systex | 9f200d2fd29ff4bc77fdab209c61dfb6671d9538f5a8d9d6bbee489dc8d5959b

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 12:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-30_4029a842aa086912c6b60c4c16ca0ece_amadey_darkgate_elex_smoke-loader_stop.exe
Size 384KB
Sample260930-n89ppawcnf
SHA256 9f200d2fd29ff4bc77fdab209c61dfb6671d9538f5a8d9d6bbee489dc8d5959b
MD5 4029a842aa086912c6b60c4c16ca0ece
SHA1 9682dca7db2dce10f03fc77217e464b6ebed275a
SHA512 7e7dee1ad926d80d6018c4a16b101125e6b38aa8d9889c0031fe54fcb9722931774c693d4e347d0e78bfda5250b4246257e6ddf93671a8bb09eb4ba2a226e770
SSDEEP 3072:5btF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:5btt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F3847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
5620	gbytrljdbvtolgdy.exe
2580	gbytrljdbvtolgdy.sys
3768	CreateProcess.exe
5768	bwtoljdbyt.exe
832	CreateProcess.exe
4160	CreateProcess.exe
5648	i_bwtoljdbyt.exe
2816	nlfayvqoig.sys
2564	CreateProcess.exe
4332	igbytqljdb.exe
5628	CreateProcess.exe
2404	CreateProcess.exe
5968	i_igbytqljdb.exe
4584	nifaxvqnlf.sys
5876	CreateProcess.exe
5008	fdxvtnifay.exe
2488	CreateProcess.exe
1980	CreateProcess.exe
3572	i_fdxvtnifay.exe
2472	spnkfdxvsn.sys
4788	CreateProcess.exe
1836	spkhfdxusq.exe
3428	CreateProcess.exe
5792	CreateProcess.exe
2820	i_spkhfdxusq.exe
2768	zxvsnkfdxv.sys
4336	CreateProcess.exe
3904	pkhczusmke.exe
4656	CreateProcess.exe
1532	CreateProcess.exe
3276	i_pkhczusmke.exe
3892	kecwupmkhc.sys
5776	CreateProcess.exe
1116	hecwuspmhe.exe
4720	CreateProcess.exe
5956	CreateProcess.exe
2960	i_hecwuspmhe.exe
2464	hezwrpjhbz.sys
400	CreateProcess.exe
3284	ezwrojhbzt.exe
5272	CreateProcess.exe
6128	CreateProcess.exe
1728	i_ezwrojhbzt.exe
5528	trljhbywur.sys
5300	CreateProcess.exe
1832	ywtrojgebw.exe
4844	CreateProcess.exe
960	CreateProcess.exe
4216	i_ywtrojgebw.exe
1876	geywqomywq.sys
3392	CreateProcess.exe
2500	trljdbvtrl.exe
876	CreateProcess.exe
4884	CreateProcess.exe
2324	i_trljdbvtrl.exe
3700	qoigdbvtol.sys
1312	CreateProcess.exe
6104	qoigaykiga.exe
696	CreateProcess.exe
5348	CreateProcess.exe
3804	i_qoigaykiga.exe
4544	dyvqoigays.sys
4556	CreateProcess.exe
1412	vtqkidavtn.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_1433435152\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_1433435152\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_152602562\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_320958068\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_1433435152\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_320958068\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_83319307\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_83319307\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4900_1433435152\llm_user_input_extractor_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtqkidavtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifaysqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxvtnifay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spkhfdxusq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pkhczusmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hecwuspmhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezwrojhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmhezxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwtoljdbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igbytqljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hecwuspmhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljdbvtrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cxupmhezwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqlidbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spkhfdxusq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywtrojgebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-30_4029a842aa086912c6b60c4c16ca0ece_amadey_darkgate_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwtoljdbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_causpkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmhezxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbzwrpjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqoigbytrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifaysqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbytrljdbvtolgdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igbytqljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywtrojgebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxupmhezwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbzwrpjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqoigdbytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvtnifay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljdbvtrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqoigbytrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pkhczusmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezwrojhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigaykiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqoigdbytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigaykiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtqkidavtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causpkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqlidbvt.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4652	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3848	ipconfig.exe
3788	ipconfig.exe
3972	ipconfig.exe
5360	ipconfig.exe
5952	ipconfig.exe
5668	ipconfig.exe
4072	ipconfig.exe
5104	ipconfig.exe
1520	ipconfig.exe
1564	ipconfig.exe
1500	ipconfig.exe
5664	ipconfig.exe
2708	ipconfig.exe
5624	ipconfig.exe
4288	ipconfig.exe
108	ipconfig.exe
4544	ipconfig.exe
2688	ipconfig.exe
2052	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1404337215-1550464601-2805570857-1000\{57C58B74-3109-4993-94BC-932EB73E1D3C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4136	2026-09-30_4029a842aa086912c6b60c4c16ca0ece_amadey_darkgate_elex_smoke-loader_stop.exe
4136	2026-09-30_4029a842aa086912c6b60c4c16ca0ece_amadey_darkgate_elex_smoke-loader_stop.exe
4136	2026-09-30_4029a842aa086912c6b60c4c16ca0ece_amadey_darkgate_elex_smoke-loader_stop.exe
4136	2026-09-30_4029a842aa086912c6b60c4c16ca0ece_amadey_darkgate_elex_smoke-loader_stop.exe
4136	2026-09-30_4029a842aa086912c6b60c4c16ca0ece_amadey_darkgate_elex_smoke-loader_stop.exe
4136	2026-09-30_4029a842aa086912c6b60c4c16ca0ece_amadey_darkgate_elex_smoke-loader_stop.exe
4136	2026-09-30_4029a842aa086912c6b60c4c16ca0ece_amadey_darkgate_elex_smoke-loader_stop.exe
4136	2026-09-30_4029a842aa086912c6b60c4c16ca0ece_amadey_darkgate_elex_smoke-loader_stop.exe
4136	2026-09-30_4029a842aa086912c6b60c4c16ca0ece_amadey_darkgate_elex_smoke-loader_stop.exe
4136	2026-09-30_4029a842aa086912c6b60c4c16ca0ece_amadey_darkgate_elex_smoke-loader_stop.exe
4136	2026-09-30_4029a842aa086912c6b60c4c16ca0ece_amadey_darkgate_elex_smoke-loader_stop.exe
4136	2026-09-30_4029a842aa086912c6b60c4c16ca0ece_amadey_darkgate_elex_smoke-loader_stop.exe
4136	2026-09-30_4029a842aa086912c6b60c4c16ca0ece_amadey_darkgate_elex_smoke-loader_stop.exe
4136	2026-09-30_4029a842aa086912c6b60c4c16ca0ece_amadey_darkgate_elex_smoke-loader_stop.exe
4136	2026-09-30_4029a842aa086912c6b60c4c16ca0ece_amadey_darkgate_elex_smoke-loader_stop.exe
4136	2026-09-30_4029a842aa086912c6b60c4c16ca0ece_amadey_darkgate_elex_smoke-loader_stop.exe
4136	2026-09-30_4029a842aa086912c6b60c4c16ca0ece_amadey_darkgate_elex_smoke-loader_stop.exe
4136	2026-09-30_4029a842aa086912c6b60c4c16ca0ece_amadey_darkgate_elex_smoke-loader_stop.exe
4136	2026-09-30_4029a842aa086912c6b60c4c16ca0ece_amadey_darkgate_elex_smoke-loader_stop.exe
4136	2026-09-30_4029a842aa086912c6b60c4c16ca0ece_amadey_darkgate_elex_smoke-loader_stop.exe
4136	2026-09-30_4029a842aa086912c6b60c4c16ca0ece_amadey_darkgate_elex_smoke-loader_stop.exe
4136	2026-09-30_4029a842aa086912c6b60c4c16ca0ece_amadey_darkgate_elex_smoke-loader_stop.exe
4136	2026-09-30_4029a842aa086912c6b60c4c16ca0ece_amadey_darkgate_elex_smoke-loader_stop.exe
4136	2026-09-30_4029a842aa086912c6b60c4c16ca0ece_amadey_darkgate_elex_smoke-loader_stop.exe
4136	2026-09-30_4029a842aa086912c6b60c4c16ca0ece_amadey_darkgate_elex_smoke-loader_stop.exe
4136	2026-09-30_4029a842aa086912c6b60c4c16ca0ece_amadey_darkgate_elex_smoke-loader_stop.exe
4136	2026-09-30_4029a842aa086912c6b60c4c16ca0ece_amadey_darkgate_elex_smoke-loader_stop.exe
4136	2026-09-30_4029a842aa086912c6b60c4c16ca0ece_amadey_darkgate_elex_smoke-loader_stop.exe
4136	2026-09-30_4029a842aa086912c6b60c4c16ca0ece_amadey_darkgate_elex_smoke-loader_stop.exe
4136	2026-09-30_4029a842aa086912c6b60c4c16ca0ece_amadey_darkgate_elex_smoke-loader_stop.exe
4136	2026-09-30_4029a842aa086912c6b60c4c16ca0ece_amadey_darkgate_elex_smoke-loader_stop.exe
4136	2026-09-30_4029a842aa086912c6b60c4c16ca0ece_amadey_darkgate_elex_smoke-loader_stop.exe
4136	2026-09-30_4029a842aa086912c6b60c4c16ca0ece_amadey_darkgate_elex_smoke-loader_stop.exe
4136	2026-09-30_4029a842aa086912c6b60c4c16ca0ece_amadey_darkgate_elex_smoke-loader_stop.exe
4136	2026-09-30_4029a842aa086912c6b60c4c16ca0ece_amadey_darkgate_elex_smoke-loader_stop.exe
4136	2026-09-30_4029a842aa086912c6b60c4c16ca0ece_amadey_darkgate_elex_smoke-loader_stop.exe
4136	2026-09-30_4029a842aa086912c6b60c4c16ca0ece_amadey_darkgate_elex_smoke-loader_stop.exe
4136	2026-09-30_4029a842aa086912c6b60c4c16ca0ece_amadey_darkgate_elex_smoke-loader_stop.exe
4136	2026-09-30_4029a842aa086912c6b60c4c16ca0ece_amadey_darkgate_elex_smoke-loader_stop.exe
4136	2026-09-30_4029a842aa086912c6b60c4c16ca0ece_amadey_darkgate_elex_smoke-loader_stop.exe
4136	2026-09-30_4029a842aa086912c6b60c4c16ca0ece_amadey_darkgate_elex_smoke-loader_stop.exe
4136	2026-09-30_4029a842aa086912c6b60c4c16ca0ece_amadey_darkgate_elex_smoke-loader_stop.exe
4136	2026-09-30_4029a842aa086912c6b60c4c16ca0ece_amadey_darkgate_elex_smoke-loader_stop.exe
4136	2026-09-30_4029a842aa086912c6b60c4c16ca0ece_amadey_darkgate_elex_smoke-loader_stop.exe
4136	2026-09-30_4029a842aa086912c6b60c4c16ca0ece_amadey_darkgate_elex_smoke-loader_stop.exe
4136	2026-09-30_4029a842aa086912c6b60c4c16ca0ece_amadey_darkgate_elex_smoke-loader_stop.exe
4136	2026-09-30_4029a842aa086912c6b60c4c16ca0ece_amadey_darkgate_elex_smoke-loader_stop.exe
4136	2026-09-30_4029a842aa086912c6b60c4c16ca0ece_amadey_darkgate_elex_smoke-loader_stop.exe
4136	2026-09-30_4029a842aa086912c6b60c4c16ca0ece_amadey_darkgate_elex_smoke-loader_stop.exe
4136	2026-09-30_4029a842aa086912c6b60c4c16ca0ece_amadey_darkgate_elex_smoke-loader_stop.exe
4136	2026-09-30_4029a842aa086912c6b60c4c16ca0ece_amadey_darkgate_elex_smoke-loader_stop.exe
4136	2026-09-30_4029a842aa086912c6b60c4c16ca0ece_amadey_darkgate_elex_smoke-loader_stop.exe
4136	2026-09-30_4029a842aa086912c6b60c4c16ca0ece_amadey_darkgate_elex_smoke-loader_stop.exe
4136	2026-09-30_4029a842aa086912c6b60c4c16ca0ece_amadey_darkgate_elex_smoke-loader_stop.exe
5620	gbytrljdbvtolgdy.exe
5620	gbytrljdbvtolgdy.exe
5620	gbytrljdbvtolgdy.exe
4136	2026-09-30_4029a842aa086912c6b60c4c16ca0ece_amadey_darkgate_elex_smoke-loader_stop.exe
4136	2026-09-30_4029a842aa086912c6b60c4c16ca0ece_amadey_darkgate_elex_smoke-loader_stop.exe
5620	gbytrljdbvtolgdy.exe
5620	gbytrljdbvtolgdy.exe
5620	gbytrljdbvtolgdy.exe
5620	gbytrljdbvtolgdy.exe
5620	gbytrljdbvtolgdy.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	5648	i_bwtoljdbyt.exe
Token: SeDebugPrivilege	5968	i_igbytqljdb.exe
Token: SeDebugPrivilege	3572	i_fdxvtnifay.exe
Token: SeDebugPrivilege	2820	i_spkhfdxusq.exe
Token: SeDebugPrivilege	3276	i_pkhczusmke.exe
Token: SeDebugPrivilege	2960	i_hecwuspmhe.exe
Token: SeDebugPrivilege	1728	i_ezwrojhbzt.exe
Token: SeDebugPrivilege	4216	i_ywtrojgebw.exe
Token: SeDebugPrivilege	2324	i_trljdbvtrl.exe
Token: SeDebugPrivilege	3804	i_qoigaykiga.exe
Token: SeDebugPrivilege	3412	i_vtqkidavtn.exe
Token: SeDebugPrivilege	4072	i_ifaysqkica.exe
Token: SeDebugPrivilege	4148	i_causpkhcau.exe
Token: SeDebugPrivilege	5376	i_cxupmhezwr.exe
Token: SeDebugPrivilege	5604	i_pmhezxrpjh.exe
Token: SeDebugPrivilege	2620	i_hbzwrpjhbz.exe
Token: SeDebugPrivilege	5864	i_wqoigbytrl.exe
Token: SeDebugPrivilege	3452	i_tqoigdbytq.exe
Token: SeDebugPrivilege	5644	i_aysqlidbvt.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4900	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4136 wrote to memory of 5620	4136	2026-09-30_4029a842aa086912c6b60c4c16ca0ece_amadey_darkgate_elex_smoke-loader_stop.exe	89
PID 4136 wrote to memory of 4840	4136	2026-09-30_4029a842aa086912c6b60c4c16ca0ece_amadey_darkgate_elex_smoke-loader_stop.exe	90
PID 4840 wrote to memory of 4900	4840	iexplore.exe	91
PID 4900 wrote to memory of 5408	4900	msedge.exe	92
PID 4900 wrote to memory of 4652	4900	msedge.exe	93
PID 4900 wrote to memory of 4684	4900	msedge.exe	94
PID 4900 wrote to memory of 4684	4900	msedge.exe	94
PID 4900 wrote to memory of 4684	4900	msedge.exe	94
PID 4900 wrote to memory of 2988	4900	msedge.exe	95
PID 4900 wrote to memory of 2988	4900	msedge.exe	95
PID 4900 wrote to memory of 2396	4900	msedge.exe	97
PID 4900 wrote to memory of 1924	4900	msedge.exe	98
PID 4900 wrote to memory of 2396	4900	msedge.exe	97
PID 4900 wrote to memory of 2396	4900	msedge.exe	97
PID 4900 wrote to memory of 1924	4900	msedge.exe	98
PID 4900 wrote to memory of 1924	4900	msedge.exe	98
PID 4900 wrote to memory of 1300	4900	msedge.exe	99
PID 4900 wrote to memory of 4496	4900	msedge.exe	100
PID 4900 wrote to memory of 1300	4900	msedge.exe	99
PID 4900 wrote to memory of 1300	4900	msedge.exe	99
PID 4900 wrote to memory of 4496	4900	msedge.exe	100
PID 4900 wrote to memory of 4496	4900	msedge.exe	100
PID 4900 wrote to memory of 1776	4900	msedge.exe	101
PID 4900 wrote to memory of 1776	4900	msedge.exe	101
PID 4900 wrote to memory of 2688	4900	msedge.exe	106
PID 4900 wrote to memory of 5380	4900	msedge.exe	105
PID 4900 wrote to memory of 2688	4900	msedge.exe	106
PID 4900 wrote to memory of 5380	4900	msedge.exe	105
PID 5620 wrote to memory of 3768	5620	gbytrljdbvtolgdy.exe	107
PID 5768 wrote to memory of 832	5768	bwtoljdbyt.exe	110
PID 4900 wrote to memory of 3192	4900	msedge.exe	114
PID 4900 wrote to memory of 5936	4900	msedge.exe	115
PID 4900 wrote to memory of 5936	4900	msedge.exe	115
PID 4900 wrote to memory of 3744	4900	msedge.exe	116
PID 4900 wrote to memory of 3744	4900	msedge.exe	116
PID 5620 wrote to memory of 4160	5620	gbytrljdbvtolgdy.exe	119
PID 5620 wrote to memory of 2564	5620	gbytrljdbvtolgdy.exe	123
PID 4332 wrote to memory of 5628	4332	igbytqljdb.exe	125
PID 5620 wrote to memory of 2404	5620	gbytrljdbvtolgdy.exe	128
PID 5620 wrote to memory of 5876	5620	gbytrljdbvtolgdy.exe	132
PID 5008 wrote to memory of 2488	5008	fdxvtnifay.exe	134
PID 5620 wrote to memory of 1980	5620	gbytrljdbvtolgdy.exe	137
PID 5620 wrote to memory of 4788	5620	gbytrljdbvtolgdy.exe	142
PID 1836 wrote to memory of 3428	1836	spkhfdxusq.exe	144
PID 5620 wrote to memory of 5792	5620	gbytrljdbvtolgdy.exe	147
PID 4900 wrote to memory of 3412	4900	msedge.exe	149
PID 4900 wrote to memory of 4300	4900	msedge.exe	150
PID 4900 wrote to memory of 5708	4900	msedge.exe	151
PID 5620 wrote to memory of 4336	5620	gbytrljdbvtolgdy.exe	154
PID 3904 wrote to memory of 4656	3904	pkhczusmke.exe	156
PID 5620 wrote to memory of 1532	5620	gbytrljdbvtolgdy.exe	159
PID 5620 wrote to memory of 5776	5620	gbytrljdbvtolgdy.exe	163
PID 1116 wrote to memory of 4720	1116	hecwuspmhe.exe	165
PID 5620 wrote to memory of 5956	5620	gbytrljdbvtolgdy.exe	168
PID 5620 wrote to memory of 400	5620	gbytrljdbvtolgdy.exe	172
PID 3284 wrote to memory of 5272	3284	ezwrojhbzt.exe	174
PID 5620 wrote to memory of 6128	5620	gbytrljdbvtolgdy.exe	177
PID 5620 wrote to memory of 5300	5620	gbytrljdbvtolgdy.exe	181
PID 1832 wrote to memory of 4844	1832	ywtrojgebw.exe	183
PID 5620 wrote to memory of 960	5620	gbytrljdbvtolgdy.exe	186
PID 4900 wrote to memory of 4728	4900	msedge.exe	188
PID 4900 wrote to memory of 4728	4900	msedge.exe	188
PID 5620 wrote to memory of 3392	5620	gbytrljdbvtolgdy.exe	194
PID 2500 wrote to memory of 876	2500	trljdbvtrl.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-09-30_4029a842aa086912c6b60c4c16ca0ece_amadey_darkgate_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_4029a842aa086912c6b60c4c16ca0ece_amadey_darkgate_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Temp\gbytrljdbvtolgdy.exe
  C:\Temp\gbytrljdbvtolgdy.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5620
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bwtoljdbyt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3768
  - - C:\Temp\bwtoljdbyt.exe
      C:\Temp\bwtoljdbyt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5768
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:832
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3972
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bwtoljdbyt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4160
  - - C:\Temp\i_bwtoljdbyt.exe
      C:\Temp\i_bwtoljdbyt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5648
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\igbytqljdb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2564
  - - C:\Temp\igbytqljdb.exe
      C:\Temp\igbytqljdb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4332
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5628
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5624
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_igbytqljdb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2404
  - - C:\Temp\i_igbytqljdb.exe
      C:\Temp\i_igbytqljdb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5968
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fdxvtnifay.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5876
  - - C:\Temp\fdxvtnifay.exe
      C:\Temp\fdxvtnifay.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5008
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2488
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5360
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fdxvtnifay.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1980
  - - C:\Temp\i_fdxvtnifay.exe
      C:\Temp\i_fdxvtnifay.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3572
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\spkhfdxusq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4788
  - - C:\Temp\spkhfdxusq.exe
      C:\Temp\spkhfdxusq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1836
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3428
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5952
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_spkhfdxusq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5792
  - - C:\Temp\i_spkhfdxusq.exe
      C:\Temp\i_spkhfdxusq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2820
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pkhczusmke.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4336
  - - C:\Temp\pkhczusmke.exe
      C:\Temp\pkhczusmke.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3904
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4656
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4544
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pkhczusmke.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1532
  - - C:\Temp\i_pkhczusmke.exe
      C:\Temp\i_pkhczusmke.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3276
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hecwuspmhe.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5776
  - - C:\Temp\hecwuspmhe.exe
      C:\Temp\hecwuspmhe.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1116
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4720
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4288
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hecwuspmhe.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5956
  - - C:\Temp\i_hecwuspmhe.exe
      C:\Temp\i_hecwuspmhe.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2960
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ezwrojhbzt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:400
  - - C:\Temp\ezwrojhbzt.exe
      C:\Temp\ezwrojhbzt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3284
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5272
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5668
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ezwrojhbzt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6128
  - - C:\Temp\i_ezwrojhbzt.exe
      C:\Temp\i_ezwrojhbzt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1728
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ywtrojgebw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5300
  - - C:\Temp\ywtrojgebw.exe
      C:\Temp\ywtrojgebw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1832
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4844
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2688
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ywtrojgebw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:960
  - - C:\Temp\i_ywtrojgebw.exe
      C:\Temp\i_ywtrojgebw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4216
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\trljdbvtrl.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3392
  - - C:\Temp\trljdbvtrl.exe
      C:\Temp\trljdbvtrl.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2500
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:876
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:108
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_trljdbvtrl.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4884
  - - C:\Temp\i_trljdbvtrl.exe
      C:\Temp\i_trljdbvtrl.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2324
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qoigaykiga.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1312
  - - C:\Temp\qoigaykiga.exe
      C:\Temp\qoigaykiga.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:6104
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:696
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4072
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qoigaykiga.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5348
  - - C:\Temp\i_qoigaykiga.exe
      C:\Temp\i_qoigaykiga.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3804
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtqkidavtn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4556
  - - C:\Temp\vtqkidavtn.exe
      C:\Temp\vtqkidavtn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1412
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2900
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3848
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtqkidavtn.exe ups_ins
    3⤵
    PID:3304
  - - C:\Temp\i_vtqkidavtn.exe
      C:\Temp\i_vtqkidavtn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3412
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ifaysqkica.exe ups_run
    3⤵
    PID:5288
  - - C:\Temp\ifaysqkica.exe
      C:\Temp\ifaysqkica.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5820
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5268
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1520
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ifaysqkica.exe ups_ins
    3⤵
    PID:5100
  - - C:\Temp\i_ifaysqkica.exe
      C:\Temp\i_ifaysqkica.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4072
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\causpkhcau.exe ups_run
    3⤵
    PID:3744
  - - C:\Temp\causpkhcau.exe
      C:\Temp\causpkhcau.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2000
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5364
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3788
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_causpkhcau.exe ups_ins
    3⤵
    PID:4644
  - - C:\Temp\i_causpkhcau.exe
      C:\Temp\i_causpkhcau.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4148
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cxupmhezwr.exe ups_run
    3⤵
    PID:2644
  - - C:\Temp\cxupmhezwr.exe
      C:\Temp\cxupmhezwr.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2412
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3564
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2708
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cxupmhezwr.exe ups_ins
    3⤵
    PID:4196
  - - C:\Temp\i_cxupmhezwr.exe
      C:\Temp\i_cxupmhezwr.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5376
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pmhezxrpjh.exe ups_run
    3⤵
    PID:1880
  - - C:\Temp\pmhezxrpjh.exe
      C:\Temp\pmhezxrpjh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2560
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3592
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5104
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pmhezxrpjh.exe ups_ins
    3⤵
    PID:8
  - - C:\Temp\i_pmhezxrpjh.exe
      C:\Temp\i_pmhezxrpjh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5604
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hbzwrpjhbz.exe ups_run
    3⤵
    PID:5148
  - - C:\Temp\hbzwrpjhbz.exe
      C:\Temp\hbzwrpjhbz.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5024
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2908
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1564
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hbzwrpjhbz.exe ups_ins
    3⤵
    PID:3804
  - - C:\Temp\i_hbzwrpjhbz.exe
      C:\Temp\i_hbzwrpjhbz.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2620
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wqoigbytrl.exe ups_run
    3⤵
    PID:3848
  - - C:\Temp\wqoigbytrl.exe
      C:\Temp\wqoigbytrl.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2844
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4772
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1500
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wqoigbytrl.exe ups_ins
    3⤵
    PID:5708
  - - C:\Temp\i_wqoigbytrl.exe
      C:\Temp\i_wqoigbytrl.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5864
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tqoigdbytq.exe ups_run
    3⤵
    PID:5416
  - - C:\Temp\tqoigdbytq.exe
      C:\Temp\tqoigdbytq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2096
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2544
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2052
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tqoigdbytq.exe ups_ins
    3⤵
    PID:2296
  - - C:\Temp\i_tqoigdbytq.exe
      C:\Temp\i_tqoigdbytq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3452
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\aysqlidbvt.exe ups_run
    3⤵
    PID:4588
  - - C:\Temp\aysqlidbvt.exe
      C:\Temp\aysqlidbvt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5188
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1100
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5664
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_aysqlidbvt.exe ups_ins
    3⤵
    PID:6056
  - - C:\Temp\i_aysqlidbvt.exe
      C:\Temp\i_aysqlidbvt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5644
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffa35b7c188,0x7ffa35b7c194,0x7ffa35b7c1a0
      4⤵
      PID:5408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,4859752569851824807,9327373623910604095,524288 --field-trial-handle=2576,i,3502559923691745322,13107975027889178301,262144 --variations-seed-version --mojo-platform-channel-handle=2720 /prefetch:11
      4⤵
      System Time Discovery
      PID:4652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,9052939936609506957,236733639859270632,262144 --field-trial-handle=2576,i,3502559923691745322,13107975027889178301,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:2
      4⤵
      PID:4684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2248,i,3280822834869620672,8301730149304609510,524288 --field-trial-handle=2576,i,3502559923691745322,13107975027889178301,262144 --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:13
      4⤵
      PID:2988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=2556,i,2141502325162167104,6383050923702016183,2097152 --field-trial-handle=2576,i,3502559923691745322,13107975027889178301,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
      4⤵
      PID:2396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,14859764250582875733,6957777347916991715,2097152 --field-trial-handle=2576,i,3502559923691745322,13107975027889178301,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
      4⤵
      PID:1924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,13744124207039578962,5175545408805420220,2097152 --field-trial-handle=2576,i,3502559923691745322,13107975027889178301,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:1
      4⤵
      PID:1300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,17332249615704006317,17320934451694651886,2097152 --field-trial-handle=2576,i,3502559923691745322,13107975027889178301,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:9
      4⤵
      PID:4496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,1495834737663075542,14402469290786729230,524288 --field-trial-handle=2576,i,3502559923691745322,13107975027889178301,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:14
      4⤵
      PID:1776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3724,i,11613901206090848960,7759066850833892049,524288 --field-trial-handle=2576,i,3502559923691745322,13107975027889178301,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:14
      4⤵
      PID:5380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3712,i,17851726410390050155,7313945695896535549,524288 --field-trial-handle=2576,i,3502559923691745322,13107975027889178301,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:14
      4⤵
      PID:2688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,1816506089619030145,8627922706561278736,524288 --field-trial-handle=2576,i,3502559923691745322,13107975027889178301,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
      4⤵
      PID:4924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,1816506089619030145,8627922706561278736,524288 --field-trial-handle=2576,i,3502559923691745322,13107975027889178301,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
      4⤵
      PID:3192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,8221749516942745762,5756928628402655742,524288 --field-trial-handle=2576,i,3502559923691745322,13107975027889178301,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:14
      4⤵
      PID:5936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6620,i,15483848696184594723,6188150726935518744,524288 --field-trial-handle=2576,i,3502559923691745322,13107975027889178301,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:14
      4⤵
      PID:3744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4516,i,6812002909935043178,13152889741943871794,524288 --field-trial-handle=2576,i,3502559923691745322,13107975027889178301,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
      4⤵
      PID:3412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4556,i,17573592015943382002,9733794594234240034,524288 --field-trial-handle=2576,i,3502559923691745322,13107975027889178301,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:14
      4⤵
      PID:4300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,17607962750955627806,10128129775237554196,524288 --field-trial-handle=2576,i,3502559923691745322,13107975027889178301,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:14
      4⤵
      PID:5708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4036,i,3250089110385123295,1826128458280852104,524288 --field-trial-handle=2576,i,3502559923691745322,13107975027889178301,262144 --variations-seed-version --mojo-platform-channel-handle=4040 /prefetch:14
      4⤵
      PID:4728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,11331251551812750514,2931084588803364360,524288 --field-trial-handle=2576,i,3502559923691745322,13107975027889178301,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:14
      4⤵
      PID:2904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,7648245274368985737,13537099076197989579,524288 --field-trial-handle=2576,i,3502559923691745322,13107975027889178301,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:14
      4⤵
      PID:5864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=948,i,2678558453042570115,13442595788378746673,524288 --field-trial-handle=2576,i,3502559923691745322,13107975027889178301,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:14
      4⤵
      PID:108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6060,i,6942322621503075529,16950578831710584955,262144 --field-trial-handle=2576,i,3502559923691745322,13107975027889178301,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:10
      4⤵
      PID:1348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,8224830970249354373,5301678307920740891,524288 --field-trial-handle=2576,i,3502559923691745322,13107975027889178301,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:14
      4⤵
      PID:4824

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1680

C:\Temp\gbytrljdbvtolgdy.sys
C:\Temp\gbytrljdbvtolgdy.sys
1⤵
- Executes dropped EXE
PID:2580

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4896

C:\Temp\nlfayvqoig.sys
C:\Temp\nlfayvqoig.sys
1⤵
- Executes dropped EXE
PID:2816

C:\Temp\nifaxvqnlf.sys
C:\Temp\nifaxvqnlf.sys
1⤵
- Executes dropped EXE
PID:4584

C:\Temp\spnkfdxvsn.sys
C:\Temp\spnkfdxvsn.sys
1⤵
- Executes dropped EXE
PID:2472

C:\Temp\zxvsnkfdxv.sys
C:\Temp\zxvsnkfdxv.sys
1⤵
- Executes dropped EXE
PID:2768

C:\Temp\kecwupmkhc.sys
C:\Temp\kecwupmkhc.sys
1⤵
- Executes dropped EXE
PID:3892

C:\Temp\hezwrpjhbz.sys
C:\Temp\hezwrpjhbz.sys
1⤵
- Executes dropped EXE
PID:2464

C:\Temp\trljhbywur.sys
C:\Temp\trljhbywur.sys
1⤵
- Executes dropped EXE
PID:5528

C:\Temp\geywqomywq.sys
C:\Temp\geywqomywq.sys
1⤵
- Executes dropped EXE
PID:1876

C:\Temp\qoigdbvtol.sys
C:\Temp\qoigdbvtol.sys
1⤵
- Executes dropped EXE
PID:3700

C:\Temp\dyvqoigays.sys
C:\Temp\dyvqoigays.sys
1⤵
- Executes dropped EXE
PID:4544

C:\Temp\qkicaysqki.sys
C:\Temp\qkicaysqki.sys
1⤵
PID:6008

C:\Temp\fcxupnkica.sys
C:\Temp\fcxupnkica.sys
1⤵
PID:248

C:\Temp\hecauspjhe.sys
C:\Temp\hecauspjhe.sys
1⤵
PID:5284

C:\Temp\omhezwrpjh.sys
C:\Temp\omhezwrpjh.sys
1⤵
PID:124

C:\Temp\ebzwrpjhbz.sys
C:\Temp\ebzwrpjhbz.sys
1⤵
PID:4988

C:\Temp\bwtoljdbwr.sys
C:\Temp\bwtoljdbwr.sys
1⤵
PID:3316

C:\Temp\dywtolgdyv.sys
C:\Temp\dywtolgdyv.sys
1⤵
PID:5652

C:\Temp\dywqnigays.sys
C:\Temp\dywqnigays.sys
1⤵
PID:5392

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bwtoljdbyt.exe

Path C:\Temp\bwtoljdbyt.exe
Size 384KB
SHA256 2f179ace90ff66703f12c88d0b723013fb2e9eabed12a511b508f08fcc9c24b8
MD5 4ad7ae39d00274286a5ab01a209417a5
SHA1 90ea028593031b57ddebfb419fb583217d72bbdc
SHA512 16f83a92e37a4efd70cbe12c8816a3b4607a26943da8dce786e6743cf53c105cf069d0d94462f74ecc6bc83b3b1a70d09975f83ef173e47a869389a41fb66358
SSDEEP 3072:VbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:Vbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T18D847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdxvtnifay.exe

Path C:\Temp\fdxvtnifay.exe
Size 384KB
SHA256 293b6e85ecf53a322e63cafc2d35f0d42adf559cb6bbe8d7ccb95e689cc22064
MD5 5b4593455a7eacb7d479dd3babfda0a3
SHA1 ab422f9fac7e96065f1b45a6166f7d198ae22069
SHA512 a411ad24960654c3843c97cc7ce4373104c42f07f8e814d7e2b7dd31f77fd50cc656c674a631347d630ca4a7839dfebd8e33623b0c8df9952199e8afbcce7615
SSDEEP 3072:JbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:Jbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1FD847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC3F754CE5D9A517C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbytrljdbvtolgdy.exe

Path C:\Temp\gbytrljdbvtolgdy.exe
Size 384KB
SHA256 33c46fa8e538ba45b694d5e58cf85b70ee321ddbadc75c94d7fe5d0e0d933018
MD5 22ab75e02d24573fefa0a0d8db4c868f
SHA1 47ed183515a2908632c10df23f9719cd1dfb7c38
SHA512 3b8bf4cc4bb39b4b83e3372d5949e6cba2cbbb3e3d229cb10265385e53a30d5b66e9f7072768fed2dec894863d491d8fd36ec3fd46c82b4480545104e43bebcd
SSDEEP 3072:KbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:Kbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T176847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbytrljdbvtolgdy.sys

Path C:\Temp\gbytrljdbvtolgdy.sys
Size 293KB
SHA256 0c800b0af12f07c7d3ca4788bebf946d1c7ed583f994ede5040a237a25f92158
MD5 bfae4da415609d37a050fd1cde69aa1a
SHA1 4ff1f0c1cbee7df05e650ad905d2cfb6bd3ca93f
SHA512 5d0870ee76d5756b844ff054a7ec4ed23adf3ab71faf25982010013bc0ff525f2c03b9cc4652f3c8f874106711b3226d79d54fc60df7ad7327c894fcae636682
SSDEEP 3072:ptKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:pIJjiJcbI03GBc3ucY5DCSj
TLSH
T1BC545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hecwuspmhe.exe

Path C:\Temp\hecwuspmhe.exe
Size 384KB
SHA256 032ca9cce42790a761de93a8d0f0942e2153885c834d8733b1f9af6695f5072c
MD5 9a7dedc77f131331397722370d66e804
SHA1 835e4b85cccd45737aba7fd047c4fd566cb51667
SHA512 e39d7086e5a526df867e8f80177aed06c40deff5b8c126bdaaef9206f34d313a581e8bb36de0326f30b18e0e754b726488c72a3381bd81ab28f45d4441942815
SSDEEP 3072:MbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:Mbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A8847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bwtoljdbyt.exe

Path C:\Temp\i_bwtoljdbyt.exe
Size 384KB
SHA256 8ba6ffa2d157effd1acb808710ee9846f000d57c2c138346c807c6d821284988
MD5 c4769e3ff5379e1f65f7c3ac5af7f816
SHA1 3b14536e93d0b15628357ede9896a3f955903eab
SHA512 2a23a5a7acc6016b04a25892eff76be4addf0e61dfdc0d0e53bc84f0cd813be468a78862277ffaef924a8397393d058e26f7963d9968fcf139c0c61a734e6aef
SSDEEP 3072:mbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:mbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C3847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F354CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fdxvtnifay.exe

Path C:\Temp\i_fdxvtnifay.exe
Size 384KB
SHA256 4b87ba6f21e2bb115b7dc5726484769794698981a0c0d857a58da89ce98c862c
MD5 7bd580ef4972e5f7c7db2ae2e05f43aa
SHA1 7d335b25e7720986980a32ee4e26e1755c216cf2
SHA512 0e304d8047a2b3ab753022489558914633c297527af4d963f66525e2d2248d52650b054f7012fcef56a1d81bb2c25ac2095e945f87c5677df3ca19a84538dbac
SSDEEP 3072:mbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:mbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T172847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC3F354CE5D9A517C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_igbytqljdb.exe

Path C:\Temp\i_igbytqljdb.exe
Size 384KB
SHA256 654c06f34e2e7423bb6e1d41b4cc36a60e7ce04178db8e0c9d74d0645b50c8f8
MD5 230b6395c9e93a81ebc0dfe36706d8de
SHA1 79b0d7f61622c52b101b393e6ec38c764f744a6b
SHA512 a16cf2b59748b23d57fe0ad06d41c6567176dcd48eed59eaf70b877d48138a0c787f1e3a08972518c12d9af00f3d58c73706a3f8aec485c1fef2fef79928fda5
SSDEEP 3072:PbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:Pbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A4847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F354CE5D9A517C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pkhczusmke.exe

Path C:\Temp\i_pkhczusmke.exe
Size 384KB
SHA256 aaea60e7ec26dec59a5991f5e017bf4503cf414576ced33ca0e9fb6920b26e30
MD5 7161c3805ef7ca06436628ff540536f2
SHA1 df10d38a22f594e40b3f6262b5e6bade23101c3b
SHA512 892dd36747803ae3f399e539239d63351980ba1a19961b323ce6091bb1fecf867ee57988e4ee3eaea6d4612b0c410cf1b15c6685acb9ea3cba828318769715d0
SSDEEP 3072:9btF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:9btt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T148847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F354CE5D9A517C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_spkhfdxusq.exe

Path C:\Temp\i_spkhfdxusq.exe
Size 384KB
SHA256 4cf5dfe3ad2753c4e1071ddee429e763e1ef3987aafa08d8710c7b71fe27ce10
MD5 f1b97677d795cd1c9d79add565a81d54
SHA1 c44522f06db94e45630e72df5dc837e73b4263bf
SHA512 0e0be9a1f83f309ed1943474734300652e4b39683139bfbb5f8863b2ce347af05fa213c30128f1efe0f3a2763082c815b4eb69fd8c4d0d20880e53af521420bf
SSDEEP 3072:PbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:Pbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T13D847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F354CE5D9A517C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igbytqljdb.exe

Path C:\Temp\igbytqljdb.exe
Size 384KB
SHA256 104ed46b2b8d36e4938257a69eb74d055f4a2b25e6771cbc0364f27ad10f628b
MD5 00b4d18c415490eb18647102f0703e23
SHA1 e5e66b7b1c2e9c234e367dfdb31c55c347c12bc4
SHA512 f20cc409368443fc015ddd5f7b53bda919edce407f67f58da9d25bda4b73e0222422aab71f5251e83d79c0b8d7b171ddf83a943ad37d3488d3367b453fe34db5
SSDEEP 3072:XbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:Xbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A4847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC3F754CE5D9A517C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kecwupmkhc.sys

Path C:\Temp\kecwupmkhc.sys
Size 293KB
SHA256 6a34d675b788f3ef303607ae836bceb7c1f1ed1348694ec1bb013d4eddf4fd72
MD5 49544eca87cf5a9e48bc7d004ba75030
SHA1 8ae9f30582d1153a80d4aa118cddd6b204c48f5e
SHA512 549d4a462fa49b30ad844c6e0ef0e509d02cfb88b6f90ceea427f485add1a6b154cdaa76d390dcd71f5f9d6ac8c6ec0efb0c832af48a02a83fb59924366bd6a0
SSDEEP 3072:PtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:PIJjiJcbI03GBc3ucY5DCSj
TLSH
T112545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nifaxvqnlf.sys

Path C:\Temp\nifaxvqnlf.sys
Size 293KB
SHA256 6c88474ab4338b1802de0780d0a66c39d746fb4bf57df2d2d0541d95f91fd42d
MD5 7cc7a196308afcff3374ac24e5910ca7
SHA1 d62ea248cd4c52bc935e13705b96a463f68a4703
SHA512 f2b84d415d1cc6bcc09d8e0b1b22decbebad95d24dd30d00db3292818382656bc445ca2013fd358397294bdba364c0cf09c35268d9dab47e4971c58b044d058e
SSDEEP 3072:htKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:hIJjiJcbI03GBc3ucY5DCSj
TLSH
T190545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlfayvqoig.sys

Path C:\Temp\nlfayvqoig.sys
Size 293KB
SHA256 80cffc27ef5421dfbb1277f874fae821d1f3d8420ffb8288d869148a037a2f8c
MD5 b4e3238a2c895242bd146d90858966b9
SHA1 b646dd1154d7dd5e4ad655d21d8c22bff3ba30fc
SHA512 d00529cd9c8f59ff53ae30e6f99ad6960e1993e2e98459a36ff1a162543aaed53c778a8121227c6f92ba3b825a9cbd17b54b6a71e38480fe1dba443af29ce0bd
SSDEEP 3072:rtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:rIJjiJcbI03GBc3ucY5DCSj
TLSH
T1B3545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkhczusmke.exe

Path C:\Temp\pkhczusmke.exe
Size 384KB
SHA256 d30a344eb035bed16486f90a84f0505cac8edc3a936a7828ac6b2fbe17bd84c2
MD5 75f912a24a71c4622405f3e417acb256
SHA1 01fe27150b96a31923ad342b2f31de47a37717ef
SHA512 999fc9f6449104ec0b0b0a47e08a75762848cb301b1e00585655abb980e424b14907a6d3e935cf6d10ed6d20558f8b1893434ff1717109df69b41375abee9221
SSDEEP 3072:8btF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:8btt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T173847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F354CE5D9A517C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spkhfdxusq.exe

Path C:\Temp\spkhfdxusq.exe
Size 384KB
SHA256 9d5b0cf65dc023ed6eaa368594fd5322e88772eddde478cc186183a61257c387
MD5 009049ad7ec3ec28ffed03ea36e9ff21
SHA1 2e1545bb1dbedc72946c415f3cdfe8560af76758
SHA512 15ddc1f75de4433a8ce830dc911fd7289da4d689dd0346559eabc5d4c544c9bbc223046d5c909cfa57327e8c0d6debde89fe5ae2b81e9e6609b392f56a4022ab
SSDEEP 3072:JbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:Jbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E1847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC3F754CE5D9A517C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spnkfdxvsn.sys

Path C:\Temp\spnkfdxvsn.sys
Size 293KB
SHA256 85ed0beb9b64c200490aa45c78287914f5d0859ce3bacda2db5aa2c87f6801dd
MD5 199bc4d26af6295c0d85a70a3868cebf
SHA1 b572db1c5861312328742f8c2ad906b88ffd8b99
SHA512 f1ade7afce9941e164c6d15274e32026fc6e7d3a053f20067143e03e9abac4e4298a11a7c7de0c86994eeaa285c287499fd90555bac8916174e35b5240f73077
SSDEEP 3072:ItKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:IIJjiJcbI03GBc3ucY5DCSj
TLSH
T1E7545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxvsnkfdxv.sys

Path C:\Temp\zxvsnkfdxv.sys
Size 293KB
SHA256 73ee20eeb046cd1b09590c237f4f67b105a156ef3482470ec5a95f0beda087fd
MD5 a5df391c2e8ca1b48a782d9e3eda6c5a
SHA1 506e93cf188c47faee8fb1c6739759b151c266d6
SHA512 bbe405c6c6cfe3c632180ff3e843d2563af82cfbec89baec807459e0630da3712de28aac2d6df3a980b69e32e9d969ddc8601d0722285e7c17dbf443057cbd06
SSDEEP 3072:4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:4IJjiJcbI03GBc3ucY5DCSj
TLSH
T1F6545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a0b193400a27c0cdf94ac11f5fb5b0747828b5b461169cefeffb96191b9e4834
MD5 edaab58c014c1abbfa900853b2ab2696
SHA1 e35eb02c0343d109af1ddd7dbd39dee3b989aea3
SHA512 b3cca7ed39fd4708b9c01cbefd67aab972f585372e01b5fa39d4a0840a7f579725d1202ab2916cda4e7635fb16dbc74178888461c7b6a2b3ea91d273ce2909ea
TLSH
T1BBD02B75F96ECC23E85204F940D24208329775818C0441812601CC080A603850000182
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 932f01682de6215b2c3b5faeb96a07b886e28db2ff6f8242a36da556c4292464
MD5 667b54168424526a7188593696f59ace
SHA1 deeb9f5ad1bccaabad57a386f08ba0c0740b2f81
SHA512 698f5a88d262c546b9bf21ead67e8dbe00ce6bd13f196761a5910f59ff69ca7532cacdf03c070f8d3b9f5d4fb8990b358e9b60ace9e48a0848e4a9da1d92b3ed
TLSH
T1D4D02B79F95ECD23E85204F540D1420832A77581DC04418125018C080A603850001182
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 4ab40a54f1345c2dabe80b630fcce2eba7cf9819a31cb2dd4c61c8c665c1e9ee
MD5 ab7c475ba0b27557864f256f9979306a
SHA1 5cd6f1d575d90953b318f5709a44d4bdc1e31029
SHA512 d9649b7fcf687273235c732728ab7d9e8f4522cc2d191b54522fc5094830ee0c9f9259e30ae6d51cdbe39db2cbfc50c3c56d786278e287f11469556fb23508a0
TLSH
T18E519780E1A0644DF7B94BB250DA128FF7308F8AD0079EAE3A98CC75E946B10B43C55B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59ca6a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59ca6a.TMP
Size 2KB
SHA256 a3ac0f8f66549b7d92dbce6abe4bed1e3af140498d2df66653b23e28c529b142
MD5 a5445ee09cce8397dbcd67b2d4c995b0
SHA1 8d23327ecd5bf5967d1b3925e1210a1c1999b95a
SHA512 9ca177f5798c6594314253383df2acd25a688d330f6ec8c245aceabcc2346b5531b450a025fb8348fc4d4c6db2cc8360feb9e4bc04ba07047958c5325dd07549
TLSH
T1E1519780A5A0244DF7B94BB250DA128FF7308F8AD4439EAE3A98CC75E946B10B43C15B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 330e1c2477f5d9040deee7c0c3cc4db4f9a1e97bc5e8675499c70ec3aa12f700
MD5 a051563f7fc5a46b97cde7ae24f2fc7f
SHA1 4e51ada2ea47b95796ad6ca93932d4a96135b0a7
SHA512 cf91800e44aa8d778338e9705e7b057475be5582ca8c6e6102dfd912e5fca6bf9f2aef06423b04a84fcea282f0c18e4aad7f9a83bae694c0f457891fe52d2f3c
TLSH
T15351DEF7C3E8866D8D0156F0AA187E2BCE2D0914432C3D5AC8E4AE1B93E2471E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 a8801f6ae6a263eae8bd6c1761119949a7969fd2c55efd7969a49f8113c2b42b
MD5 f88fad513e8217f0a74b4c4e678d3e08
SHA1 bdf5d9484ea4d6173cc632648970e18f4345fcad
SHA512 8ccfa452e46ef657b6eb084fdd19ef6c6a035b7e6341f24d0900c1c4aed9d3b760520de3789d84849c0727c023f529b529a991148c01c6ff54e0310f34b6720a
SSDEEP 192:sxRNRNCu/f/sScZQlP6YezoA8p9P/g6+WNC9V/YEUvGmIgDl+J:sxRNCu/f/sSiY6K1/5C/KE
TLSH
T1A142D855AE28A97B8CCBD31DBB65BF53D2F91072A1D51E48A6FC861C04E76CD2203C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 dcf9d79c5dd0345cbb32d30989a4604fc0d2e9ebfc963cff5d64ab2af0d62c5a
MD5 b93500c0ff37c01186f2a9ba8e656d77
SHA1 c81487fb04b335ce78cf7baa20ce46c0e4948474
SHA512 1fe20bffddc774e284d82564ce7cbe35a3ad63c8e4f92262215a54ef2ccd116817e019ad7af7cd9441f5831069a80cf87e339bcdcf10dc6ecc74ee122291c14a
SSDEEP 192:sxRNRNCu/f/s7gcZQlP6YezoA8p9P/g6+WNC9V/YEfvGmIgD/+J:sxRNCu/f/s0iY6K1/5C/3u
TLSH
T15D42D955AE28A97B8CCBD31DBB65BF53D2F91072A1D51E48A6FC861C05E76CD2203C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 61889ba4d37d723fe60734aeff502d874b4e7129be758a646674f04e27a849b7
MD5 73ce3332c45164cb8ddccbbce0f976de
SHA1 9609d201966fc1870395e0d910c6ad52081dafd8
SHA512 a1a4a86b6b722ea763b42ecbd2b9a8101d0a8453fcfddc98c51296d9d254e4bcaa57b9c43e3ff51cfa246a8a2b1c24c416f6882266b64d6ba5214696fe9c88f3
SSDEEP 192:sxRmRNCu/f/sscZQlP6YezoA8p9P/g6+WNC9V/YEUvGmIgV+J:sxRmCu/f/ssiY6K1/5C/Ko
TLSH
T17B42D915AE28A97B8CCBD31DBB65BF53D2F91132A1D51E48A6FC861C04E76CD2207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 b55d228bb1733f4f25ee3035b4a1eebe192ae8e9481ebabd629a082e7e58893d
MD5 9bbfac981c244ca787ad62ada1871d7d
SHA1 174944332ecb0a2832d8d31454bfdf04e61262ec
SHA512 2799f63a7f9222d99f7bc9d4686c02155d1f91c003f41e6227af72c938d9cc1e53346f1fca7bd237ed0b2e3f8b0d3d180bdd5791ed647cba26406ec37a62fd31
SSDEEP 768:U/pCbTx7pLuLbLmWg8KfrL8F1+UoAYDCx9Tuqh0VfUC9xbog/OVKwuyhpQroJFKe:U/pCbTnEbLmWg8KfrLu1jatwu8p77P
TLSH
T1E2D2D97B740CCB7F4F804ADDA8197ADA6D6902CB9A98CD4047FE941C02C77EB511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

10bcc55f-54a1-4fa1-96d4-fd9a73b37694.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\10bcc55f-54a1-4fa1-96d4-fd9a73b37694.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 0505a83c5b80066d468d80e4de7846272d49e6f9c990ca59a8ea27ca23a29a24
MD5 19792533af85280da5fa6ffbb75e8ead
SHA1 97851de321268cc70d1f294dc0c6d5c60845a5b9
SHA512 a908a679a1b2a329cf739ce0135649a4355424db40c909e33ed18a92393c8e09121869318e56034abd33cea21efd4a3c74f38e7a6e7563c2d0b747569008dc9b
SSDEEP 768:Zv3rUHc7fZrKlHPp5XSwQs88uBkiT2w2s0rz:Zv3r7trkxILNBt2s8z
TLSH
T129F2BF34FCA48CB36CFA9381768A67426FF06157D8C40A98C5DEA71E018775E2B4BC5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 4294df51b67610ff35fa6c8b4797d98d5fb4fefc97eda42876676a35c68fcf15
MD5 fdadb1d6d91ffbfb058572fbe26ca0c8
SHA1 b83abc7b3a3da395a445868b1c2a8614f1727d1d
SHA512 5e96d4d1ce7edb167c0ad23ababbbd68230abf1389b986337a2c5af4919ce7c83a62dc74e0b57f1a4487484a0b039cabf4bd0c61fcf77e3460f845d04073a749
SSDEEP 768:1v3/UHc7fZrKlHPp5XSwQs88uBkiT2w2s0rz:1v3/7trkxILNBt2s8z
TLSH
T12EF2BF35FCA58CB36CFA9381768A27426FF06157D8C40A98C5DEA70E018775E2B4BC5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 e872c9d78a81e5646881ce5bdeacacf55d91f3b576c99697ba4cc52e7f25cb6a
MD5 d65d47fb305cfbf40b0fb36537b6b83b
SHA1 3a7ab8f98d5abed7083bbb5ab3bde5232e81a3a5
SHA512 dc067ab3d7a933f32f837a8a2259d870166c1951c0b4286c1ec04dee71a01f01d93849e28b8670c87977960f69093cc80a2f8a63676baff7edb15d49f8a5b100
SSDEEP 768:R/UxvxjgC+W3l8ec7fZrKtp5XSwQs88uBkiTC0G/P84g:kZj3+W3lWtr6ILNBUHg
TLSH
T1C303D039F8946873ACF39385365A275BAFF05153C4C40BA849EE7A0E028B75DA707897
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 f954b020a06570dccbe0e1c4d8e3c96dfebfffecc81963035470330b15f257b8
MD5 a7c8ca7c7dcc504e02657c8ad2539dfd
SHA1 361c45e9c99ae8e8f3544ad2587474aeb273811f
SHA512 8777df323813da0fe78bcaceb3d11c9ca2d32b8574ae55c6c029e8fe348863b99c3451347eade1f11cf3f16af0315033b80f7b378dc7ba0513f4ef398e4e438b
SSDEEP 768:4v3kGHc7fZrKlHGp5XSwQs88uBkiT2w2s0rz:4v3khtrkYILNBt2s8z
TLSH
T125F2BF35F8A58CA36CFA9381768A27426FF06157D8C80A98C5DDA70E018775E2B4BC5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 1d3d285c87640cecd3450f496307c7fe93f7ba697fbcf730553d0834c08aa49a
MD5 9d5de1e8c8cea2fc5e12a92c9ec789e8
SHA1 1e67021d639c9d34b2eab84f45bda19c52fe0ea2
SHA512 9ea41f17bf2dc2a53ea9ae48f18bb66016bd74f037a5a656e9622405bd547d0cbf94435c2b546984b450f860c9fce85ba16e6cf035381fe62acfe3c706fa60b3
SSDEEP 768:WFHy35wg63j5erKlHUkp5XSwQs88uBkiT2w2s0rz:ay3ysrk0KILNBt2s8z
TLSH
T1A01338F598D38976E8AE4383677D6E429EBCD153B4884984F7C9590CCC822BFC70B856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

a74e162d-377a-4be8-94e2-f36d5fad8fc5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a74e162d-377a-4be8-94e2-f36d5fad8fc5.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4900_466710608\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 44716b13130cabb3d60a63f5a962ad5c84a566f20c8d0c3aa8ca89bf10a36002
MD5 b2c6ab8d56add9cab5686b297c5da411
SHA1 47dd9f05d32f1b621c397116391240a74332f3b2
SHA512 0c422cd951202d7a2736860c9c7ee7559f773c5ee923dc0344382506a11b84ba96eca84e80ac0fc4adb3cacec312d5eff0214cbf577bc3e8b6ea8b1a0df832d4
TLSH
T18B71C08356A9DAB2C1DA9BF512835644F6BB2238077370201B95598ABA30A7A58B8F14
MD5 SHA1 SHA512 TLSH

Submit Download

memory/124-426-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/248-411-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1876-330-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2464-310-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2472-261-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2580-62-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2768-273-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2816-185-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3316-465-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3700-354-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3892-311-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3892-302-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4544-363-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4584-225-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4988-446-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5284-422-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5392-489-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5528-315-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5652-477-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6008-390-0x0000000000010000-0x00000000000AB000-memory.dmp

Download