elex_smoke-loader_stop.exe
6036	2026-09-30_ad79ad625388ed6098b19068bbd2d0c2_amadey_darkgate_elex_smoke-loader_stop.exe
4852	omhezwrpjhbzurmj.exe
4852	omhezwrpjhbzurmj.exe
4852	omhezwrpjhbzurmj.exe
4852	omhezwrpjhbzurmj.exe
4852	omhezwrpjhbzurmj.exe
4852	omhezwrpjhbzurmj.exe
4852	omhezwrpjhbzurmj.exe
4852	omhezwrpjhbzurmj.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	5952	i_rpmgezwroj.exe
Token: SeDebugPrivilege	4792	i_dbytqolgdy.exe
Token: SeDebugPrivilege	5360	i_bvtnlgdbyt.exe
Token: SeDebugPrivilege	2256	i_yvtnligayt.exe
Token: SeDebugPrivilege	5664	i_nlfavsnlfd.exe
Token: SeDebugPrivilege	4616	i_faxvpnhfzx.exe
Token: SeDebugPrivilege	5804	i_causpkhcau.exe
Token: SeDebugPrivilege	3332	i_mkhczxupnh.exe
Token: SeDebugPrivilege	4216	i_ecwuomhezw.exe
Token: SeDebugPrivilege	5132	i_omjebzwroj.exe
Token: SeDebugPrivilege	4724	i_lgeywqojgb.exe
Token: SeDebugPrivilege	5604	i_nljdyvqoig.exe
Token: SeDebugPrivilege	4548	i_bvtnlfdavs.exe
Token: SeDebugPrivilege	3252	i_lfdxvpnkfd.exe
Token: SeDebugPrivilege	4836	i_ecausmkifz.exe
Token: SeDebugPrivilege	932	i_hfcwusmkhc.exe
Token: SeDebugPrivilege	3608	i_kecwurmkec.exe
Token: SeDebugPrivilege	3484	i_cwtromgebz.exe
Token: SeDebugPrivilege	936	i_vtrljebwqo.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1692	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6036 wrote to memory of 4852	6036	2026-09-30_ad79ad625388ed6098b19068bbd2d0c2_amadey_darkgate_elex_smoke-loader_stop.exe	89
PID 6036 wrote to memory of 3340	6036	2026-09-30_ad79ad625388ed6098b19068bbd2d0c2_amadey_darkgate_elex_smoke-loader_stop.exe	90
PID 3340 wrote to memory of 1692	3340	iexplore.exe	91
PID 1692 wrote to memory of 2948	1692	msedge.exe	92
PID 1692 wrote to memory of 3272	1692	msedge.exe	93
PID 1692 wrote to memory of 5520	1692	msedge.exe	94
PID 1692 wrote to memory of 3272	1692	msedge.exe	93
PID 1692 wrote to memory of 3272	1692	msedge.exe	93
PID 1692 wrote to memory of 2392	1692	msedge.exe	95
PID 1692 wrote to memory of 2392	1692	msedge.exe	95
PID 1692 wrote to memory of 2932	1692	msedge.exe	97
PID 1692 wrote to memory of 2932	1692	msedge.exe	97
PID 1692 wrote to memory of 2932	1692	msedge.exe	97
PID 1692 wrote to memory of 3836	1692	msedge.exe	98
PID 1692 wrote to memory of 3836	1692	msedge.exe	98
PID 1692 wrote to memory of 3836	1692	msedge.exe	98
PID 1692 wrote to memory of 5492	1692	msedge.exe	99
PID 1692 wrote to memory of 5508	1692	msedge.exe	100
PID 1692 wrote to memory of 5492	1692	msedge.exe	99
PID 1692 wrote to memory of 5492	1692	msedge.exe	99
PID 1692 wrote to memory of 5508	1692	msedge.exe	100
PID 1692 wrote to memory of 5508	1692	msedge.exe	100
PID 1692 wrote to memory of 5384	1692	msedge.exe	102
PID 1692 wrote to memory of 5384	1692	msedge.exe	102
PID 4852 wrote to memory of 6004	4852	omhezwrpjhbzurmj.exe	105
PID 2696 wrote to memory of 4968	2696	rpmgezwroj.exe	108
PID 1692 wrote to memory of 5860	1692	msedge.exe	112
PID 1692 wrote to memory of 5828	1692	msedge.exe	111
PID 1692 wrote to memory of 5860	1692	msedge.exe	112
PID 1692 wrote to memory of 5828	1692	msedge.exe	111
PID 1692 wrote to memory of 5392	1692	msedge.exe	114
PID 1692 wrote to memory of 3120	1692	msedge.exe	115
PID 1692 wrote to memory of 3120	1692	msedge.exe	115
PID 1692 wrote to memory of 5200	1692	msedge.exe	118
PID 1692 wrote to memory of 5200	1692	msedge.exe	118
PID 4852 wrote to memory of 5808	4852	omhezwrpjhbzurmj.exe	119
PID 4852 wrote to memory of 3452	4852	omhezwrpjhbzurmj.exe	123
PID 5820 wrote to memory of 5196	5820	dbytqolgdy.exe	125
PID 4852 wrote to memory of 5496	4852	omhezwrpjhbzurmj.exe	128
PID 4852 wrote to memory of 568	4852	omhezwrpjhbzurmj.exe	132
PID 4292 wrote to memory of 5944	4292	bvtnlgdbyt.exe	134
PID 4852 wrote to memory of 4976	4852	omhezwrpjhbzurmj.exe	137
PID 4852 wrote to memory of 3880	4852	omhezwrpjhbzurmj.exe	141
PID 2552 wrote to memory of 2380	2552	yvtnligayt.exe	143
PID 4852 wrote to memory of 4948	4852	omhezwrpjhbzurmj.exe	147
PID 1692 wrote to memory of 2808	1692	msedge.exe	149
PID 1692 wrote to memory of 5972	1692	msedge.exe	150
PID 1692 wrote to memory of 4668	1692	msedge.exe	151
PID 4852 wrote to memory of 1888	4852	omhezwrpjhbzurmj.exe	154
PID 1068 wrote to memory of 1312	1068	nlfavsnlfd.exe	156
PID 4852 wrote to memory of 2004	4852	omhezwrpjhbzurmj.exe	159
PID 4852 wrote to memory of 3248	4852	omhezwrpjhbzurmj.exe	163
PID 1432 wrote to memory of 1996	1432	faxvpnhfzx.exe	165
PID 4852 wrote to memory of 3436	4852	omhezwrpjhbzurmj.exe	168
PID 4852 wrote to memory of 1180	4852	omhezwrpjhbzurmj.exe	172
PID 5336 wrote to memory of 3280	5336	causpkhcau.exe	174
PID 4852 wrote to memory of 4132	4852	omhezwrpjhbzurmj.exe	177
PID 4852 wrote to memory of 1112	4852	omhezwrpjhbzurmj.exe	181
PID 2184 wrote to memory of 5384	2184	mkhczxupnh.exe	183
PID 4852 wrote to memory of 4956	4852	omhezwrpjhbzurmj.exe	186
PID 1692 wrote to memory of 2544	1692	msedge.exe	188
PID 1692 wrote to memory of 2544	1692	msedge.exe	188
PID 4852 wrote to memory of 2356	4852	omhezwrpjhbzurmj.exe	194
PID 696 wrote to memory of 4884	696	ecwuomhezw.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-09-30_ad79ad625388ed6098b19068bbd2d0c2_amadey_darkgate_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_ad79ad625388ed6098b19068bbd2d0c2_amadey_darkgate_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6036
- C:\Temp\omhezwrpjhbzurmj.exe
  C:\Temp\omhezwrpjhbzurmj.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4852
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rpmgezwroj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6004
  - - C:\Temp\rpmgezwroj.exe
      C:\Temp\rpmgezwroj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2696
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4968
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3764
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rpmgezwroj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5808
  - - C:\Temp\i_rpmgezwroj.exe
      C:\Temp\i_rpmgezwroj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5952
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbytqolgdy.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3452
  - - C:\Temp\dbytqolgdy.exe
      C:\Temp\dbytqolgdy.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5820
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5196
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5864
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbytqolgdy.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5496
  - - C:\Temp\i_dbytqolgdy.exe
      C:\Temp\i_dbytqolgdy.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4792
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bvtnlgdbyt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:568
  - - C:\Temp\bvtnlgdbyt.exe
      C:\Temp\bvtnlgdbyt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4292
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5944
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3260
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bvtnlgdbyt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4976
  - - C:\Temp\i_bvtnlgdbyt.exe
      C:\Temp\i_bvtnlgdbyt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5360
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\yvtnligayt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3880
  - - C:\Temp\yvtnligayt.exe
      C:\Temp\yvtnligayt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2552
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2380
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1180
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_yvtnligayt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4948
  - - C:\Temp\i_yvtnligayt.exe
      C:\Temp\i_yvtnligayt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2256
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nlfavsnlfd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1888
  - - C:\Temp\nlfavsnlfd.exe
      C:\Temp\nlfavsnlfd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1068
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1312
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5920
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nlfavsnlfd.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2004
  - - C:\Temp\i_nlfavsnlfd.exe
      C:\Temp\i_nlfavsnlfd.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5664
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\faxvpnhfzx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3248
  - - C:\Temp\faxvpnhfzx.exe
      C:\Temp\faxvpnhfzx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1432
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1996
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4384
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_faxvpnhfzx.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3436
  - - C:\Temp\i_faxvpnhfzx.exe
      C:\Temp\i_faxvpnhfzx.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4616
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\causpkhcau.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1180
  - - C:\Temp\causpkhcau.exe
      C:\Temp\causpkhcau.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5336
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3280
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2812
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_causpkhcau.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4132
  - - C:\Temp\i_causpkhcau.exe
      C:\Temp\i_causpkhcau.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5804
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mkhczxupnh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1112
  - - C:\Temp\mkhczxupnh.exe
      C:\Temp\mkhczxupnh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2184
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5384
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4416
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mkhczxupnh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4956
  - - C:\Temp\i_mkhczxupnh.exe
      C:\Temp\i_mkhczxupnh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3332
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ecwuomhezw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2356
  - - C:\Temp\ecwuomhezw.exe
      C:\Temp\ecwuomhezw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:696
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4884
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4484
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ecwuomhezw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:760
  - - C:\Temp\i_ecwuomhezw.exe
      C:\Temp\i_ecwuomhezw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4216
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\omjebzwroj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5200
  - - C:\Temp\omjebzwroj.exe
      C:\Temp\omjebzwroj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3368
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5624
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:940
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_omjebzwroj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4668
  - - C:\Temp\i_omjebzwroj.exe
      C:\Temp\i_omjebzwroj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5132
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lgeywqojgb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3852
  - - C:\Temp\lgeywqojgb.exe
      C:\Temp\lgeywqojgb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4556
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3796
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2540
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lgeywqojgb.exe ups_ins
    3⤵
    PID:1556
  - - C:\Temp\i_lgeywqojgb.exe
      C:\Temp\i_lgeywqojgb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4724
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nljdyvqoig.exe ups_run
    3⤵
    PID:5680
  - - C:\Temp\nljdyvqoig.exe
      C:\Temp\nljdyvqoig.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3240
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4384
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4772
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nljdyvqoig.exe ups_ins
    3⤵
    PID:4216
  - - C:\Temp\i_nljdyvqoig.exe
      C:\Temp\i_nljdyvqoig.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5604
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bvtnlfdavs.exe ups_run
    3⤵
    PID:3440
  - - C:\Temp\bvtnlfdavs.exe
      C:\Temp\bvtnlfdavs.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2920
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2708
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:936
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bvtnlfdavs.exe ups_ins
    3⤵
    PID:6108
  - - C:\Temp\i_bvtnlfdavs.exe
      C:\Temp\i_bvtnlfdavs.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4548
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lfdxvpnkfd.exe ups_run
    3⤵
    PID:4724
  - - C:\Temp\lfdxvpnkfd.exe
      C:\Temp\lfdxvpnkfd.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1492
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1396
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1724
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lfdxvpnkfd.exe ups_ins
    3⤵
    PID:5016
  - - C:\Temp\i_lfdxvpnkfd.exe
      C:\Temp\i_lfdxvpnkfd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3252
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ecausmkifz.exe ups_run
    3⤵
    PID:1720
  - - C:\Temp\ecausmkifz.exe
      C:\Temp\ecausmkifz.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4568
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5752
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1412
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ecausmkifz.exe ups_ins
    3⤵
    PID:1832
  - - C:\Temp\i_ecausmkifz.exe
      C:\Temp\i_ecausmkifz.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4836
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hfcwusmkhc.exe ups_run
    3⤵
    PID:2348
  - - C:\Temp\hfcwusmkhc.exe
      C:\Temp\hfcwusmkhc.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3520
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4844
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5868
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hfcwusmkhc.exe ups_ins
    3⤵
    PID:4140
  - - C:\Temp\i_hfcwusmkhc.exe
      C:\Temp\i_hfcwusmkhc.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:932
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kecwurmkec.exe ups_run
    3⤵
    PID:3872
  - - C:\Temp\kecwurmkec.exe
      C:\Temp\kecwurmkec.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3460
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2964
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5924
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kecwurmkec.exe ups_ins
    3⤵
    PID:2680
  - - C:\Temp\i_kecwurmkec.exe
      C:\Temp\i_kecwurmkec.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3608
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cwtromgebz.exe ups_run
    3⤵
    PID:2764
  - - C:\Temp\cwtromgebz.exe
      C:\Temp\cwtromgebz.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4476
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1776
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1424
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cwtromgebz.exe ups_ins
    3⤵
    PID:6016
  - - C:\Temp\i_cwtromgebz.exe
      C:\Temp\i_cwtromgebz.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3484
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtrljebwqo.exe ups_run
    3⤵
    PID:4916
  - - C:\Temp\vtrljebwqo.exe
      C:\Temp\vtrljebwqo.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2232
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3912
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3616
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtrljebwqo.exe ups_ins
    3⤵
    PID:5172
  - - C:\Temp\i_vtrljebwqo.exe
      C:\Temp\i_vtrljebwqo.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:936
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bywqolgdby.exe ups_run
    3⤵
    PID:1352
  - - C:\Temp\bywqolgdby.exe
      C:\Temp\bywqolgdby.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4264
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2840
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1704
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3340
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7fff887ec188,0x7fff887ec194,0x7fff887ec1a0
      4⤵
      PID:2948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1616,i,4744047483530681096,3605143245910881003,262144 --field-trial-handle=2292,i,9089362275459834104,9158121072567246060,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
      4⤵
      PID:3272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,216495468775210195,13974814021381567486,524288 --field-trial-handle=2292,i,9089362275459834104,9158121072567246060,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:11
      4⤵
      System Time Discovery
      PID:5520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2484,i,8605841163111713348,14255118437763372956,524288 --field-trial-handle=2292,i,9089362275459834104,9158121072567246060,262144 --variations-seed-version --mojo-platform-channel-handle=3164 /prefetch:13
      4⤵
      PID:2392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3560,i,8588162670243237001,9163099776672293646,2097152 --field-trial-handle=2292,i,9089362275459834104,9158121072567246060,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
      4⤵
      PID:2932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=2700,i,15568738223291840066,2316874974994711694,2097152 --field-trial-handle=2292,i,9089362275459834104,9158121072567246060,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
      4⤵
      PID:3836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,285277547972800959,3008969622087446464,2097152 --field-trial-handle=2292,i,9089362275459834104,9158121072567246060,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:9
      4⤵
      PID:5492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,12608619469024996634,8794300012763551694,2097152 --field-trial-handle=2292,i,9089362275459834104,9158121072567246060,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:1
      4⤵
      PID:5508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,3541916367873869200,13593495950832581930,524288 --field-trial-handle=2292,i,9089362275459834104,9158121072567246060,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
      4⤵
      PID:5384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3724,i,6150014582013192490,13907337391615599660,524288 --field-trial-handle=2292,i,9089362275459834104,9158121072567246060,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
      4⤵
      PID:5828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3748,i,6538432003048588268,17380227964171837115,524288 --field-trial-handle=2292,i,9089362275459834104,9158121072567246060,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:14
      4⤵
      PID:5860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,1659523110262459269,8384568777095299976,524288 --field-trial-handle=2292,i,9089362275459834104,9158121072567246060,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
      4⤵
      PID:2984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,1659523110262459269,8384568777095299976,524288 --field-trial-handle=2292,i,9089362275459834104,9158121072567246060,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
      4⤵
      PID:5392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,2558800042639372721,488034722056690597,524288 --field-trial-handle=2292,i,9089362275459834104,9158121072567246060,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:14
      4⤵
      PID:3120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,11495717252010644315,107476244055557306,524288 --field-trial-handle=2292,i,9089362275459834104,9158121072567246060,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:14
      4⤵
      PID:5200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4844,i,1960236655263462377,14138473666034916562,524288 --field-trial-handle=2292,i,9089362275459834104,9158121072567246060,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:14
      4⤵
      PID:2808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4860,i,11708269541839860742,220943371041302182,524288 --field-trial-handle=2292,i,9089362275459834104,9158121072567246060,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:14
      4⤵
      PID:5972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4832,i,5584583457469670179,9742763774695624766,524288 --field-trial-handle=2292,i,9089362275459834104,9158121072567246060,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:14
      4⤵
      PID:4668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,7485577455257583596,16555152196284113005,524288 --field-trial-handle=2292,i,9089362275459834104,9158121072567246060,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:14
      4⤵
      PID:2544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3776,i,6732265878477483796,17401273071924634056,524288 --field-trial-handle=2292,i,9089362275459834104,9158121072567246060,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:14
      4⤵
      PID:4532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4228,i,9627674967436229002,2255287469486003106,524288 --field-trial-handle=2292,i,9089362275459834104,9158121072567246060,262144 --variations-seed-version --mojo-platform-channel-handle=6888 /prefetch:14
      4⤵
      PID:1832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6896,i,12929619177383505445,6529905971263957210,524288 --field-trial-handle=2292,i,9089362275459834104,9158121072567246060,262144 --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:14
      4⤵
      PID:3912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6892,i,15258045422716811165,16174123274475617757,262144 --field-trial-handle=2292,i,9089362275459834104,9158121072567246060,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:10
      4⤵
      PID:4284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,4189254124729455408,8163349195313654030,524288 --field-trial-handle=2292,i,9089362275459834104,9158121072567246060,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:14
      4⤵
      PID:1220

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3980

C:\Temp\omhezwrpjhbzurmj.sys
C:\Temp\omhezwrpjhbzurmj.sys
1⤵
- Executes dropped EXE
PID:1976

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3328

C:\Temp\ojgbztrljd.sys
C:\Temp\ojgbztrljd.sys
1⤵
- Executes dropped EXE
PID:5348

C:\Temp\ljdbvtrljg.sys
C:\Temp\ljdbvtrljg.sys
1⤵
- Executes dropped EXE
PID:4364

C:\Temp\wqolfdbytq.sys
C:\Temp\wqolfdbytq.sys
1⤵
- Executes dropped EXE
PID:3440

C:\Temp\tnlfdavsnl.sys
C:\Temp\tnlfdavsnl.sys
1⤵
- Executes dropped EXE
PID:932

C:\Temp\kfdxvpnhfz.sys
C:\Temp\kfdxvpnhfz.sys
1⤵
- Executes dropped EXE
PID:1268

C:\Temp\kifaxspkhf.sys
C:\Temp\kifaxspkhf.sys
1⤵
- Executes dropped EXE
PID:3380

C:\Temp\kecwuspkhf.sys
C:\Temp\kecwuspkhf.sys
1⤵
- Executes dropped EXE
PID:2064

C:\Temp\mjhbzxrpmh.sys
C:\Temp\mjhbzxrpmh.sys
1⤵
- Executes dropped EXE
PID:4320

C:\Temp\uomgeywqoj.sys
C:\Temp\uomgeywqoj.sys
1⤵
- Executes dropped EXE
PID:4764

C:\Temp\trljdbwtrl.sys
C:\Temp\trljdbwtrl.sys
1⤵
- Executes dropped EXE
PID:5968

C:\Temp\qligbywqoi.sys
C:\Temp\qligbywqoi.sys
1⤵
PID:1396

C:\Temp\lfdxvqnlfd.sys
C:\Temp\lfdxvqnlfd.sys
1⤵
PID:940

C:\Temp\kfdavsqkic.sys
C:\Temp\kfdavsqkic.sys
1⤵
PID:796

C:\Temp\spnhfaxsqk.sys
C:\Temp\spnhfaxsqk.sys
1⤵
PID:5852

C:\Temp\hfzxvpmkec.sys
C:\Temp\hfzxvpmkec.sys
1⤵
PID:5972

C:\Temp\pmhezxrpjh.sys
C:\Temp\pmhezxrpjh.sys
1⤵
PID:1196

C:\Temp\bztrmjebzw.sys
C:\Temp\bztrmjebzw.sys
1⤵
PID:5580

C:\Temp\gebwtoljeb.sys
C:\Temp\gebwtoljeb.sys
1⤵
PID:572

C:\Temp\bytrligbyw.sys
C:\Temp\bytrligbyw.sys
1⤵
PID:5868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bvtnlgdbyt.exe

Path C:\Temp\bvtnlgdbyt.exe
Size 384KB
SHA256 bd9e5d483e42d465373ac2837c93cf400a7b188498e18c829cb82626629f70ac
MD5 930eaf0b2d629a3f0eb983ae0879f418
SHA1 111623e69e975f09f4eb8bdf3374dd16cd4ae748
SHA512 43eb0492e4e9fbe38194736c0fb5c314b86faae1a2fb357182027c552f0131071decf404178ccb947cb0504c85b43fa3378bf67a3d2c8eccae13e0e244fbc8d9
SSDEEP 3072:ibtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:ibtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T141847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC3F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbytqolgdy.exe

Path C:\Temp\dbytqolgdy.exe
Size 384KB
SHA256 d7d0c5f05e550009a2c80d59918f67e70ef9eb0be74e0737b56ce746c3d1f782
MD5 31ee7b5f9cbb0ac1797888664083fd90
SHA1 9350fc25f6b128be80b7cf199ba7a906be0cece7
SHA512 083cb0edbdc1ca8aceb5159ddd41984cd1b5c2f5b4977bdbd759b88d1e06183764e196cb90de105ad4366497cca53ba151b493fd6b37bc5f0480d24e8fc35f8c
SSDEEP 3072:6btF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:6btt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T164847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

faxvpnhfzx.exe

Path C:\Temp\faxvpnhfzx.exe
Size 384KB
SHA256 84a6599defa2736f08670783d20e74d1a40509fb0b9f96413fb4963f882ac809
MD5 64a60fdc03e13fb966c42509e9b194e4
SHA1 732136231cd88b7418d962613b5244232d8139d9
SHA512 a400b92e3605773aab17d31fb3b09a29406c596770c9c25e40bd694b44b633d9f48ca9c3c243592ed65bc87359a34d9cfd1b7fc24f4f7b040bb1658c2db5bc1b
SSDEEP 3072:NbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:Nbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C6847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC3F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bvtnlgdbyt.exe

Path C:\Temp\i_bvtnlgdbyt.exe
Size 384KB
SHA256 e455ca3a03dc0bc30aaf94ff3e44eec260a765901231d57429c2218d5148e56e
MD5 f51f7339f2ddba8f24a941a408515f58
SHA1 86b0df8a89ebfbac0d5e0e2ea5a7914a87b32083
SHA512 bde54d5ea45fe032a0c81ad065ea59bd81fdff488216ab1ad205b1e4717b733f46b2e206fa10433dda3f9c9f9db369dc4d549895cb3a54e83020247dd6fb6b6b
SSDEEP 3072:QbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:Qbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D6847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dbytqolgdy.exe

Path C:\Temp\i_dbytqolgdy.exe
Size 384KB
SHA256 22731e3b296c58b14fde26ce714741e12a6a178a2597b7771cd353c422113808
MD5 ef87d05255af9f70b659ef5b5856b84e
SHA1 4751e8ac34e0d1cd905cd01f01d4d8c02fb0b54b
SHA512 9ffd91ecc929ebb6aaec6ffe2363da8eb6cfdb25cb9ebc647c1ba3c2006045508f4a4014c41c8d7ebc5cbabb17f3793a7c04ffce04ad8b8175f9448415447bab
SSDEEP 3072:CbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:Cbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T13B847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nlfavsnlfd.exe

Path C:\Temp\i_nlfavsnlfd.exe
Size 384KB
SHA256 149d653a7c10c9ea93830452dda6e057e8d6de152993838569f82b2d90ef4823
MD5 b17654673f5e748a20f0c154a8854bf3
SHA1 9ca02cd512ace84d45b139a97d4ff8a6910e85c3
SHA512 0de1d4efab39013c646f60df7c0a4551cdf1019769f0a50591341f049401c0bc4a5c44d7f25741bc0d7b3cdeeb57f290cd3725a439eef769993559c9bd131922
SSDEEP 3072:pbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:pbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1AB847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rpmgezwroj.exe

Path C:\Temp\i_rpmgezwroj.exe
Size 384KB
SHA256 26839bddb2a7ee3237f0a07c466d1992a547279f85c59374bc9707b47936acbb
MD5 ba7c75e70eabe165c8a5ae381a5ffd51
SHA1 f6343c786ad9df241e2c713e3ff037ad07ebe85e
SHA512 ffd7c941f77badb4b760c9906e563fbbe504331cf6cc5a4aea89035aed86a43c5ce534a7073dd4ddeec3c4e13563434d27800ded91d87238ebc5578cbdaf3333
SSDEEP 3072:VbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:Vbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1BC847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC3F754CE5D9A517C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_yvtnligayt.exe

Path C:\Temp\i_yvtnligayt.exe
Size 384KB
SHA256 f0d39d41f374860144157f3f1947ad80fcc878efa1afc89ee284c0310623e59b
MD5 a2ff2048109b03fb6d84118785a4a84a
SHA1 8b503024fa00e9866c081cba2961d5bc860cfca3
SHA512 1a54008bc88b9e5ac4095679a676d554a67ae768b8fd101d25177eacd41df31bf03a6d2bb5d4ed5d572f2e34e9a81a3ccec4703d2ffbfc0d5861002c22e6776a
SSDEEP 3072:ZbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:Zbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A3847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC3F754CE5D9A517C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kfdxvpnhfz.sys

Path C:\Temp\kfdxvpnhfz.sys
Size 293KB
SHA256 4306c14cc36f2bdfeda02791c3b3c5f81173b97dbc88436cf5aa324baa17c34a
MD5 3c39e58c0efc66f521b60aa05339995c
SHA1 8dd0d89388a9905e578f3bd0d7dbf16b34cfa1b6
SHA512 3ed416a734a591724b438a4da6733ba23bbbb9f4a473a85e251e138656d5bcbbc711d3a0fa898270cf798988b393ccf1e15eaae72358ddcb831fe8464635284a
SSDEEP 3072:itKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:iIJjiJcbI03GBc3ucY5DCSj
TLSH
T1FC545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljdbvtrljg.sys

Path C:\Temp\ljdbvtrljg.sys
Size 293KB
SHA256 9ef1e92d783d69efee8fa2eaf54b2363a0f2d0c02fc2518892024b9bfd022c6f
MD5 ef0aafa668373fb5cd91748c71a5c6b3
SHA1 e2054f12cf57015748a4fecc96be54a4e2067581
SHA512 ed0e34d1391a8bb1c67a52152feaae4990a9e3f58018165e6a38c2524732b5f5cdfc86b8e70e4a17c2f0b9d98748803274469096f44d63bd938cced6bb0caa4f
SSDEEP 3072:utKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:uIJjiJcbI03GBc3ucY5DCSj
TLSH
T134545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlfavsnlfd.exe

Path C:\Temp\nlfavsnlfd.exe
Size 384KB
SHA256 546f8012b852869e8a575484cce497511631878f236500bf517cfa5d901b6234
MD5 2ddd6b97bb5860c03dccfd5bf1e90ced
SHA1 9d46da1fb614c72479637a9ff7ba212ee139c343
SHA512 eb0a6a27ff2e533bbd8120cf3d22424949c7c4ec2b1ef4c58da07bba30592e9d4cdf2ce8028d3c9af22a07cb4d59aa94f66ab58785785eaf29830f5a558df074
SSDEEP 3072:fbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:fbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T13D847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ojgbztrljd.sys

Path C:\Temp\ojgbztrljd.sys
Size 293KB
SHA256 124be7a700dc3c89b6bce12420ff63ed4d38175c14bf7a30bd32532143e47b4f
MD5 27bb5cbe8731e70dc736ae31ffd4f2be
SHA1 a3fad7e91bd7b1caf22688e91eddca447d56b8b8
SHA512 64bdef8e0d99661fa6708db934c14246974dddd4064fddd5e9d3887b46828e9210b3448a0baaae516cf3144704be3d2bedf4af04f1691cf978e21f8480d8d7dc
SSDEEP 3072:rtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:rIJjiJcbI03GBc3ucY5DCSj
TLSH
T172545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omhezwrpjhbzurmj.exe

Path C:\Temp\omhezwrpjhbzurmj.exe
Size 384KB
SHA256 3812e94d5e1a2c58254b3ff9bac452fab3ac6111f7b5c41a7b68da60cb998b63
MD5 9a730097093aa52b341f51f2aea4d7ad
SHA1 8d0d7fffcde5dca17ae7fcc995bb030f9dc11c02
SHA512 f8d3d395531cbd22dc330647514b0d202edd8ec7030ad4751271b262bbac44a37d4cdcbf4f9d1f6286c287ec04f83df4e3b564846a00d471a7155d711baca2f7
SSDEEP 3072:UbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:Ubtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T180847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omhezwrpjhbzurmj.sys

Path C:\Temp\omhezwrpjhbzurmj.sys
Size 293KB
SHA256 4ecf19228c0de5c16984110fcc3f52a9404c92f48b423dfff3bb261604f8ee41
MD5 b35e0f25d68e2fbd16ee1c4fa9580a64
SHA1 dbfacacae8183674af06971d96260ea01260c85e
SHA512 327b5aade6ab07dc432926edccc2fae9efbe5a2c278de50ee1ba983ac23c6ab2ae801913d40506b867bdda305bc41b7037dd7d2d3ff945025bd67bbdcb62cd20
SSDEEP 3072:AtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:AIJjiJcbI03GBc3ucY5DCSj
TLSH
T165545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpmgezwroj.exe

Path C:\Temp\rpmgezwroj.exe
Size 384KB
SHA256 ca451219d11f9b032918560446c53ec42e4c6bbe56ea93de0d2157a03822763c
MD5 caf1813fc5af8bd92ce08ec35a847107
SHA1 9cf7db28752985bfcc04efe2bca35dfb5a14b3b0
SHA512 0eb00a28b275daf2fd377222dd7dff91661d8d642c974f5d118f50f648f5cc0af2bfb4f7b6529dba440b2048e5d4a065f59c29b76ad82a2c9381bddd2e9fe885
SSDEEP 3072:cbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:cbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T166847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnlfdavsnl.sys

Path C:\Temp\tnlfdavsnl.sys
Size 293KB
SHA256 3cd3ef8b87b9c86f3ecab55756ff65095187cdcb39469c77e76d7a3e528e2274
MD5 eaccddec3025d25aded9b9850effb111
SHA1 73c0b0e476c32e51fe369324bf6df11b28e05411
SHA512 96022b16f993f32c8e7a6b7eed72f4b63b2fd8e7fa881a1d4e8c492bb3a5eb5f200e403ed0c3389b9db9f354651829ca62f61511ce9380823b54f1097fe4ec6d
SSDEEP 3072:StKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:SIJjiJcbI03GBc3ucY5DCSj
TLSH
T1FA545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wqolfdbytq.sys

Path C:\Temp\wqolfdbytq.sys
Size 293KB
SHA256 40b864b7ba393cec43edd58ab5b30bef09c51a38c1b99a10caea9246bd761032
MD5 1d3d8d1bd35153e7b304f3b5999ef8fa
SHA1 63f1d738d5ffae02c0770766cde4fa7abf4bf284
SHA512 a646d10da9400baee6f749a40fd8f66cbf25b767082f8f41e61bfe70a448d34831eabe5d9bbb62be46585d5f50953505399d7e6b67eab4dfafc5b59485ec437c
SSDEEP 3072:YtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:YIJjiJcbI03GBc3ucY5DCSj
TLSH
T127545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yvtnligayt.exe

Path C:\Temp\yvtnligayt.exe
Size 384KB
SHA256 111e1031317309db2f6edf918880f3049b3a6300e76403019e26bf9d0f39c777
MD5 e55285cc284b43eb10a7981f4b30f163
SHA1 53b1dca396afea64a2e0751ba074ff98dbc3c7a8
SHA512 6001b7cd66309083f08a740d1d849f51690eb45b0c5ccddc4c7c11a03a4e23e1a55d70cd1e766e56c3c8550d37bfd4c360430730562cab79bfbec9df6fe99201
SSDEEP 3072:tbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:tbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T115847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC3F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fc0a38b9bd67def6f8a6da7a4a5956bc201e5aac4ba6f906946e52f5b14e13c2
MD5 1f96c275206494cbaa7386b7e675b940
SHA1 e11ab12226c05e6b54c67a266c2f75cfeb24b04a
SHA512 a117c9e9ceb3447431daa46611f5c54ed75796456b4251af5e1ed3f62b5c6cbe9ebccf949569237178ca2ca7feba8c9acb69940a8457c36a9156ef8fd98eb09c
TLSH
T188D02B3671684D13E0805278007111613882F405DF0601C01322982609902483010180
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0d0352bb5f4b47f3d1ca8042212dfbae37957031d48d7789bd6cd7b4b6cbbe31
MD5 32b3e4b238ee2f76e0152ca1b1ff9944
SHA1 78d56bdababf57c069ac4ad713ad9cdc3e3f04a0
SHA512 3e7b72969f35c769b07f0760fb1a06022e37e68e88be1bff45e02463b5358a671e4f84f6bad11b043a01370573d062084b864866961ee86cb12eceb980874f69
TLSH
T178D02B3A71584E13E0805274007011613892F405EF0601C01322581609902483011184
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 ae3ad97d94ce4933aed5c2000d527565922af6727a990b6cc4db045a2a056f12
MD5 8c7ac9cce7766e4097a13234794e1927
SHA1 3e3e27ff07818f65a1e9857ab4002680cdf32bec
SHA512 9385d9cd6b3ae887398e9b430511c73cc892fb34731eba1886a57b4611f7f8df1c251a19f015ae4ea3bffc171bdb99c73d01b409d9384fc83b4ffbcf46fdd182
TLSH
T1CF516211D6E44094FFA6D07886E0DC8BBF385E81B19F0E6307A5CBB8E74E3A90183C24
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599253.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe599253.TMP
Size 2KB
SHA256 129a8a5316c5fb90bfc5f7cf5f2986bd5c4291c95c1fb9dcee041fe7a474757c
MD5 204c7b04036cc0192f110a8e8a5ab0b8
SHA1 99006569fa3a49834872afb14b014adae34b1f49
SHA512 163e0c2f4d8a9c9c1d62b0867a9a3ec938e029947b30877d1a6d393f4e3425aa5b4f41c13a549e2f9531549ad4227577000c0f33ee5be389d90171c9df4a9558
TLSH
T178515351D6E44095FF66D47886E0DC8BBF385E81B19F0E6307A5CBB8E74E3A90183C64
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 17c26b4f7675000e12cc8cc1d4a2adfbd741fd715f8f596c6b026d71b17824b6
MD5 c1c52cb52843339083364e3503e3db77
SHA1 ea5c9fea3f9f30516e5721e787735ccaea7a28f4
SHA512 69e320dda8acf03a9bb6158c5d572eb71ce1944b67b8a67b9883ccfef101f7de0e182e442ff2592881334150af82316f00a03bd07dca3ea5bbfad1b71fae1e0b
TLSH
T15751AFF3C3E8866E890196F0AA18AE1BCE1D0955432C7D5AC8E4DF5B93E2471E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 5eacc7d278a5fea8b91be18ba291c63c60e34d7bd16a0d7b44bcfa23a102ad0a
MD5 0bfb2c4c8a06c196af6bd3664da60b33
SHA1 632aac8548b843fb9347a06e59108c484db3358b
SHA512 c6d250d35634a015a9e388ea4d5b8ad1813a4393a54fce58b2a5f3220ffce850694590b2bc156359f5255293beb484f6b18723fc169c4b3a77080b0ef54f7029
SSDEEP 192:sxRrRZCQ/fPsVnXZmq3czoA8p9i/g6+WNCe9/Yoz2GMuIgVyJ:sxRrmQ/fPsppV8/5d/CGM
TLSH
T15F32B615ED68A97B8CCBD219BB25BF53E6F91032A0D11E4CEAFC961C14E76DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 bb84928e2c66331305969c195f4e68440d6a30e1f769327f84c57c47af562ac1
MD5 652300e605137e737ff2972905a3d2aa
SHA1 80265340cd7b26d236230180621088db360c954b
SHA512 5c5f735536b3a15a417f1d7a42660ebbfaf939b3b1a0cf71933572810907a82dcaa8e6ccf7da4bc8ce852097d9a0b494200a75304ce1e303aa416a9904acf955
SSDEEP 192:sxRARZCQ/fPsXnXZmq3czoA8p9i/g6+WNCe9/Yoz2GMuIgD4yJ:sxRAmQ/fPs3pV8/5d/CGv
TLSH
T1C242D615ED68A97B8CCBD219BB55BF53E6F91032A0D11E4CEAFC961C04E76DD120380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 f5fdb32742b277ed1046ba7f36f710e236e48dca7c47d52faf6808285d0d6c94
MD5 1ff675327c3aef027bce447d77bc98e8
SHA1 b72d44bb240de4b6a0ac3360f4beebbd1340c284
SHA512 5eac6138fe4f3fe77dbd9fc4f05046d3525f1a54c3cd38e9f2654d72966dc3660c36715131b7d88cef43b6f053443c104a604ab7a37fd69fed39d292e14cd861
SSDEEP 192:sxRARZCQ/fPsXTXZmq3czoA8p9i/g6+WNCe9/Yop2GMuIgDayJ:sxRAmQ/fPsjpV8/5d/oGR
TLSH
T1BB42D615ED68A97B8CCBE21DBB55BF53E6F91032A0D11E4CAAFC961C14E76CD120380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 cfe22b3dfa9bf5135a66b06700b529ac07eeb24e8a91931c75c47e54c1ceead3
MD5 0f60cb2f5ee9c124de5632b3236b3e4e
SHA1 24485316f3ee7f0cbdffff4b8a5a56f326583065
SHA512 ac393cd4d025b0c655841b5f8bfb24736e0e9dc1900141f66194e10863bb94a1186b889e3714096175ae00eedbcee2b782a7441b7a2f059e48944a72c4f5df05
SSDEEP 768:p/wWuO7pLuLbOnWg/Xf1p8F1+UoAYDCx9Tuqh0VfUC9xbog/OVyoXH3IVro87j/:p/wWuOEbOnWg/Xf1pu1japoXXIu87j/
TLSH
T15CD2EA7B740CCA7F4F804ADDDC197E9F6DA802CB9698CD8047FA985C02C67EA52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a589127c-6a5c-4fa2-9f94-bc25a39b00be.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\a589127c-6a5c-4fa2-9f94-bc25a39b00be.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 a22d0fcd33747ba4d20772bc7030695bc85aa732068328d4b928d22ab4671474
MD5 416f33a6b8ae7ee31d84dd72be82744a
SHA1 d1ccb35aa93521067423e0a57b26889598073f10
SHA512 62e277985182ff68b46bbbe52f34b6eff580a2ee5071b599c47de1227902e7902445768b1248b64b54fbee174095ec34288ffd5988317c4ff6f2c45dfc8f58b4
SSDEEP 768:H/UxvxjgC+P3E/oxAOT2NqX/9OA9at01j0iq00+Iaigc2sfN:6Zj3+P3EgQCHq00Navc2sfN
TLSH
T19F13CF31ECA59D33ACFAB254730A63C79FF41973C5C59AD889E91A0D04436AE270BC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 427ae8de1cc6438e7a9c3cd75a7dea9846c7b954c68cb714e827def25d4587bd
MD5 b8081b025c80bdcdea3fc6334de30b42
SHA1 6640ea5016535005d10520fcb18c6ff26842bb25
SHA512 b9db0a0531c5b04049d8ad2041e6fe34c12cbe67b41fd2062170973adee83adcb313703888bac7b3dee5ab203380710530ed6e0b3dc6213c3be6f370088c3991
SSDEEP 768:3FQU39wgMrEIOT2NqB/9OA9at01j0iq00+Iaigc2sJq:KU3InCHq00Navc2sJq
TLSH
T1671328F198E38A77E8AE5787633D6E468EBCC163B5889584B7D41D0CCC421BFD30A856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 b5f96ca6cfd5c88ff35c1eb1a391c9173efde06f02980b74e5b07378f6bfb5b4
MD5 3ae9ff2cdbeedcece952c08ebe60bc8b
SHA1 8d57801fc338faca701920305b72f252a6fc8a82
SHA512 fc3f9d84b0f5051357255488a836687c3ba6d0bf932de19ac5ca5b2b8f3cab3f5c84343831006b2538c357e04f89fbb9cbc7ab0a876e2fb55492b33de85d2797
SSDEEP 768:nC3ipAOT2Nqt/9OA9at01j0iq00+Iaigc2sJq:nC3iSCHq00Navc2sJq
TLSH
T18FF2BF70ECB5CE736CFAB285730667835FF41567C5C99AC4C9E92A0E00036AA270BC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 def118b564352668288be421a2a227de4d3e1a0639fdefbf337282f82275a6a5
MD5 51e6beee774b207613355ccee4356e76
SHA1 f122fa7cb64668043fabc7fbc5a348227fbfdbd5
SHA512 e0a867699640ac05f415dbb4db0991ac6c8e17cb8c8a33829ba202b358d21ef5a981ae88f451983ae808b5aefb776bc2fd6a103d9af017f6974e8ea30f916f98
SSDEEP 768:X/UxvxjgC+H3+97OT2e/9OA9at01j0iq00+Ia2geSHxRz:KZj3+H3+jCHq00NareSTz
TLSH
T1AC03C031ECA19D739CF7B384730A63879FF44663C6C96A9449ED2A0E01876AD1307CA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 023ede8d5735f2a47ae6aed95257be20f8b7edb56a68725f86588421fc0560af
MD5 cede0d3420bc956ad4b5be481af9c5ab
SHA1 f0cb7be401aeb55112704562e1c8b0394397c3c2
SHA512 699be4bf5f5b924c44cef9c3d37e5d09d130d58124ca5173a3a95b11184ba22709c47de2347eff339cda976306485357fe4ac373f08c6a48548dc88e78fd39ab
SSDEEP 768:bC37pAOT2Nqt/9OA9at01j0iq00+Iaigc2sJq:bC37SCHq00Navc2sJq
TLSH
T121F2BF71ECB5DE736CFAB285730667835FF41567D5C99AC4C8E92A0E00036AA270BC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

725ef235-f839-4d82-8e31-fbb1cff2cc81.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\725ef235-f839-4d82-8e31-fbb1cff2cc81.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1692_1021098595\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 04c27dbc8b813b6bbe2151ede1b754e8436a8f5f98351d143c05202a1bc90ef5
MD5 9dc83fae87d2f5249caf78bdeaa1104b
SHA1 bea411f55a9464cde547c2245ccf681da19c99b5
SHA512 699bbf0bd5ece10aab64b7babf633aca2b70e77c5778377c9f7ac1a2b20dc7bf00edfb4162fc26805de559f3c7142f895b07619f78226538aeb835d9a5a43dba
TLSH
T1C371008356A8C5F2C2DE5FF502835648F1FB22784B2330300B515546AB30A7A28B8F08
MD5 SHA1 SHA512 TLSH

Submit Download

memory/572-485-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/572-466-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/796-404-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/932-273-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/940-400-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1196-440-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1268-285-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1396-375-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1976-64-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2064-314-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3380-310-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3380-316-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3440-260-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4320-319-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4364-232-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4364-266-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4764-334-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5348-185-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5580-462-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5852-424-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5868-483-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5968-363-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5972-457-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5972-435-0x0000000000010000-0x00000000000AB000-memory.dmp

Download