systex | f512f5cc0c8b7131cbe059632382bdb9a79a0feeda65ed31dfedef3e4311db83

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/10/2026, 14:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-30_54c62b8407976420fd64602ac1f09418_amadey_darkgate_elex_smoke-loader_stop.exe
Size 384KB
Sample261001-rl99gsvsct
SHA256 f512f5cc0c8b7131cbe059632382bdb9a79a0feeda65ed31dfedef3e4311db83
MD5 54c62b8407976420fd64602ac1f09418
SHA1 e6fda023ea42b5fabf6f5e3911549108cfc2d448
SHA512 b070eaa6b6ddcb34f89dd34196a855972375b5ea53107f998c926043f28d834dcbe0834fab40140c58952f984ca4a56567414100ae569d45a3c0f1c3b6f43c9b
SSDEEP 3072:pbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:pbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1CE847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
6120	dxvqnlidavsnlfdx.exe
3092	dxvqnlidavsnlfdx.sys
5296	CreateProcess.exe
2744	ifaysqkica.exe
5348	CreateProcess.exe
3616	CreateProcess.exe
4460	i_ifaysqkica.exe
2676	vsnkicavsn.sys
3880	CreateProcess.exe
2816	hfdxvsnkfc.exe
2544	CreateProcess.exe
2608	CreateProcess.exe
4360	i_hfdxvsnkfc.exe
2888	uspkicausp.sys
3092	CreateProcess.exe
4904	vpnhfzxvpf.exe
2656	CreateProcess.exe
5876	CreateProcess.exe
2860	i_vpnhfzxvpf.exe
4584	usmkfzxrpn.sys
1848	CreateProcess.exe
4544	usmkfcxupm.exe
4792	CreateProcess.exe
1488	CreateProcess.exe
4112	i_usmkfcxupm.exe
1732	mhezwuomjh.sys
2928	CreateProcess.exe
2888	jhbztrmgez.exe
5164	CreateProcess.exe
5224	CreateProcess.exe
2756	i_jhbztrmgez.exe
1912	omjebwuomg.sys
2000	CreateProcess.exe
5580	jdbwtomgey.exe
4952	CreateProcess.exe
5088	CreateProcess.exe
932	i_jdbwtomgey.exe
3452	mgeywuoljg.sys
4948	CreateProcess.exe
5520	jgebwtrojg.exe
4188	CreateProcess.exe
3628	CreateProcess.exe
3376	i_jgebwtrojg.exe
4464	toljdaywqo.sys
5952	CreateProcess.exe
1732	vtolgdywqo.exe
3196	CreateProcess.exe
2716	CreateProcess.exe
2856	i_vtolgdywqo.exe
5400	igayvtnlfd.sys
2356	CreateProcess.exe
984	vtqligayvq.exe
3860	CreateProcess.exe
4540	CreateProcess.exe
5924	i_vtqligayvq.exe
6100	xvqfaxsqki.sys
5968	CreateProcess.exe
2416	kicaxsqkic.exe
4360	CreateProcess.exe
5124	CreateProcess.exe
4884	i_kicaxsqkic.exe
5816	nkfcausnkf.sys
1216	CreateProcess.exe
4584	qkiusnkfcx.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2924_145450414\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2924_145450414\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2924_935200740\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2924_980599955\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2924_980599955\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2924_252497231\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2924_252497231\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2924_252497231\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2924_376090571\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2924_935200740\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2924_980599955\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2924_980599955\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2924_252497231\sets.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtolgdywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgebztrojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_davsnlfaxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdavsnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtqligayvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkiusnkfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmkfcxupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicaxsqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgeywrojhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgeyvtoljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_khczurmjec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgeywrojhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lfdyvqnljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	davsnlfaxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfdxvsnkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhbztrmgez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbwtomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgebwtrojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kicaxsqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgebztrojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-30_54c62b8407976420fd64602ac1f09418_amadey_darkgate_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxvqnlidavsnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtqligayvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgeyvtoljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifaysqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpnhfzxvpf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgebwtrojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtolgdywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkiusnkfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfzxusmkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	khczurmjec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfdxvsnkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhbztrmgez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfzxusmkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lfdyvqnljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdavsnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifaysqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpnhfzxvpf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmkfcxupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbwtomgey.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2736	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3980	ipconfig.exe
5816	ipconfig.exe
2076	ipconfig.exe
1604	ipconfig.exe
1292	ipconfig.exe
4332	ipconfig.exe
1524	ipconfig.exe
4980	ipconfig.exe
4456	ipconfig.exe
5872	ipconfig.exe
2456	ipconfig.exe
4580	ipconfig.exe
5272	ipconfig.exe
3564	ipconfig.exe
1684	ipconfig.exe
6084	ipconfig.exe
3376	ipconfig.exe
3972	ipconfig.exe
5316	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-650287814-2715975232-1279715623-1000\{A787157F-0020-452F-8240-EA92286BC6CE}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1548	2026-09-30_54c62b8407976420fd64602ac1f09418_amadey_darkgate_elex_smoke-loader_stop.exe
1548	2026-09-30_54c62b8407976420fd64602ac1f09418_amadey_darkgate_elex_smoke-loader_stop.exe
1548	2026-09-30_54c62b8407976420fd64602ac1f09418_amadey_darkgate_elex_smoke-loader_stop.exe
1548	2026-09-30_54c62b8407976420fd64602ac1f09418_amadey_darkgate_elex_smoke-loader_stop.exe
1548	2026-09-30_54c62b8407976420fd64602ac1f09418_amadey_darkgate_elex_smoke-loader_stop.exe
1548	2026-09-30_54c62b8407976420fd64602ac1f09418_amadey_darkgate_elex_smoke-loader_stop.exe
1548	2026-09-30_54c62b8407976420fd64602ac1f09418_amadey_darkgate_elex_smoke-loader_stop.exe
1548	2026-09-30_54c62b8407976420fd64602ac1f09418_amadey_darkgate_elex_smoke-loader_stop.exe
1548	2026-09-30_54c62b8407976420fd64602ac1f09418_amadey_darkgate_elex_smoke-loader_stop.exe
1548	2026-09-30_54c62b8407976420fd64602ac1f09418_amadey_darkgate_elex_smoke-loader_stop.exe
1548	2026-09-30_54c62b8407976420fd64602ac1f09418_amadey_darkgate_elex_smoke-loader_stop.exe
1548	2026-09-30_54c62b8407976420fd64602ac1f09418_amadey_darkgate_elex_smoke-loader_stop.exe
1548	2026-09-30_54c62b8407976420fd64602ac1f09418_amadey_darkgate_elex_smoke-loader_stop.exe
1548	2026-09-30_54c62b8407976420fd64602ac1f09418_amadey_darkgate_elex_smoke-loader_stop.exe
1548	2026-09-30_54c62b8407976420fd64602ac1f09418_amadey_darkgate_elex_smoke-loader_stop.exe
1548	2026-09-30_54c62b8407976420fd64602ac1f09418_amadey_darkgate_elex_smoke-loader_stop.exe
1548	2026-09-30_54c62b8407976420fd64602ac1f09418_amadey_darkgate_elex_smoke-loader_stop.exe
1548	2026-09-30_54c62b8407976420fd64602ac1f09418_amadey_darkgate_elex_smoke-loader_stop.exe
1548	2026-09-30_54c62b8407976420fd64602ac1f09418_amadey_darkgate_elex_smoke-loader_stop.exe
1548	2026-09-30_54c62b8407976420fd64602ac1f09418_amadey_darkgate_elex_smoke-loader_stop.exe
1548	2026-09-30_54c62b8407976420fd64602ac1f09418_amadey_darkgate_elex_smoke-loader_stop.exe
1548	2026-09-30_54c62b8407976420fd64602ac1f09418_amadey_darkgate_elex_smoke-loader_stop.exe
1548	2026-09-30_54c62b8407976420fd64602ac1f09418_amadey_darkgate_elex_smoke-loader_stop.exe
1548	2026-09-30_54c62b8407976420fd64602ac1f09418_amadey_darkgate_elex_smoke-loader_stop.exe
1548	2026-09-30_54c62b8407976420fd64602ac1f09418_amadey_darkgate_elex_smoke-loader_stop.exe
1548	2026-09-30_54c62b8407976420fd64602ac1f09418_amadey_darkgate_elex_smoke-loader_stop.exe
1548	2026-09-30_54c62b8407976420fd64602ac1f09418_amadey_darkgate_elex_smoke-loader_stop.exe
1548	2026-09-30_54c62b8407976420fd64602ac1f09418_amadey_darkgate_elex_smoke-loader_stop.exe
1548	2026-09-30_54c62b8407976420fd64602ac1f09418_amadey_darkgate_elex_smoke-loader_stop.exe
1548	2026-09-30_54c62b8407976420fd64602ac1f09418_amadey_darkgate_elex_smoke-loader_stop.exe
1548	2026-09-30_54c62b8407976420fd64602ac1f09418_amadey_darkgate_elex_smoke-loader_stop.exe
1548	2026-09-30_54c62b8407976420fd64602ac1f09418_amadey_darkgate_elex_smoke-loader_stop.exe
1548	2026-09-30_54c62b8407976420fd64602ac1f09418_amadey_darkgate_elex_smoke-loader_stop.exe
1548	2026-09-30_54c62b8407976420fd64602ac1f09418_amadey_darkgate_elex_smoke-loader_stop.exe
1548	2026-09-30_54c62b8407976420fd64602ac1f09418_amadey_darkgate_elex_smoke-loader_stop.exe
1548	2026-09-30_54c62b8407976420fd64602ac1f09418_amadey_darkgate_elex_smoke-loader_stop.exe
1548	2026-09-30_54c62b8407976420fd64602ac1f09418_amadey_darkgate_elex_smoke-loader_stop.exe
1548	2026-09-30_54c62b8407976420fd64602ac1f09418_amadey_darkgate_elex_smoke-loader_stop.exe
1548	2026-09-30_54c62b8407976420fd64602ac1f09418_amadey_darkgate_elex_smoke-loader_stop.exe
1548	2026-09-30_54c62b8407976420fd64602ac1f09418_amadey_darkgate_elex_smoke-loader_stop.exe
1548	2026-09-30_54c62b8407976420fd64602ac1f09418_amadey_darkgate_elex_smoke-loader_stop.exe
1548	2026-09-30_54c62b8407976420fd64602ac1f09418_amadey_darkgate_elex_smoke-loader_stop.exe
1548	2026-09-30_54c62b8407976420fd64602ac1f09418_amadey_darkgate_elex_smoke-loader_stop.exe
1548	2026-09-30_54c62b8407976420fd64602ac1f09418_amadey_darkgate_elex_smoke-loader_stop.exe
1548	2026-09-30_54c62b8407976420fd64602ac1f09418_amadey_darkgate_elex_smoke-loader_stop.exe
1548	2026-09-30_54c62b8407976420fd64602ac1f09418_amadey_darkgate_elex_smoke-loader_stop.exe
1548	2026-09-30_54c62b8407976420fd64602ac1f09418_amadey_darkgate_elex_smoke-loader_stop.exe
1548	2026-09-30_54c62b8407976420fd64602ac1f09418_amadey_darkgate_elex_smoke-loader_stop.exe
1548	2026-09-30_54c62b8407976420fd64602ac1f09418_amadey_darkgate_elex_smoke-loader_stop.exe
1548	2026-09-30_54c62b8407976420fd64602ac1f09418_amadey_darkgate_elex_smoke-loader_stop.exe
1548	2026-09-30_54c62b8407976420fd64602ac1f09418_amadey_darkgate_elex_smoke-loader_stop.exe
1548	2026-09-30_54c62b8407976420fd64602ac1f09418_amadey_darkgate_elex_smoke-loader_stop.exe
1548	2026-09-30_54c62b8407976420fd64602ac1f09418_amadey_darkgate_elex_smoke-loader_stop.exe
1548	2026-09-30_54c62b8407976420fd64602ac1f09418_amadey_darkgate_elex_smoke-loader_stop.exe
1548	2026-09-30_54c62b8407976420fd64602ac1f09418_amadey_darkgate_elex_smoke-loader_stop.exe
1548	2026-09-30_54c62b8407976420fd64602ac1f09418_amadey_darkgate_elex_smoke-loader_stop.exe
6120	dxvqnlidavsnlfdx.exe
6120	dxvqnlidavsnlfdx.exe
6120	dxvqnlidavsnlfdx.exe
6120	dxvqnlidavsnlfdx.exe
6120	dxvqnlidavsnlfdx.exe
6120	dxvqnlidavsnlfdx.exe
6120	dxvqnlidavsnlfdx.exe
6120	dxvqnlidavsnlfdx.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	4460	i_ifaysqkica.exe
Token: SeDebugPrivilege	4360	i_hfdxvsnkfc.exe
Token: SeDebugPrivilege	2860	i_vpnhfzxvpf.exe
Token: SeDebugPrivilege	4112	i_usmkfcxupm.exe
Token: SeDebugPrivilege	2756	i_jhbztrmgez.exe
Token: SeDebugPrivilege	932	i_jdbwtomgey.exe
Token: SeDebugPrivilege	3376	i_jgebwtrojg.exe
Token: SeDebugPrivilege	2856	i_vtolgdywqo.exe
Token: SeDebugPrivilege	5924	i_vtqligayvq.exe
Token: SeDebugPrivilege	4884	i_kicaxsqkic.exe
Token: SeDebugPrivilege	4236	i_qkiusnkfcx.exe
Token: SeDebugPrivilege	3568	i_nhfzxusmkh.exe
Token: SeDebugPrivilege	3056	i_khczurmjec.exe
Token: SeDebugPrivilege	5044	i_mgeywrojhb.exe
Token: SeDebugPrivilege	4984	i_jgebztrojg.exe
Token: SeDebugPrivilege	4384	i_lgeyvtoljd.exe
Token: SeDebugPrivilege	2856	i_lfdyvqnljd.exe
Token: SeDebugPrivilege	1808	i_davsnlfaxv.exe
Token: SeDebugPrivilege	1456	i_fdavsnlfdx.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2924	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1548 wrote to memory of 6120	1548	2026-09-30_54c62b8407976420fd64602ac1f09418_amadey_darkgate_elex_smoke-loader_stop.exe	89
PID 1548 wrote to memory of 2184	1548	2026-09-30_54c62b8407976420fd64602ac1f09418_amadey_darkgate_elex_smoke-loader_stop.exe	90
PID 2184 wrote to memory of 2924	2184	iexplore.exe	91
PID 2924 wrote to memory of 4652	2924	msedge.exe	92
PID 2924 wrote to memory of 348	2924	msedge.exe	93
PID 2924 wrote to memory of 2736	2924	msedge.exe	94
PID 2924 wrote to memory of 348	2924	msedge.exe	93
PID 2924 wrote to memory of 348	2924	msedge.exe	93
PID 2924 wrote to memory of 1348	2924	msedge.exe	96
PID 2924 wrote to memory of 1348	2924	msedge.exe	96
PID 2924 wrote to memory of 3948	2924	msedge.exe	97
PID 2924 wrote to memory of 3948	2924	msedge.exe	97
PID 2924 wrote to memory of 3948	2924	msedge.exe	97
PID 2924 wrote to memory of 2712	2924	msedge.exe	98
PID 2924 wrote to memory of 2712	2924	msedge.exe	98
PID 2924 wrote to memory of 2712	2924	msedge.exe	98
PID 2924 wrote to memory of 4304	2924	msedge.exe	99
PID 2924 wrote to memory of 4304	2924	msedge.exe	99
PID 2924 wrote to memory of 5660	2924	msedge.exe	100
PID 2924 wrote to memory of 4304	2924	msedge.exe	99
PID 2924 wrote to memory of 5660	2924	msedge.exe	100
PID 2924 wrote to memory of 5660	2924	msedge.exe	100
PID 2924 wrote to memory of 3288	2924	msedge.exe	102
PID 2924 wrote to memory of 3288	2924	msedge.exe	102
PID 2924 wrote to memory of 5808	2924	msedge.exe	105
PID 2924 wrote to memory of 5752	2924	msedge.exe	106
PID 2924 wrote to memory of 5808	2924	msedge.exe	105
PID 2924 wrote to memory of 5752	2924	msedge.exe	106
PID 6120 wrote to memory of 5296	6120	dxvqnlidavsnlfdx.exe	107
PID 2924 wrote to memory of 5232	2924	msedge.exe	110
PID 2924 wrote to memory of 5420	2924	msedge.exe	115
PID 2924 wrote to memory of 5420	2924	msedge.exe	115
PID 2924 wrote to memory of 4408	2924	msedge.exe	118
PID 2924 wrote to memory of 4408	2924	msedge.exe	118
PID 6120 wrote to memory of 3616	6120	dxvqnlidavsnlfdx.exe	119
PID 6120 wrote to memory of 3880	6120	dxvqnlidavsnlfdx.exe	123
PID 2816 wrote to memory of 2544	2816	hfdxvsnkfc.exe	125
PID 6120 wrote to memory of 2608	6120	dxvqnlidavsnlfdx.exe	128
PID 6120 wrote to memory of 3092	6120	dxvqnlidavsnlfdx.exe	132
PID 4904 wrote to memory of 2656	4904	vpnhfzxvpf.exe	134
PID 6120 wrote to memory of 5876	6120	dxvqnlidavsnlfdx.exe	137
PID 6120 wrote to memory of 1848	6120	dxvqnlidavsnlfdx.exe	142
PID 4544 wrote to memory of 4792	4544	usmkfcxupm.exe	144
PID 6120 wrote to memory of 1488	6120	dxvqnlidavsnlfdx.exe	147
PID 2924 wrote to memory of 2456	2924	msedge.exe	149
PID 2924 wrote to memory of 6100	2924	msedge.exe	150
PID 2924 wrote to memory of 3696	2924	msedge.exe	151
PID 6120 wrote to memory of 2928	6120	dxvqnlidavsnlfdx.exe	154
PID 2888 wrote to memory of 5164	2888	jhbztrmgez.exe	156
PID 6120 wrote to memory of 5224	6120	dxvqnlidavsnlfdx.exe	159
PID 6120 wrote to memory of 2000	6120	dxvqnlidavsnlfdx.exe	163
PID 5580 wrote to memory of 4952	5580	jdbwtomgey.exe	165
PID 6120 wrote to memory of 5088	6120	dxvqnlidavsnlfdx.exe	168
PID 6120 wrote to memory of 4948	6120	dxvqnlidavsnlfdx.exe	172
PID 5520 wrote to memory of 4188	5520	jgebwtrojg.exe	174
PID 6120 wrote to memory of 3628	6120	dxvqnlidavsnlfdx.exe	177
PID 6120 wrote to memory of 5952	6120	dxvqnlidavsnlfdx.exe	181
PID 1732 wrote to memory of 3196	1732	vtolgdywqo.exe	183
PID 6120 wrote to memory of 2716	6120	dxvqnlidavsnlfdx.exe	186
PID 2924 wrote to memory of 2828	2924	msedge.exe	188
PID 2924 wrote to memory of 2828	2924	msedge.exe	188
PID 6120 wrote to memory of 2356	6120	dxvqnlidavsnlfdx.exe	194
PID 984 wrote to memory of 3860	984	vtqligayvq.exe	196
PID 6120 wrote to memory of 4540	6120	dxvqnlidavsnlfdx.exe	199

C:\Users\Admin\AppData\Local\Temp\2026-09-30_54c62b8407976420fd64602ac1f09418_amadey_darkgate_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_54c62b8407976420fd64602ac1f09418_amadey_darkgate_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Temp\dxvqnlidavsnlfdx.exe
  C:\Temp\dxvqnlidavsnlfdx.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:6120
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ifaysqkica.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5296
  - - C:\Temp\ifaysqkica.exe
      C:\Temp\ifaysqkica.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2744
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5348
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4332
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ifaysqkica.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3616
  - - C:\Temp\i_ifaysqkica.exe
      C:\Temp\i_ifaysqkica.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4460
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hfdxvsnkfc.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3880
  - - C:\Temp\hfdxvsnkfc.exe
      C:\Temp\hfdxvsnkfc.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2816
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2544
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2456
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hfdxvsnkfc.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2608
  - - C:\Temp\i_hfdxvsnkfc.exe
      C:\Temp\i_hfdxvsnkfc.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4360
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vpnhfzxvpf.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3092
  - - C:\Temp\vpnhfzxvpf.exe
      C:\Temp\vpnhfzxvpf.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4904
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2656
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3972
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vpnhfzxvpf.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5876
  - - C:\Temp\i_vpnhfzxvpf.exe
      C:\Temp\i_vpnhfzxvpf.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2860
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\usmkfcxupm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1848
  - - C:\Temp\usmkfcxupm.exe
      C:\Temp\usmkfcxupm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4544
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4792
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1524
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_usmkfcxupm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1488
  - - C:\Temp\i_usmkfcxupm.exe
      C:\Temp\i_usmkfcxupm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4112
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jhbztrmgez.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2928
  - - C:\Temp\jhbztrmgez.exe
      C:\Temp\jhbztrmgez.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2888
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5164
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4580
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jhbztrmgez.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5224
  - - C:\Temp\i_jhbztrmgez.exe
      C:\Temp\i_jhbztrmgez.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2756
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jdbwtomgey.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2000
  - - C:\Temp\jdbwtomgey.exe
      C:\Temp\jdbwtomgey.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5580
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4952
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5272
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jdbwtomgey.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5088
  - - C:\Temp\i_jdbwtomgey.exe
      C:\Temp\i_jdbwtomgey.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:932
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jgebwtrojg.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4948
  - - C:\Temp\jgebwtrojg.exe
      C:\Temp\jgebwtrojg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5520
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4188
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3564
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jgebwtrojg.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3628
  - - C:\Temp\i_jgebwtrojg.exe
      C:\Temp\i_jgebwtrojg.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3376
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtolgdywqo.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5952
  - - C:\Temp\vtolgdywqo.exe
      C:\Temp\vtolgdywqo.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1732
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3196
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1684
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtolgdywqo.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2716
  - - C:\Temp\i_vtolgdywqo.exe
      C:\Temp\i_vtolgdywqo.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2856
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtqligayvq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2356
  - - C:\Temp\vtqligayvq.exe
      C:\Temp\vtqligayvq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:984
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3860
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4980
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtqligayvq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4540
  - - C:\Temp\i_vtqligayvq.exe
      C:\Temp\i_vtqligayvq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5924
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kicaxsqkic.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5968
  - - C:\Temp\kicaxsqkic.exe
      C:\Temp\kicaxsqkic.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2416
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4360
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6084
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kicaxsqkic.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5124
  - - C:\Temp\i_kicaxsqkic.exe
      C:\Temp\i_kicaxsqkic.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4884
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qkiusnkfcx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1216
  - - C:\Temp\qkiusnkfcx.exe
      C:\Temp\qkiusnkfcx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4584
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4208
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5316
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qkiusnkfcx.exe ups_ins
    3⤵
    PID:932
  - - C:\Temp\i_qkiusnkfcx.exe
      C:\Temp\i_qkiusnkfcx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4236
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nhfzxusmkh.exe ups_run
    3⤵
    PID:1112
  - - C:\Temp\nhfzxusmkh.exe
      C:\Temp\nhfzxusmkh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4608
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2340
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1604
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nhfzxusmkh.exe ups_ins
    3⤵
    PID:2408
  - - C:\Temp\i_nhfzxusmkh.exe
      C:\Temp\i_nhfzxusmkh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3568
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\khczurmjec.exe ups_run
    3⤵
    PID:4336
  - - C:\Temp\khczurmjec.exe
      C:\Temp\khczurmjec.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2556
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1632
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1292
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_khczurmjec.exe ups_ins
    3⤵
    PID:4224
  - - C:\Temp\i_khczurmjec.exe
      C:\Temp\i_khczurmjec.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3056
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mgeywrojhb.exe ups_run
    3⤵
    PID:4488
  - - C:\Temp\mgeywrojhb.exe
      C:\Temp\mgeywrojhb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4628
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1296
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3980
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mgeywrojhb.exe ups_ins
    3⤵
    PID:2676
  - - C:\Temp\i_mgeywrojhb.exe
      C:\Temp\i_mgeywrojhb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5044
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jgebztrojg.exe ups_run
    3⤵
    PID:1052
  - - C:\Temp\jgebztrojg.exe
      C:\Temp\jgebztrojg.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5760
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2592
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4456
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jgebztrojg.exe ups_ins
    3⤵
    PID:2576
  - - C:\Temp\i_jgebztrojg.exe
      C:\Temp\i_jgebztrojg.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4984
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lgeyvtoljd.exe ups_run
    3⤵
    PID:5152
  - - C:\Temp\lgeyvtoljd.exe
      C:\Temp\lgeyvtoljd.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6100
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3480
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5872
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lgeyvtoljd.exe ups_ins
    3⤵
    PID:2256
  - - C:\Temp\i_lgeyvtoljd.exe
      C:\Temp\i_lgeyvtoljd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4384
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lfdyvqnljd.exe ups_run
    3⤵
    PID:1996
  - - C:\Temp\lfdyvqnljd.exe
      C:\Temp\lfdyvqnljd.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1928
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3576
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5816
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lfdyvqnljd.exe ups_ins
    3⤵
    PID:3980
  - - C:\Temp\i_lfdyvqnljd.exe
      C:\Temp\i_lfdyvqnljd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2856
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\davsnlfaxv.exe ups_run
    3⤵
    PID:4456
  - - C:\Temp\davsnlfaxv.exe
      C:\Temp\davsnlfaxv.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4120
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:252
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2076
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_davsnlfaxv.exe ups_ins
    3⤵
    PID:6140
  - - C:\Temp\i_davsnlfaxv.exe
      C:\Temp\i_davsnlfaxv.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1808
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fdavsnlfdx.exe ups_run
    3⤵
    PID:4640
  - - C:\Temp\fdavsnlfdx.exe
      C:\Temp\fdavsnlfdx.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3248
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3552
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3376
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fdavsnlfdx.exe ups_ins
    3⤵
    PID:2480
  - - C:\Temp\i_fdavsnlfdx.exe
      C:\Temp\i_fdavsnlfdx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1456
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\axspkhfzxv.exe ups_run
    3⤵
    PID:4492
  - - C:\Temp\axspkhfzxv.exe
      C:\Temp\axspkhfzxv.exe ups_run
      4⤵
      PID:5720
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x394,0x7ffec438c188,0x7ffec438c194,0x7ffec438c1a0
      4⤵
      PID:4652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,9925448661419623084,11214993468146692850,262144 --field-trial-handle=2332,i,5952017682760480270,12612183299371059398,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:2
      4⤵
      PID:348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,13316267013462000946,16023593703891712,524288 --field-trial-handle=2332,i,5952017682760480270,12612183299371059398,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:11
      4⤵
      System Time Discovery
      PID:2736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2560,i,6498358652596671227,16789071969169909466,524288 --field-trial-handle=2332,i,5952017682760480270,12612183299371059398,262144 --variations-seed-version --mojo-platform-channel-handle=3256 /prefetch:13
      4⤵
      PID:1348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3512,i,5694876034619203282,7983164304521645197,2097152 --field-trial-handle=2332,i,5952017682760480270,12612183299371059398,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:1
      4⤵
      PID:3948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3540,i,13690523223372915451,9388445608476452538,2097152 --field-trial-handle=2332,i,5952017682760480270,12612183299371059398,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
      4⤵
      PID:2712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4296,i,14456074556197537999,9256574912650033650,2097152 --field-trial-handle=2332,i,5952017682760480270,12612183299371059398,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:1
      4⤵
      PID:4304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4316,i,9515351041675819544,17134895562903297932,2097152 --field-trial-handle=2332,i,5952017682760480270,12612183299371059398,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:9
      4⤵
      PID:5660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4304,i,1139575692070804239,8212456838261558627,524288 --field-trial-handle=2332,i,5952017682760480270,12612183299371059398,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:14
      4⤵
      PID:3288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,1745962051671431774,8432757976212887347,524288 --field-trial-handle=2332,i,5952017682760480270,12612183299371059398,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:14
      4⤵
      PID:5808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,812642210123831902,14018788367716139674,524288 --field-trial-handle=2332,i,5952017682760480270,12612183299371059398,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:14
      4⤵
      PID:5752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,5375061128437738431,16332342811290911007,524288 --field-trial-handle=2332,i,5952017682760480270,12612183299371059398,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:14
      4⤵
      PID:5308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,5375061128437738431,16332342811290911007,524288 --field-trial-handle=2332,i,5952017682760480270,12612183299371059398,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:14
      4⤵
      PID:5232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,14339879080395785090,2412991143538067295,524288 --field-trial-handle=2332,i,5952017682760480270,12612183299371059398,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:14
      4⤵
      PID:5420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,1433503410225010494,15352432587294615029,524288 --field-trial-handle=2332,i,5952017682760480270,12612183299371059398,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:14
      4⤵
      PID:4408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4436,i,1138446803658995117,9021731045399636648,524288 --field-trial-handle=2332,i,5952017682760480270,12612183299371059398,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:14
      4⤵
      PID:2456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4328,i,13780849081853615572,8650351064240476438,524288 --field-trial-handle=2332,i,5952017682760480270,12612183299371059398,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:14
      4⤵
      PID:6100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3624,i,17742610279493924151,14015604725103821761,524288 --field-trial-handle=2332,i,5952017682760480270,12612183299371059398,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:14
      4⤵
      PID:3696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2904,i,3241194094358190990,14555487426518692591,524288 --field-trial-handle=2332,i,5952017682760480270,12612183299371059398,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:14
      4⤵
      PID:2828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,10998025502636980668,15372311344682401718,524288 --field-trial-handle=2332,i,5952017682760480270,12612183299371059398,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:14
      4⤵
      PID:1420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4300,i,15828307687019101109,8001902398534900794,524288 --field-trial-handle=2332,i,5952017682760480270,12612183299371059398,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:14
      4⤵
      PID:4980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,11152365435182295292,2067881589439072180,524288 --field-trial-handle=2332,i,5952017682760480270,12612183299371059398,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:14
      4⤵
      PID:2384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,14119844701724588243,11043981859212270376,524288 --field-trial-handle=2332,i,5952017682760480270,12612183299371059398,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:14
      4⤵
      PID:4732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5312,i,13663253193029079591,10018846544824238793,262144 --field-trial-handle=2332,i,5952017682760480270,12612183299371059398,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:10
      4⤵
      PID:3272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,7319914653826021162,4687193803596595219,524288 --field-trial-handle=2332,i,5952017682760480270,12612183299371059398,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:14
      4⤵
      PID:2320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6164,i,11639510711144071554,16975005554402331445,524288 --field-trial-handle=2332,i,5952017682760480270,12612183299371059398,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:14
      4⤵
      PID:1292

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4360

C:\Temp\dxvqnlidavsnlfdx.sys
C:\Temp\dxvqnlidavsnlfdx.sys
1⤵
- Executes dropped EXE
PID:3092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2992

C:\Temp\vsnkicavsn.sys
C:\Temp\vsnkicavsn.sys
1⤵
- Executes dropped EXE
PID:2676

C:\Temp\uspkicausp.sys
C:\Temp\uspkicausp.sys
1⤵
- Executes dropped EXE
PID:2888

C:\Temp\usmkfzxrpn.sys
C:\Temp\usmkfzxrpn.sys
1⤵
- Executes dropped EXE
PID:4584

C:\Temp\mhezwuomjh.sys
C:\Temp\mhezwuomjh.sys
1⤵
- Executes dropped EXE
PID:1732

C:\Temp\omjebwuomg.sys
C:\Temp\omjebwuomg.sys
1⤵
- Executes dropped EXE
PID:1912

C:\Temp\mgeywuoljg.sys
C:\Temp\mgeywuoljg.sys
1⤵
- Executes dropped EXE
PID:3452

C:\Temp\toljdaywqo.sys
C:\Temp\toljdaywqo.sys
1⤵
- Executes dropped EXE
PID:4464

C:\Temp\igayvtnlfd.sys
C:\Temp\igayvtnlfd.sys
1⤵
- Executes dropped EXE
PID:5400

C:\Temp\xvqfaxsqki.sys
C:\Temp\xvqfaxsqki.sys
1⤵
- Executes dropped EXE
PID:6100

C:\Temp\nkfcausnkf.sys
C:\Temp\nkfcausnkf.sys
1⤵
- Executes dropped EXE
PID:5816

C:\Temp\pnhfzxrpkh.sys
C:\Temp\pnhfzxrpkh.sys
1⤵
PID:6140

C:\Temp\jhecwupmhe.sys
C:\Temp\jhecwupmhe.sys
1⤵
PID:2136

C:\Temp\rpjhbztrpj.sys
C:\Temp\rpjhbztrpj.sys
1⤵
PID:1900

C:\Temp\mjebztromj.sys
C:\Temp\mjebztromj.sys
1⤵
PID:3700

C:\Temp\igbztqljdb.sys
C:\Temp\igbztqljdb.sys
1⤵
PID:1604

C:\Temp\igayvtqlig.sys
C:\Temp\igayvtqlig.sys
1⤵
PID:2092

C:\Temp\lidbvtnlfd.sys
C:\Temp\lidbvtnlfd.sys
1⤵
PID:4784

C:\Temp\ifaxsqkifa.sys
C:\Temp\ifaxsqkifa.sys
1⤵
PID:1072

C:\Temp\xspkhfzxsp.sys
C:\Temp\xspkhfzxsp.sys
1⤵
PID:4340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dxvqnlidavsnlfdx.exe

Path C:\Temp\dxvqnlidavsnlfdx.exe
Size 384KB
SHA256 457293f5dd2f227c66ffeab5454454f977dc80dbec802af6206d1c87dfdc9de3
MD5 ca4404ed7903e698111ce0a1785cd0f3
SHA1 3ea8170dc3bf71f4772d70d301ee86dd7efb1d2b
SHA512 e418e8ba71f6f70dee6ec89d0ccc1ee8c0fd553dc8a191845a6fa41a274f2bc22a23bc08795e7ec5e5ac16af472237ebb34eb867124e068a4f285ee086fc6fa3
SSDEEP 3072:xbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:xbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T124847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC3F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxvqnlidavsnlfdx.sys

Path C:\Temp\dxvqnlidavsnlfdx.sys
Size 293KB
SHA256 2d3facb9246beea11fdbbc21bd12e86a22104a6297d1fe24ec17103f4df5aebc
MD5 442197978779a93fbf52bf7e9fc644f9
SHA1 cf6776324b8560667526167db41c0bf0ebd237a1
SHA512 2938cda490d860bc3459279c82a7f289ce5783acdcf45f54347a1bd866b6778327fbb4849a1d87047a1a48c2a4617db2266f8057a9ea09e81e1626a8dfe1b656
SSDEEP 3072:QtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:QIJjiJcbI03GBc3ucY5DCSj
TLSH
T10A545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfdxvsnkfc.exe

Path C:\Temp\hfdxvsnkfc.exe
Size 384KB
SHA256 a8cc172ef1602300fc4823406b68ca9577f906a412935a478422c3a46149c7c1
MD5 59c8302df99476e52e2ec4a653966bb0
SHA1 342110de5281d5e2604d03fa1a5aedc2ba759c66
SHA512 746cc3a12c3712a9f6268d680205b0b0ca1a468153a4e0536c451380acb9b75e2fde4ed7752b60db73745520dff3ae9cde60dac9e21e13bb85a65fc01b487725
SSDEEP 3072:/btF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:/btt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C5847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hfdxvsnkfc.exe

Path C:\Temp\i_hfdxvsnkfc.exe
Size 384KB
SHA256 e8ffe780c3d8f918e3ce7f17760a5cfdd0a593ab93734eac6e8b066c59241fde
MD5 ce63b22654b8cad7f3b79f09ebd62994
SHA1 3014ed29fb4abb749a92c54054270e833df41fef
SHA512 27050301c3a0447d0a1ed82e16dc0487cfc3c3c316cf14fec92db2ee4716d3801a38793f14baf12572aa0cd520439765a3e80c2e36c3793f76acd064260ee700
SSDEEP 3072:EbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:Ebtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T17B847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC3F754CE5D9A517C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ifaysqkica.exe

Path C:\Temp\i_ifaysqkica.exe
Size 384KB
SHA256 dbd74059423c74fd03dddc4488c9edb2ac0b0780f99ffe2e5f285f1b7b605046
MD5 2044be365aefc4d8b1d2a1964e0153fd
SHA1 46dd949b4a5d6001578a3810aa22d94444e2fc24
SHA512 65a8f84ce8c6de163544bdc9e73ede30a6f11447611e80f123572117e9c0448430d7017759dbfd037648e91abbe7c50ce97b4aaa5415935d2d590cf301827c90
SSDEEP 3072:PbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:Pbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D2847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F354CE5D9A517C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jhbztrmgez.exe

Path C:\Temp\i_jhbztrmgez.exe
Size 384KB
SHA256 bd382aa99ee61f4b3c618b0ded08024c6ec8e1ce45a3d359b84f472ba39440b9
MD5 816ec63c480d553aaa73e09334181f41
SHA1 c04fb162722b892ad7f0908399df0a409be62158
SHA512 a16fae9a3e22a4c56c1654f3daae199e3cc948da6c689be5e2c868f73b0075d270e8e46abf3e4ccce13860e92dc311d1d39090ca6148e4701220351c6145a31f
SSDEEP 3072:wbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:wbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T192847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_usmkfcxupm.exe

Path C:\Temp\i_usmkfcxupm.exe
Size 384KB
SHA256 755893ff2c492c984e85817968f2e59851ff7cadab3aea47339e0088e6e198ef
MD5 2994301c28057183e15e6c777aef7f0c
SHA1 4e33a504fac29dc4d66b56a9cccd2be39f95f169
SHA512 ffaea41455c36f529b389e83e5caa39eb19d4b5087b8396c6c2504bc12bb0981b14f3cf3ab1a39f63673e76bfce64b4403ad67e69c1785e3f726da1633b2dc08
SSDEEP 3072:mbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:mbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F0847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vpnhfzxvpf.exe

Path C:\Temp\i_vpnhfzxvpf.exe
Size 384KB
SHA256 735557ccb088eab95692a8b120f07935f5c44d9f05284b6faa40138194bf2358
MD5 26d1384f34bf3eafd8e6a108b2672ff4
SHA1 25404b2bdc4894aee9cb10d9a379ed804ac34d82
SHA512 95dd73af4b82fe929b931f3971dea82f614b69a986f01a28a6a3e8f59e1194e12c05e5bb874600db1cae0e3109cf718f5840106a810e086734c70e88b2fe4e92
SSDEEP 3072:6btF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:6btt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T185847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC3F354CE5D9A517C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ifaysqkica.exe

Path C:\Temp\ifaysqkica.exe
Size 384KB
SHA256 a0f7b47945e50332e6a2eb39e468c41b5c56b0ab2e10fba6fa3b5241fbfbd810
MD5 61f7f5ccf66f2d8d273bef8a66ed2652
SHA1 f5f0b23408a114ffd06df89756cf667aad04dc0a
SHA512 f90ad58f8f4c8d5870d4d3a4f056decebeb771a6d02047ff3d4404dd346016e464f0efb21a1ea2cd9d1ca06508f33725b82a58a8d0ba84dfce391b067b24c685
SSDEEP 3072:AbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:Abtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F0847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC3F754CE5D9A517C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdbwtomgey.exe

Path C:\Temp\jdbwtomgey.exe
Size 384KB
SHA256 e38876bd85d549c121ad8c4d3c085dd248e1b84f8f58d9347c4fadab5a9738f7
MD5 a765eb56df1cafb6c899b12b23d684fe
SHA1 f0ea2bd41a0af036d1501104523709a3bf3ed5d0
SHA512 629a042a91292f5ec19098c889bd1a2031e8e54f3a1f388052d8e47420b1403d6caeb68157df3329ca2299e54d81a54994be7b8c8067e056d8c6bdefff19da94
SSDEEP 3072:6btF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:6btt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T19C847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhbztrmgez.exe

Path C:\Temp\jhbztrmgez.exe
Size 384KB
SHA256 3bef6150423bc4e26afd6d6ba4b6f6c4cba19608ed8780e3fc852c3326f0e161
MD5 26ea04002d1aa7300720c77e745004c1
SHA1 a340832aa75fc12571f19f986bd1cfeded7ef04d
SHA512 af1158a1662053c179fc4df186e8551f99627f64dc794396717d21e035125a3d6ddd090f71ca94ce4d77b60613c66a4467fc3420d5cc9d1fc4d295fb91e49255
SSDEEP 3072:EbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:Ebtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T12B847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mhezwuomjh.sys

Path C:\Temp\mhezwuomjh.sys
Size 293KB
SHA256 ce81ca8d8cfa4537a796242fa1fc1c28094b27e53fcc189f8b3ab99aec413163
MD5 432876180b6bf72a4ba3a3536d8e0fab
SHA1 919c5ea696b8d37f20ece66433bf7feafb610fc1
SHA512 04ed0552d4c967eac039c4f03180c408815b75d9efd825134390e22c24084f150c2c67f111a11bbc3b98ba84ae00c448b7aadf7095f6ce020ad0ad9acb24b50d
SSDEEP 3072:utKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:uIJjiJcbI03GBc3ucY5DCSj
TLSH
T13B545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omjebwuomg.sys

Path C:\Temp\omjebwuomg.sys
Size 293KB
SHA256 a5bd9bf86c8eca725106a1a7c8f9e14e04528681505ba632d330e95a9634acb9
MD5 a2b464728d4cd20d2cb2aff2c2eb4d9a
SHA1 f171a0ac4b49997290929d8226fbd5006ff475db
SHA512 af45c5ea13a5299693a0e49cd0dc8dbb3079bc02f143a64e967257a6ce9b3ea1f585e7a8d316df5c6914adee3bc97b72a6db24cc3d2a14bb100270710f94d61f
SSDEEP 3072:CtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:CIJjiJcbI03GBc3ucY5DCSj
TLSH
T144545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usmkfcxupm.exe

Path C:\Temp\usmkfcxupm.exe
Size 384KB
SHA256 ade6babef1a41a30e8289d08a9cb300ce5f2153e589c77606457f74fa83a94e0
MD5 d6350b400051debf5c2afab571264831
SHA1 fb01d0c71625b83d1391898f8dad89c3089e2d50
SHA512 49f2ef8d06b7aabfe4cdca1e62674d9b0a14e6fbfa4875dfb48b91ed37cc28ba52cded1e94a803d154724c03fedc9e76cb44d7c9b2e5779d5f03f1a27bfc11c1
SSDEEP 3072:vbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:vbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1AD847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usmkfzxrpn.sys

Path C:\Temp\usmkfzxrpn.sys
Size 293KB
SHA256 5a03a9c21f08fa47daaddc3fc2262218a0aeb0357c48cf8cb6e4186198042113
MD5 78645100aaa96ed46f591a234c454192
SHA1 39a38ff55da8cde8eb28f7f657442a4b4704b06d
SHA512 42e0d190a6e9f49245b1814ac821fe995cb99c43348b2e228a82b9d7e5f3261911a60dbad53689f7d9b543b66918d41218a709f305e3ddc953da2b5d70389161
SSDEEP 3072:ntKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:nIJjiJcbI03GBc3ucY5DCSj
TLSH
T174545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uspkicausp.sys

Path C:\Temp\uspkicausp.sys
Size 293KB
SHA256 42b93dc697355e952a530c13158d0f8d09b4d3077427d44607489566fdca1b22
MD5 aa74de920f877a5bc9a4beda60d240af
SHA1 684908697e484e9e52ab0ff0aaab5f2d58c7bf97
SHA512 8654b0a18e98d49f3a522ed44ad1bc7a921fc8b84b2d0e6b2e658f9c80550038ab87fc0ddb6bb4e84f52ba389599709b51ce4b04ab90a3237790e1f18b4c5359
SSDEEP 3072:ftKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:fIJjiJcbI03GBc3ucY5DCSj
TLSH
T17F545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vpnhfzxvpf.exe

Path C:\Temp\vpnhfzxvpf.exe
Size 384KB
SHA256 60d04a1b14897d53cc773fc4a62bcd649d2a61aba1d7efa3c09f78cca94f9b31
MD5 beef2674fd352c5b38a4e635432d1c11
SHA1 d5f6c1ee3ae63be89a55d75d713ea6fde0c8c531
SHA512 57581cb0a321a07576e5c791b405f31c7fd303d910d461d803b314ade33cb506c51aa4ca5f0b1981ef0add56c690b39ca878593a6753b488d85724d6a81fefc1
SSDEEP 3072:zbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:zbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1EA847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F354CE5D9A517C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vsnkicavsn.sys

Path C:\Temp\vsnkicavsn.sys
Size 293KB
SHA256 319120bf0cbdbeb3ca788f6a620e4d1b87dff47f2eea2aebcc4ae9fd3fc8d45c
MD5 89641d31df918599f5581a31fc924be7
SHA1 e93aea5217b78e60ec256c707b9fa8cf2991e911
SHA512 5605dba2f434dce6bccbd853b5f40d996a9ded6e9e4f2a25bc0125e53f4a5caa81ee14796d33d6abb65926f64a45ea312142a382325d4b93a2876193dcdcf502
SSDEEP 3072:CtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:CIJjiJcbI03GBc3ucY5DCSj
TLSH
T143545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6ff73de37e74e04bc32af0dd2dd926bcd2d6c623deb8eb066c65071254002178
MD5 a569aede49695d8fc8b039ab7024fd75
SHA1 de14644ea578b78d3cd08753552602517297fd30
SHA512 b87c4dc8e3e3be51d402a4d2d6166ca389ae05ea059903425483e2dcc38b0f2394d29a7a81921700d62e2a403e94a7b3e6c02c186966742a945996df580c0065
TLSH
T18FD02B71EFBB6C03D184207C100282C01610FC406B6902C4170041B4042C5444313201
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e0217c0f2953c25b5ecacbfc82728d57c809cf5450e9203a48d2faaff8836c2b
MD5 04b3b3f543557524e135a08dac44efda
SHA1 4f856c66c17971828ff8fd245186ea6b1b303bc7
SHA512 a11f6ce9f676e6157f7d9b86de7e7c3f0b7758052de5b00121c54342e363951818cf7787ed1baf39e636241455a76f6b90dc0405f5eaf0361a7c1056c3560c1a
TLSH
T1F5D02B71EFBB6C03D184207C100182C01620FC40BF6902C4170001A4042C5444313205
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 daf602c7b459babd5e0638b75d89fae246e008563701c41c125ebfd21bfc7df3
MD5 e9193f536d709a4ad291f61acd8106e1
SHA1 da261767da6edeab0d2413ca1314aa9fa2e3879b
SHA512 20e088bcc5d73997ebe0bb677a8af48522c77e8a2b49399c9666d556997c440a7cef06d8543885a2f742c2b18596203868c233a8acfb4a64b9105dd293614ef9
TLSH
T1FD61968E6AA04012FF7870FE89D1BEE37E34A5C755873E1236D7DAB9586736C1C54108
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59feb9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59feb9.TMP
Size 3KB
SHA256 13e5b0994a066bb8650a70eb43b7e8c995052d23a57fb90deea6b9f9e704ce54
MD5 e3de24d13ec6f1cd8d93d5088fa46b37
SHA1 32a4f253e5ae9b345ecd09d4ab665386936afa26
SHA512 b89e5abd916a5566f9e1c9c433f7e02fd4a40a229dcb78515e23d6c8f13149b201857374ab0c146b7d67a6af4651111c3627901ec61316a92b0f60b43c47f08f
TLSH
T12061858E2AA04052FF7830FE89D0BEE77E34A5C755873E1236D7DAB9586736C1C55108
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 25d41256733bf0d15049caafdb92bc6eb345bfbaad28acc09f605eaf12537233
MD5 283f46256d22704747be4568d5b0ecfc
SHA1 703cca733dd78c3edcdb1d353cc3e3c35ae1a0d6
SHA512 596a4b5834e28c704eb7e1b9064c91cef9ba13d1ddd1b23365a59f33eb70c0e9d127fbffa270cc4f9083fa621c09d21f1e0eec2a7c858137b26b214a943baebe
TLSH
T15C519BF3C3E8866E890196F0AB147E2BCE2D0A54432C3D5AC8E4AE5B93E2471D14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 cece6a0cf24867464449bbd1edeff08728553c865362fdb8d490683aa809a600
MD5 6fd17f7525d0850f1368983c02f25ff4
SHA1 2732dfd3676317a04d3b6963f9dd1d277c6a0578
SHA512 a11f2df84a1c79ca1bf0517243573a5cef88f7ec4b65f45aa4619562708cfebc7fbdd3c38489e67a08cca5d83ef5e9e1271cfd8f41106f1bb88ca986811ec0e6
SSDEEP 192:sxRpRiCP/fmsSNrZ63LzoA8p98/g6+WNCVb/YFh4G//IgD4LJ:sxRpnP/fmsSNF66u/5c/iI
TLSH
T1C442B815AD28A97B4CCBD21DBB667F53D2F91032A1D55F48EAFC8A1C14E76DD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 301c98ff8d889da37eee599fc601842d11ce93753afe2b43e2476193a3b3b410
MD5 1af2eaf6c326b2d89cc98ae62fa1ead3
SHA1 33db21b882dc4e920d519c54dbac52aae2c6f1a6
SHA512 97ecbdd12da4bbabc3e0a59d68a1322b4947e0809e7ef3f72e130be45afc921d241882e8480bfeafe1e143edf04e081ac547a80291c4915fac7d9fa22d7ae545
SSDEEP 192:sxRpRiCP/fmsTNrZ63LzoA8p98/g6+WNCVb/YFI4G//IgDaLJ:sxRpnP/fmsTNF66u/5c/zO
TLSH
T1DE42B855AD28A97B4CCBD21DBB567F53D2F91032A1951F48EAFCCA1C14E76DD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 9e8f83bd2d0ce9bffd8a9786ccdd4f8dc806fc6f72166b36cfb1c7767d747878
MD5 1984906710fd37d698fa9230a96d5b0d
SHA1 6265f68d1934686f7507210838cad6ba6d5340c8
SHA512 46e63602e67a35354118d2af61b2e05f7bf62f536e07c9e0a9c31b042db37b2dac0986a3b7c06b5cd9deb532348f0a743bddf1e5d0e9f4e78a59204b20359ef7
SSDEEP 768:+l2P9q7pLuLbDKWgwef4e8F1+UoAYDCx9Tuqh0VfUC9xbog/OVRVI0a0Ero+P8:+l2P9CEbDKWgwef4eu1jaSVIh0P+8
TLSH
T178D2D97B640CCA7F4F904ADDEC197A9F6DAC02CB9698C94047FA841D03C67EB521A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d40a5a58-0f71-4136-8775-040414b983b7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d40a5a58-0f71-4136-8775-040414b983b7.tmp
Size 11KB
SHA256 60b0c65229197c4cb238fe1461d2535384b68d9eb5376fff68838b7d0a3514fa
MD5 6d97553c534dc884d898c25df0c7c63c
SHA1 30625ea4e4adf5de3446d2e94ea4d1c7cf4b9d5f
SHA512 c28b84b2e3d133996532ccbb9d8f26aad3f199372bd42aa8ff98ee288e787a37e0fd1f8da33a9e7bda40f4b1196cc7b3d0667b7e00564d5d3286ae285bf5ec4b
SSDEEP 192:sxRyRiCP/fmseNrZ63LzoA8p98/g6+WNCVb/YFh4G//IgVLJ:sxRynP/fmseNF66u/5c/i/
TLSH
T1FC32C815AD28A97B4CCBD21DBB667F53D2F91032A1D55F48EAFC8A1C14E76DD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a9934.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a9934.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 b48f3403c263709ac97b479c5d861e5589fbcacce810567cc9d428bfab075838
MD5 0b440229f7bf79a994a2c40a0e1b8100
SHA1 d462dc0e4bac753e96bb3117a57de92f7262444d
SHA512 b5fa63a76c1a001d1525a5f95b56aae664cffc9fed3e91b7975e73425d72f195a66d9cefee86c9b91e0bcaec4ad8c81639ab329265aec1746bd2f7317509e9e2
SSDEEP 768:p/UxvxjgC+k3jCf9cE0IyEMbxyJugQVTJ7vvmevtSHtBk:cZj3+k3o3nyEmxyJJq17v3Sbk
TLSH
T15C03CF35ACA59C7388F792843649E787EFF502B384C62BA485DD6F0E168B3AC5307817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 c837e379e8c2e01611b5789eba4a0ecb33166aa37b2045352811c1cd3f6176b1
MD5 68879dce217cf4ea5a0c7da501cf024b
SHA1 65615f1365d87a0012720867f4ad448a9d3ba877
SHA512 9d14cf0e1ca77cb6a558979335d98fec7aea6c0615564418c8acde31d16f90f3c514fc63aa0ae2937104750f5bd2a041d3811652190343d40994fdb41306c770
SSDEEP 768:G/UxvxjgC+s3ruif9cE0qzUyEMbxyJugQVTJ7vvmeXL2sRjv:7Zj3+s3J3pUyEmxyJJq17vN2sNv
TLSH
T10E13BF35A8799C3398FBD2447249E3C3EFE515B344C61FA889D95E0E05873AD274B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 3f8765df2943674e3b9d83126c31672b05ec0c60f61cd06c122cbbf923ea41be
MD5 cd740c34b3e593d1dad42cfd243f9a28
SHA1 ee7af3c1a5d4bb7e9aed0849f83d1f8c6f178a6b
SHA512 fc12d49490f675c907f76fd3395356c71a366540543b33330cc2e0e155a12ecb7ef4e3c991754ef3b5bc966fde56b7d874bb3b02d11502f4459eaee7ae216f94
SSDEEP 768:jR3mwif9cE0qzzyEMbxyJugQVTJ7vvmeXL2sRb4:jR3e3pzyEmxyJJq17vN2sl4
TLSH
T186F2AE319875CC7398FBD2857285F7C3AFE411B398CA4B94D4D95B1E01876AE270B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 e18a01ecd800080944c1c69db37a1cd8c805e7140d795f09c9db89555374cc96
MD5 7ebee90a6551d5dd369c6a95b76c5624
SHA1 ea0be8d6d4e48f4bd1cc274fc0ba6e2b46acfd6c
SHA512 ae513c3b831f2a91dcfead6a57f7f6ff463101e38386bef77bda881508e30fb0d54e2284b5e9404be5cd01450f7b01fe5cd93e36246d6bcfa763794ab70eeac7
SSDEEP 768:eR3rwif9cE0qzzyEMbxyJugQVTJ7vvmeXL2sRb4:eR3L3pzyEmxyJJq17vN2sl4
TLSH
T108F2AE319875CC7398FBC2857285F7C3AFE511B398CA4B94D4D95B1E01876AE270B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 ea95a318a0dea9ee75209ba41967d7761c71ca1753d58e59161bbd91b777a8e3
MD5 f75bf26f457c7e1a1067c53e9e913257
SHA1 9de2c7db345585d72394c407326e044a99c0ebeb
SHA512 2bb84709b7551753d720e85fa1534da59d472410ed57ab8e89e4a38463f5fa21c3d3921cd607087fd6372bee31913bc2e676d4ebc34ebcc9fd917d824454d7fd
SSDEEP 768:RFQY3WwgvPpZi9cE0qzHyEMbxyJugQVTJ7vvmeXL2sRb4:gY3n3pHyEmxyJJq17vN2sl4
TLSH
T1591328F188E78976D8AE4383637CAE829EFCC16374894994B7C54D0DCC861BFD70A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2924_795746181\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 5622482e4f9ff874a8dc22a2a1a5b7572d4027826ab0dfc46aaf84aebb0afa08
MD5 b56d8da3b29cd15b675fad29409ceab8
SHA1 c5af55fc390c4d3da3e48204c701f728cbdeb029
SHA512 f61ad88d2f315e2838ea52641c7f32b993b315a9f9abc5d19b5e3e3ea662f19639f2105fb6bae0a89e10d5b0e0155c5ee8a873a9fd74cce17f4d1c67e60c4047
TLSH
T15E71009396A9C9B2C69A5BF102835248F2FB2238072370600B915587AB30A3A68B8F14
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1072-490-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1604-446-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1732-269-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1900-422-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1912-282-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2092-465-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2136-399-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2676-182-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2888-229-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3092-62-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3452-307-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3700-426-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3700-448-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4340-494-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4464-311-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4584-257-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4784-470-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5400-326-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5816-359-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6100-334-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6140-386-0x0000000000010000-0x00000000000AB000-memory.dmp

Download