systex | 328cf21540272b47538363856e71b41d0f06a87a433406a00ed190e7ad99c2bd

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 01:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-27_e3685eaacf0a6a4d1c2b1d098bd66b09_amadey_darkgate_elex_smoke-loader_stop.exe
Size 384KB
Sample260629-cdrd3sbz3p
SHA256 328cf21540272b47538363856e71b41d0f06a87a433406a00ed190e7ad99c2bd
MD5 e3685eaacf0a6a4d1c2b1d098bd66b09
SHA1 f3202fc3ff3250c945700e09d23f7d0e3baa54bf
SHA512 670301b68f4e0d4b0649abb8e7360c1bb1f28bdbbbfe307f156b5298e4aa08ed94031d78d7e3bc7fa3ae5157b40d27bb471e8569fee01b9bc095e3697f69902d
SSDEEP 3072:Z9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:zctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T121847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
3204	urmkeczusmkecwus.exe
4488	urmkeczusmkecwus.sys
2708	CreateProcess.exe
5812	cwusmkecxr.exe
4404	CreateProcess.exe
5564	CreateProcess.exe
3128	i_cwusmkecxr.exe
2788	zxrpjhbzur.sys
4736	CreateProcess.exe
916	mhezwrpjhe.exe
4572	CreateProcess.exe
2508	CreateProcess.exe
3224	i_mhezwrpjhe.exe
5472	rljebztrmj.sys
2100	CreateProcess.exe
1428	ljebztrljh.exe
3164	CreateProcess.exe
5056	CreateProcess.exe
2068	i_ljebztrljh.exe
616	bvtqojgeyw.sys
1296	CreateProcess.exe
6020	bvtolgeywq.exe
2104	CreateProcess.exe
6024	CreateProcess.exe
5652	i_bvtolgeywq.exe
4808	dbytqljdbv.sys
5464	CreateProcess.exe
1072	ywqoigaywq.exe
4076	CreateProcess.exe
4116	CreateProcess.exe
5256	i_ywqoigaywq.exe
1232	bvtnlfdayw.sys
3824	CreateProcess.exe
572	nkigaytqki.exe
2452	CreateProcess.exe
2404	CreateProcess.exe
6136	i_nkigaytqki.exe
5060	qnigaysqki.sys
1176	CreateProcess.exe
1528	lfdxvqniga.exe
5368	CreateProcess.exe
4332	CreateProcess.exe
5216	i_lfdxvqniga.exe
2112	icausnkfcx.sys
3228	CreateProcess.exe
2236	caxspnhfzx.exe
2572	CreateProcess.exe
1992	CreateProcess.exe
3720	i_caxspnhfzx.exe
2428	xupnhfzxsp.sys
2500	CreateProcess.exe
1856	pmhecauspk.exe
1308	CreateProcess.exe
1968	CreateProcess.exe
4204	i_pmhecauspk.exe
6136	zxrpkhfzxr.sys
2900	CreateProcess.exe
3948	mgeczurpkh.exe
6096	CreateProcess.exe
2576	CreateProcess.exe
2992	i_mgeczurpkh.exe
5252	uomjhezwuo.sys
2220	CreateProcess.exe
4392	trmjebwtrm.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3696_264364618\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3696_1319509963\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3696_1319509963\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3696_264364618\office_endpoints_list.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3696_235780797\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3696_1647259016\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3696_1647259016\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3696_264364618\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3696_264364618\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhezwrpjhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljebztrljh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtolgeywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkigaytqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgeczurpkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igayvtnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxvpkecaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecaukeczur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-27_e3685eaacf0a6a4d1c2b1d098bd66b09_amadey_darkgate_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwusmkecxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhezwrpjhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqoigaywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmhecauspk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgeczurpkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igayvtnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvtolgeywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkigaytqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trmjebwtrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrljdbwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eyvqoigeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhczurmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhbztrmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywqoigaywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrljdbwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	caxspnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhczurmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trmjebwtrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urmkeczusmkecwus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljebztrljh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	caxspnhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_caxspnhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlfdavtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnlfdavtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwusmkecxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lfdxvqniga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eyvqoigeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_caxspnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cxvpkecaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lfdxvqniga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmhecauspk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecaukeczur.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2144	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5160	ipconfig.exe
1104	ipconfig.exe
1364	ipconfig.exe
5800	ipconfig.exe
4344	ipconfig.exe
3776	ipconfig.exe
4488	ipconfig.exe
4712	ipconfig.exe
1552	ipconfig.exe
2064	ipconfig.exe
1496	ipconfig.exe
1780	ipconfig.exe
888	ipconfig.exe
1268	ipconfig.exe
2352	ipconfig.exe
4056	ipconfig.exe
472	ipconfig.exe
3908	ipconfig.exe
3404	ipconfig.exe
5308	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134271718858762925"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-28459746-3881314244-166055492-1000\{8D6C0B7D-01BB-4F39-B192-F04107267593}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4208	2026-06-27_e3685eaacf0a6a4d1c2b1d098bd66b09_amadey_darkgate_elex_smoke-loader_stop.exe
4208	2026-06-27_e3685eaacf0a6a4d1c2b1d098bd66b09_amadey_darkgate_elex_smoke-loader_stop.exe
4208	2026-06-27_e3685eaacf0a6a4d1c2b1d098bd66b09_amadey_darkgate_elex_smoke-loader_stop.exe
4208	2026-06-27_e3685eaacf0a6a4d1c2b1d098bd66b09_amadey_darkgate_elex_smoke-loader_stop.exe
4208	2026-06-27_e3685eaacf0a6a4d1c2b1d098bd66b09_amadey_darkgate_elex_smoke-loader_stop.exe
4208	2026-06-27_e3685eaacf0a6a4d1c2b1d098bd66b09_amadey_darkgate_elex_smoke-loader_stop.exe
4208	2026-06-27_e3685eaacf0a6a4d1c2b1d098bd66b09_amadey_darkgate_elex_smoke-loader_stop.exe
4208	2026-06-27_e3685eaacf0a6a4d1c2b1d098bd66b09_amadey_darkgate_elex_smoke-loader_stop.exe
4208	2026-06-27_e3685eaacf0a6a4d1c2b1d098bd66b09_amadey_darkgate_elex_smoke-loader_stop.exe
4208	2026-06-27_e3685eaacf0a6a4d1c2b1d098bd66b09_amadey_darkgate_elex_smoke-loader_stop.exe
4208	2026-06-27_e3685eaacf0a6a4d1c2b1d098bd66b09_amadey_darkgate_elex_smoke-loader_stop.exe
4208	2026-06-27_e3685eaacf0a6a4d1c2b1d098bd66b09_amadey_darkgate_elex_smoke-loader_stop.exe
4208	2026-06-27_e3685eaacf0a6a4d1c2b1d098bd66b09_amadey_darkgate_elex_smoke-loader_stop.exe
4208	2026-06-27_e3685eaacf0a6a4d1c2b1d098bd66b09_amadey_darkgate_elex_smoke-loader_stop.exe
4208	2026-06-27_e3685eaacf0a6a4d1c2b1d098bd66b09_amadey_darkgate_elex_smoke-loader_stop.exe
4208	2026-06-27_e3685eaacf0a6a4d1c2b1d098bd66b09_amadey_darkgate_elex_smoke-loader_stop.exe
4208	2026-06-27_e3685eaacf0a6a4d1c2b1d098bd66b09_amadey_darkgate_elex_smoke-loader_stop.exe
4208	2026-06-27_e3685eaacf0a6a4d1c2b1d098bd66b09_amadey_darkgate_elex_smoke-loader_stop.exe
4208	2026-06-27_e3685eaacf0a6a4d1c2b1d098bd66b09_amadey_darkgate_elex_smoke-loader_stop.exe
4208	2026-06-27_e3685eaacf0a6a4d1c2b1d098bd66b09_amadey_darkgate_elex_smoke-loader_stop.exe
4208	2026-06-27_e3685eaacf0a6a4d1c2b1d098bd66b09_amadey_darkgate_elex_smoke-loader_stop.exe
4208	2026-06-27_e3685eaacf0a6a4d1c2b1d098bd66b09_amadey_darkgate_elex_smoke-loader_stop.exe
4208	2026-06-27_e3685eaacf0a6a4d1c2b1d098bd66b09_amadey_darkgate_elex_smoke-loader_stop.exe
4208	2026-06-27_e3685eaacf0a6a4d1c2b1d098bd66b09_amadey_darkgate_elex_smoke-loader_stop.exe
4208	2026-06-27_e3685eaacf0a6a4d1c2b1d098bd66b09_amadey_darkgate_elex_smoke-loader_stop.exe
4208	2026-06-27_e3685eaacf0a6a4d1c2b1d098bd66b09_amadey_darkgate_elex_smoke-loader_stop.exe
4208	2026-06-27_e3685eaacf0a6a4d1c2b1d098bd66b09_amadey_darkgate_elex_smoke-loader_stop.exe
4208	2026-06-27_e3685eaacf0a6a4d1c2b1d098bd66b09_amadey_darkgate_elex_smoke-loader_stop.exe
4208	2026-06-27_e3685eaacf0a6a4d1c2b1d098bd66b09_amadey_darkgate_elex_smoke-loader_stop.exe
4208	2026-06-27_e3685eaacf0a6a4d1c2b1d098bd66b09_amadey_darkgate_elex_smoke-loader_stop.exe
4208	2026-06-27_e3685eaacf0a6a4d1c2b1d098bd66b09_amadey_darkgate_elex_smoke-loader_stop.exe
4208	2026-06-27_e3685eaacf0a6a4d1c2b1d098bd66b09_amadey_darkgate_elex_smoke-loader_stop.exe
4208	2026-06-27_e3685eaacf0a6a4d1c2b1d098bd66b09_amadey_darkgate_elex_smoke-loader_stop.exe
4208	2026-06-27_e3685eaacf0a6a4d1c2b1d098bd66b09_amadey_darkgate_elex_smoke-loader_stop.exe
4208	2026-06-27_e3685eaacf0a6a4d1c2b1d098bd66b09_amadey_darkgate_elex_smoke-loader_stop.exe
4208	2026-06-27_e3685eaacf0a6a4d1c2b1d098bd66b09_amadey_darkgate_elex_smoke-loader_stop.exe
4208	2026-06-27_e3685eaacf0a6a4d1c2b1d098bd66b09_amadey_darkgate_elex_smoke-loader_stop.exe
4208	2026-06-27_e3685eaacf0a6a4d1c2b1d098bd66b09_amadey_darkgate_elex_smoke-loader_stop.exe
4208	2026-06-27_e3685eaacf0a6a4d1c2b1d098bd66b09_amadey_darkgate_elex_smoke-loader_stop.exe
4208	2026-06-27_e3685eaacf0a6a4d1c2b1d098bd66b09_amadey_darkgate_elex_smoke-loader_stop.exe
4208	2026-06-27_e3685eaacf0a6a4d1c2b1d098bd66b09_amadey_darkgate_elex_smoke-loader_stop.exe
4208	2026-06-27_e3685eaacf0a6a4d1c2b1d098bd66b09_amadey_darkgate_elex_smoke-loader_stop.exe
4208	2026-06-27_e3685eaacf0a6a4d1c2b1d098bd66b09_amadey_darkgate_elex_smoke-loader_stop.exe
4208	2026-06-27_e3685eaacf0a6a4d1c2b1d098bd66b09_amadey_darkgate_elex_smoke-loader_stop.exe
4208	2026-06-27_e3685eaacf0a6a4d1c2b1d098bd66b09_amadey_darkgate_elex_smoke-loader_stop.exe
4208	2026-06-27_e3685eaacf0a6a4d1c2b1d098bd66b09_amadey_darkgate_elex_smoke-loader_stop.exe
4208	2026-06-27_e3685eaacf0a6a4d1c2b1d098bd66b09_amadey_darkgate_elex_smoke-loader_stop.exe
4208	2026-06-27_e3685eaacf0a6a4d1c2b1d098bd66b09_amadey_darkgate_elex_smoke-loader_stop.exe
4208	2026-06-27_e3685eaacf0a6a4d1c2b1d098bd66b09_amadey_darkgate_elex_smoke-loader_stop.exe
4208	2026-06-27_e3685eaacf0a6a4d1c2b1d098bd66b09_amadey_darkgate_elex_smoke-loader_stop.exe
4208	2026-06-27_e3685eaacf0a6a4d1c2b1d098bd66b09_amadey_darkgate_elex_smoke-loader_stop.exe
4208	2026-06-27_e3685eaacf0a6a4d1c2b1d098bd66b09_amadey_darkgate_elex_smoke-loader_stop.exe
4208	2026-06-27_e3685eaacf0a6a4d1c2b1d098bd66b09_amadey_darkgate_elex_smoke-loader_stop.exe
4208	2026-06-27_e3685eaacf0a6a4d1c2b1d098bd66b09_amadey_darkgate_elex_smoke-loader_stop.exe
4208	2026-06-27_e3685eaacf0a6a4d1c2b1d098bd66b09_amadey_darkgate_elex_smoke-loader_stop.exe
4208	2026-06-27_e3685eaacf0a6a4d1c2b1d098bd66b09_amadey_darkgate_elex_smoke-loader_stop.exe
3204	urmkeczusmkecwus.exe
3204	urmkeczusmkecwus.exe
3204	urmkeczusmkecwus.exe
3204	urmkeczusmkecwus.exe
3204	urmkeczusmkecwus.exe
3204	urmkeczusmkecwus.exe
3204	urmkeczusmkecwus.exe
3204	urmkeczusmkecwus.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	3128	i_cwusmkecxr.exe
Token: SeDebugPrivilege	3224	i_mhezwrpjhe.exe
Token: SeDebugPrivilege	2068	i_ljebztrljh.exe
Token: SeDebugPrivilege	5652	i_bvtolgeywq.exe
Token: SeDebugPrivilege	5256	i_ywqoigaywq.exe
Token: SeDebugPrivilege	6136	i_nkigaytqki.exe
Token: SeDebugPrivilege	5216	i_lfdxvqniga.exe
Token: SeDebugPrivilege	3720	i_caxspnhfzx.exe
Token: SeDebugPrivilege	4204	i_pmhecauspk.exe
Token: SeDebugPrivilege	2992	i_mgeczurpkh.exe
Token: SeDebugPrivilege	5780	i_trmjebwtrm.exe
Token: SeDebugPrivilege	4048	i_bztrljdbwt.exe
Token: SeDebugPrivilege	2788	i_eyvqoigeyw.exe
Token: SeDebugPrivilege	5380	i_vtnlfdavtn.exe
Token: SeDebugPrivilege	3704	i_igayvtnlfd.exe
Token: SeDebugPrivilege	3780	i_caxspnlfdx.exe
Token: SeDebugPrivilege	4428	i_cxvpkecaus.exe
Token: SeDebugPrivilege	1248	i_ecaukeczur.exe
Token: SeDebugPrivilege	3852	i_jhczurmkec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3696	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4208 wrote to memory of 3204	4208	2026-06-27_e3685eaacf0a6a4d1c2b1d098bd66b09_amadey_darkgate_elex_smoke-loader_stop.exe	89
PID 4208 wrote to memory of 2400	4208	2026-06-27_e3685eaacf0a6a4d1c2b1d098bd66b09_amadey_darkgate_elex_smoke-loader_stop.exe	90
PID 2400 wrote to memory of 3696	2400	iexplore.exe	91
PID 3696 wrote to memory of 5900	3696	msedge.exe	92
PID 3696 wrote to memory of 4472	3696	msedge.exe	93
PID 3696 wrote to memory of 2144	3696	msedge.exe	94
PID 3696 wrote to memory of 4472	3696	msedge.exe	93
PID 3696 wrote to memory of 4472	3696	msedge.exe	93
PID 3696 wrote to memory of 5548	3696	msedge.exe	95
PID 3696 wrote to memory of 5548	3696	msedge.exe	95
PID 3696 wrote to memory of 2576	3696	msedge.exe	97
PID 3696 wrote to memory of 3904	3696	msedge.exe	98
PID 3696 wrote to memory of 2576	3696	msedge.exe	97
PID 3696 wrote to memory of 2576	3696	msedge.exe	97
PID 3696 wrote to memory of 3904	3696	msedge.exe	98
PID 3696 wrote to memory of 3904	3696	msedge.exe	98
PID 3696 wrote to memory of 4992	3696	msedge.exe	99
PID 3696 wrote to memory of 3196	3696	msedge.exe	100
PID 3696 wrote to memory of 4992	3696	msedge.exe	99
PID 3696 wrote to memory of 4992	3696	msedge.exe	99
PID 3696 wrote to memory of 3196	3696	msedge.exe	100
PID 3696 wrote to memory of 3196	3696	msedge.exe	100
PID 3696 wrote to memory of 6108	3696	msedge.exe	102
PID 3696 wrote to memory of 6108	3696	msedge.exe	102
PID 3696 wrote to memory of 1136	3696	msedge.exe	105
PID 3696 wrote to memory of 1136	3696	msedge.exe	105
PID 3696 wrote to memory of 4568	3696	msedge.exe	106
PID 3696 wrote to memory of 4568	3696	msedge.exe	106
PID 3696 wrote to memory of 5408	3696	msedge.exe	108
PID 3204 wrote to memory of 2708	3204	urmkeczusmkecwus.exe	109
PID 3696 wrote to memory of 616	3696	msedge.exe	112
PID 3696 wrote to memory of 616	3696	msedge.exe	112
PID 5812 wrote to memory of 4404	5812	cwusmkecxr.exe	113
PID 3696 wrote to memory of 712	3696	msedge.exe	118
PID 3696 wrote to memory of 712	3696	msedge.exe	118
PID 3204 wrote to memory of 5564	3204	urmkeczusmkecwus.exe	119
PID 3204 wrote to memory of 4736	3204	urmkeczusmkecwus.exe	123
PID 916 wrote to memory of 4572	916	mhezwrpjhe.exe	125
PID 3204 wrote to memory of 2508	3204	urmkeczusmkecwus.exe	128
PID 3204 wrote to memory of 2100	3204	urmkeczusmkecwus.exe	132
PID 1428 wrote to memory of 3164	1428	ljebztrljh.exe	134
PID 3204 wrote to memory of 5056	3204	urmkeczusmkecwus.exe	137
PID 3204 wrote to memory of 1296	3204	urmkeczusmkecwus.exe	141
PID 6020 wrote to memory of 2104	6020	bvtolgeywq.exe	143
PID 3204 wrote to memory of 6024	3204	urmkeczusmkecwus.exe	147
PID 3696 wrote to memory of 2988	3696	msedge.exe	149
PID 3696 wrote to memory of 2460	3696	msedge.exe	150
PID 3696 wrote to memory of 4376	3696	msedge.exe	151
PID 3204 wrote to memory of 5464	3204	urmkeczusmkecwus.exe	154
PID 1072 wrote to memory of 4076	1072	ywqoigaywq.exe	156
PID 3204 wrote to memory of 4116	3204	urmkeczusmkecwus.exe	159
PID 3204 wrote to memory of 3824	3204	urmkeczusmkecwus.exe	163
PID 572 wrote to memory of 2452	572	nkigaytqki.exe	165
PID 3204 wrote to memory of 2404	3204	urmkeczusmkecwus.exe	168
PID 3204 wrote to memory of 1176	3204	urmkeczusmkecwus.exe	172
PID 1528 wrote to memory of 5368	1528	lfdxvqniga.exe	174
PID 3204 wrote to memory of 4332	3204	urmkeczusmkecwus.exe	177
PID 3204 wrote to memory of 3228	3204	urmkeczusmkecwus.exe	181
PID 2236 wrote to memory of 2572	2236	caxspnhfzx.exe	183
PID 3204 wrote to memory of 1992	3204	urmkeczusmkecwus.exe	186
PID 3696 wrote to memory of 4708	3696	msedge.exe	188
PID 3696 wrote to memory of 4708	3696	msedge.exe	188
PID 3204 wrote to memory of 2500	3204	urmkeczusmkecwus.exe	194
PID 1856 wrote to memory of 1308	1856	pmhecauspk.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-06-27_e3685eaacf0a6a4d1c2b1d098bd66b09_amadey_darkgate_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_e3685eaacf0a6a4d1c2b1d098bd66b09_amadey_darkgate_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4208
- C:\Temp\urmkeczusmkecwus.exe
  C:\Temp\urmkeczusmkecwus.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3204
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cwusmkecxr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2708
  - - C:\Temp\cwusmkecxr.exe
      C:\Temp\cwusmkecxr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5812
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4404
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1496
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cwusmkecxr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5564
  - - C:\Temp\i_cwusmkecxr.exe
      C:\Temp\i_cwusmkecxr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3128
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mhezwrpjhe.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4736
  - - C:\Temp\mhezwrpjhe.exe
      C:\Temp\mhezwrpjhe.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:916
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4572
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3776
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mhezwrpjhe.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2508
  - - C:\Temp\i_mhezwrpjhe.exe
      C:\Temp\i_mhezwrpjhe.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3224
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljebztrljh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2100
  - - C:\Temp\ljebztrljh.exe
      C:\Temp\ljebztrljh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1428
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3164
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2352
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljebztrljh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5056
  - - C:\Temp\i_ljebztrljh.exe
      C:\Temp\i_ljebztrljh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2068
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bvtolgeywq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1296
  - - C:\Temp\bvtolgeywq.exe
      C:\Temp\bvtolgeywq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6020
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2104
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1104
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bvtolgeywq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6024
  - - C:\Temp\i_bvtolgeywq.exe
      C:\Temp\i_bvtolgeywq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5652
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ywqoigaywq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5464
  - - C:\Temp\ywqoigaywq.exe
      C:\Temp\ywqoigaywq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1072
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4076
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4488
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ywqoigaywq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4116
  - - C:\Temp\i_ywqoigaywq.exe
      C:\Temp\i_ywqoigaywq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5256
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nkigaytqki.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3824
  - - C:\Temp\nkigaytqki.exe
      C:\Temp\nkigaytqki.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:572
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2452
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1364
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nkigaytqki.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2404
  - - C:\Temp\i_nkigaytqki.exe
      C:\Temp\i_nkigaytqki.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6136
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lfdxvqniga.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1176
  - - C:\Temp\lfdxvqniga.exe
      C:\Temp\lfdxvqniga.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1528
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5368
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5800
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lfdxvqniga.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4332
  - - C:\Temp\i_lfdxvqniga.exe
      C:\Temp\i_lfdxvqniga.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5216
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\caxspnhfzx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3228
  - - C:\Temp\caxspnhfzx.exe
      C:\Temp\caxspnhfzx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2236
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2572
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4344
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_caxspnhfzx.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1992
  - - C:\Temp\i_caxspnhfzx.exe
      C:\Temp\i_caxspnhfzx.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3720
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pmhecauspk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2500
  - - C:\Temp\pmhecauspk.exe
      C:\Temp\pmhecauspk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1856
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1308
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1780
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pmhecauspk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1968
  - - C:\Temp\i_pmhecauspk.exe
      C:\Temp\i_pmhecauspk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4204
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mgeczurpkh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2900
  - - C:\Temp\mgeczurpkh.exe
      C:\Temp\mgeczurpkh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3948
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6096
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4712
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mgeczurpkh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2576
  - - C:\Temp\i_mgeczurpkh.exe
      C:\Temp\i_mgeczurpkh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2992
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\trmjebwtrm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2220
  - - C:\Temp\trmjebwtrm.exe
      C:\Temp\trmjebwtrm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4392
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2808
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:888
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_trmjebwtrm.exe ups_ins
    3⤵
    PID:2824
  - - C:\Temp\i_trmjebwtrm.exe
      C:\Temp\i_trmjebwtrm.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5780
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bztrljdbwt.exe ups_run
    3⤵
    PID:3844
  - - C:\Temp\bztrljdbwt.exe
      C:\Temp\bztrljdbwt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2532
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1452
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1552
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bztrljdbwt.exe ups_ins
    3⤵
    PID:5980
  - - C:\Temp\i_bztrljdbwt.exe
      C:\Temp\i_bztrljdbwt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4048
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\eyvqoigeyw.exe ups_run
    3⤵
    PID:4752
  - - C:\Temp\eyvqoigeyw.exe
      C:\Temp\eyvqoigeyw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3008
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5800
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4056
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_eyvqoigeyw.exe ups_ins
    3⤵
    PID:4556
  - - C:\Temp\i_eyvqoigeyw.exe
      C:\Temp\i_eyvqoigeyw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2788
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtnlfdavtn.exe ups_run
    3⤵
    PID:3272
  - - C:\Temp\vtnlfdavtn.exe
      C:\Temp\vtnlfdavtn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:888
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:464
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:472
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtnlfdavtn.exe ups_ins
    3⤵
    PID:5472
  - - C:\Temp\i_vtnlfdavtn.exe
      C:\Temp\i_vtnlfdavtn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5380
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\igayvtnlfd.exe ups_run
    3⤵
    PID:5088
  - - C:\Temp\igayvtnlfd.exe
      C:\Temp\igayvtnlfd.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2868
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3820
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3908
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_igayvtnlfd.exe ups_ins
    3⤵
    PID:4364
  - - C:\Temp\i_igayvtnlfd.exe
      C:\Temp\i_igayvtnlfd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3704
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\caxspnlfdx.exe ups_run
    3⤵
    PID:2580
  - - C:\Temp\caxspnlfdx.exe
      C:\Temp\caxspnlfdx.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2788
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1172
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3404
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_caxspnlfdx.exe ups_ins
    3⤵
    PID:3488
  - - C:\Temp\i_caxspnlfdx.exe
      C:\Temp\i_caxspnlfdx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3780
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cxvpkecaus.exe ups_run
    3⤵
    PID:4204
  - - C:\Temp\cxvpkecaus.exe
      C:\Temp\cxvpkecaus.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3760
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3236
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5308
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cxvpkecaus.exe ups_ins
    3⤵
    PID:3764
  - - C:\Temp\i_cxvpkecaus.exe
      C:\Temp\i_cxvpkecaus.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4428
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ecaukeczur.exe ups_run
    3⤵
    PID:1076
  - - C:\Temp\ecaukeczur.exe
      C:\Temp\ecaukeczur.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5456
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4048
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5160
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ecaukeczur.exe ups_ins
    3⤵
    PID:2032
  - - C:\Temp\i_ecaukeczur.exe
      C:\Temp\i_ecaukeczur.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1248
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jhczurmkec.exe ups_run
    3⤵
    PID:5876
  - - C:\Temp\jhczurmkec.exe
      C:\Temp\jhczurmkec.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3704
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3128
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2064
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jhczurmkec.exe ups_ins
    3⤵
    PID:1916
  - - C:\Temp\i_jhczurmkec.exe
      C:\Temp\i_jhczurmkec.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3852
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pjhbztrmje.exe ups_run
    3⤵
    PID:4224
  - - C:\Temp\pjhbztrmje.exe
      C:\Temp\pjhbztrmje.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4376
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5384
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1268
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffbe9e6c188,0x7ffbe9e6c194,0x7ffbe9e6c1a0
      4⤵
      PID:5900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,17481262928921921513,8766988119404433897,262144 --field-trial-handle=2352,i,9463986027950550303,10963252521423260150,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:2
      4⤵
      PID:4472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,8056294130159103909,10117628953655808003,524288 --field-trial-handle=2352,i,9463986027950550303,10963252521423260150,262144 --variations-seed-version --mojo-platform-channel-handle=2724 /prefetch:11
      4⤵
      System Time Discovery
      PID:2144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2188,i,76684319702932104,5469862003147315802,524288 --field-trial-handle=2352,i,9463986027950550303,10963252521423260150,262144 --variations-seed-version --mojo-platform-channel-handle=3060 /prefetch:13
      4⤵
      PID:5548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3640,i,3718355823497248777,15464239830816969341,2097152 --field-trial-handle=2352,i,9463986027950550303,10963252521423260150,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:1
      4⤵
      PID:2576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3660,i,4466590505386120412,13839320003287136360,2097152 --field-trial-handle=2352,i,9463986027950550303,10963252521423260150,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
      4⤵
      PID:3904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4332,i,15197304548300027187,2290323456320893267,2097152 --field-trial-handle=2352,i,9463986027950550303,10963252521423260150,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:1
      4⤵
      PID:4992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4364,i,1887622811137765367,483092099883028514,2097152 --field-trial-handle=2352,i,9463986027950550303,10963252521423260150,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:9
      4⤵
      PID:3196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,17558093979482901114,1424381798395683882,524288 --field-trial-handle=2352,i,9463986027950550303,10963252521423260150,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:14
      4⤵
      PID:6108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,16334269638909282216,7018636468116764247,524288 --field-trial-handle=2352,i,9463986027950550303,10963252521423260150,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
      4⤵
      PID:1136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3680,i,4427502304524582408,268153173200898047,524288 --field-trial-handle=2352,i,9463986027950550303,10963252521423260150,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:14
      4⤵
      PID:4568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,13084188121105427117,5146904887546948398,524288 --field-trial-handle=2352,i,9463986027950550303,10963252521423260150,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:14
      4⤵
      PID:5084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,13084188121105427117,5146904887546948398,524288 --field-trial-handle=2352,i,9463986027950550303,10963252521423260150,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:14
      4⤵
      PID:5408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,11382178055487561255,4416186684593256898,524288 --field-trial-handle=2352,i,9463986027950550303,10963252521423260150,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:14
      4⤵
      PID:616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,14799117825080650592,4406063407204790535,524288 --field-trial-handle=2352,i,9463986027950550303,10963252521423260150,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:14
      4⤵
      PID:712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,13723906662203585629,2529584264334032251,524288 --field-trial-handle=2352,i,9463986027950550303,10963252521423260150,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:14
      4⤵
      PID:2988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4848,i,10295875762157905865,14604523023574507146,524288 --field-trial-handle=2352,i,9463986027950550303,10963252521423260150,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:14
      4⤵
      PID:2460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4868,i,10900948223481124423,8526901608723075352,524288 --field-trial-handle=2352,i,9463986027950550303,10963252521423260150,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:14
      4⤵
      PID:4376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5568,i,15279975091900351173,8218824817237824746,524288 --field-trial-handle=2352,i,9463986027950550303,10963252521423260150,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:14
      4⤵
      PID:4708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5648,i,14829739243169875660,5556671775798259271,524288 --field-trial-handle=2352,i,9463986027950550303,10963252521423260150,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:14
      4⤵
      PID:5840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5636,i,1480769890641683344,5600210154859043884,524288 --field-trial-handle=2352,i,9463986027950550303,10963252521423260150,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:14
      4⤵
      PID:6016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=916,i,17230401629811434864,8775443557748250699,524288 --field-trial-handle=2352,i,9463986027950550303,10963252521423260150,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:14
      4⤵
      PID:2548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6160,i,4404711887477156136,1444037754183328016,262144 --field-trial-handle=2352,i,9463986027950550303,10963252521423260150,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:10
      4⤵
      PID:2464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5712,i,10553578782475261674,8629849618136156216,524288 --field-trial-handle=2352,i,9463986027950550303,10963252521423260150,262144 --variations-seed-version --mojo-platform-channel-handle=1208 /prefetch:14
      4⤵
      PID:2676

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2648

C:\Temp\urmkeczusmkecwus.sys
C:\Temp\urmkeczusmkecwus.sys
1⤵
- Executes dropped EXE
PID:4488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5204

C:\Temp\zxrpjhbzur.sys
C:\Temp\zxrpjhbzur.sys
1⤵
- Executes dropped EXE
PID:2788

C:\Temp\rljebztrmj.sys
C:\Temp\rljebztrmj.sys
1⤵
- Executes dropped EXE
PID:5472

C:\Temp\bvtqojgeyw.sys
C:\Temp\bvtqojgeyw.sys
1⤵
- Executes dropped EXE
PID:616

C:\Temp\dbytqljdbv.sys
C:\Temp\dbytqljdbv.sys
1⤵
- Executes dropped EXE
PID:4808

C:\Temp\bvtnlfdayw.sys
C:\Temp\bvtnlfdayw.sys
1⤵
- Executes dropped EXE
PID:1232

C:\Temp\qnigaysqki.sys
C:\Temp\qnigaysqki.sys
1⤵
- Executes dropped EXE
PID:5060

C:\Temp\icausnkfcx.sys
C:\Temp\icausnkfcx.sys
1⤵
- Executes dropped EXE
PID:2112

C:\Temp\xupnhfzxsp.sys
C:\Temp\xupnhfzxsp.sys
1⤵
- Executes dropped EXE
PID:2428

C:\Temp\zxrpkhfzxr.sys
C:\Temp\zxrpkhfzxr.sys
1⤵
- Executes dropped EXE
PID:6136

C:\Temp\uomjhezwuo.sys
C:\Temp\uomjhezwuo.sys
1⤵
- Executes dropped EXE
PID:5252

C:\Temp\bztrojhbzt.sys
C:\Temp\bztrojhbzt.sys
1⤵
PID:1780

C:\Temp\dbwtnljdby.sys
C:\Temp\dbwtnljdby.sys
1⤵
PID:1400

C:\Temp\jdbytqljdb.sys
C:\Temp\jdbytqljdb.sys
1⤵
PID:2804

C:\Temp\ifayvqniga.sys
C:\Temp\ifayvqniga.sys
1⤵
PID:2628

C:\Temp\icaxsqnlfd.sys
C:\Temp\icaxsqnlfd.sys
1⤵
PID:2064

C:\Temp\nhfspkhcau.sys
C:\Temp\nhfspkhcau.sys
1⤵
PID:2688

C:\Temp\fcausmkhfz.sys
C:\Temp\fcausmkhfz.sys
1⤵
PID:2028

C:\Temp\hecwusmkec.sys
C:\Temp\hecwusmkec.sys
1⤵
PID:2624

C:\Temp\omgeztrojh.sys
C:\Temp\omgeztrojh.sys
1⤵
PID:5048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bvtnlfdayw.sys

Path C:\Temp\bvtnlfdayw.sys
Size 293KB
SHA256 de2ff5535201dc1678ab4dff175ce268b77e2ddb1a0b3ee33142324a918b4467
MD5 c269bd05f7eeba97d4eaf5cadf70a155
SHA1 3d368ffbe5ef147c4c7bc2a0b8f22e6b7b67aacc
SHA512 36295642fe8f7516b5ae25760d5ff3c3fa02288552882bd1c1cfbb1a286457ad1be856ddbacb092a13cd6ee4af1035d3dc7267996e8eb63bda26d13ee1a04355
SSDEEP 3072:BtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:BIJjiJcbI03GBc3ucY5DCSj
TLSH
T180545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bvtolgeywq.exe

Path C:\Temp\bvtolgeywq.exe
Size 384KB
SHA256 ce94ca9f834f688c5d4234e81147e60bfa2e6cadaf2bb1511a1229083cfc0700
MD5 f5bb5679040e4ac378c852633ee82a23
SHA1 3e3702ca989b19ec66cd036017bd8b6b8f153e26
SHA512 91986a3207a3a91e957a4909dd2d63da65cbcb72b226c64af9542110ee2c4d23df2b8a1c6090a9d50416fb9c00ae5143118985d13100229daa5ea7b7439f7f19
SSDEEP 3072:t9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:/ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T176847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bvtqojgeyw.sys

Path C:\Temp\bvtqojgeyw.sys
Size 293KB
SHA256 59a5128241aa2072daebaeeb94288cd98af975465a45470ba3afc058796dda1e
MD5 8c3614e341a77f32cfb43a44854dfb5a
SHA1 705db61607a50d40da09ec3b8b943ae73eade5f1
SHA512 6a3fa4e91c9a14f1c4369ad686c9f9172c168ab3b51fd6119b2ceca866b6ff5180e2e7651106a3e493e3c3e3e87965fe2b3b7b82c7dd4d5320e5a4b3a3c614f8
SSDEEP 3072:atKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:aIJjiJcbI03GBc3ucY5DCSj
TLSH
T101545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cwusmkecxr.exe

Path C:\Temp\cwusmkecxr.exe
Size 384KB
SHA256 caf726e32d71f7f6bd4b618217a42e3db06604616def3ce701a0be9a76fe9dfe
MD5 af5db96b25ea7310d28a7c6b91580f20
SHA1 4b03e9cf7a5ccd034b3867a53e8c0891bd184639
SHA512 ed9345a40c342a724af95dd20fcda049bea444c79374c0be161f907248a60af3dadf3f7d1ae10a5be1f7d8b16ae6721f39f0b4b3c76b9eed82801bc2979ad1fa
SSDEEP 3072:l9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:HctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T191847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbytqljdbv.sys

Path C:\Temp\dbytqljdbv.sys
Size 293KB
SHA256 1f5d999ee4207232798fcfc436dc3ffd7a02e69ff559ba38d5567fd07e590641
MD5 fe5fb5c87d6acc0706e684626428f169
SHA1 3c6bff302bc616096c3c70f68572d949563ffca8
SHA512 3725234975defbb1ee00aea6a49abbad539ede6a2b5a515bfacddb05c66ae13b726dd02204069752ad54c8cfd2c628bf9d0de8d7597d084a48eceb5a3b1b34c8
SSDEEP 3072:PtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:PIJjiJcbI03GBc3ucY5DCSj
TLSH
T1B6545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bvtolgeywq.exe

Path C:\Temp\i_bvtolgeywq.exe
Size 384KB
SHA256 3bca468f304ac7e93de7e720ee10331452d6c09cd0ef477140c38be38c4c56a6
MD5 e49b79160731d1d34ff6c53d644c0e26
SHA1 ecec0604f0226a27985bfc3f37e5a4a105ee20fa
SHA512 0f1df8b750424057092435b57a50570537e6973e9f99eade92ee6b905318d4e1a8d74579d6fac6261508b73311ce42f190568c8757d844727fcc8d23f0593aab
SSDEEP 3072:K9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:wctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D4847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_cwusmkecxr.exe

Path C:\Temp\i_cwusmkecxr.exe
Size 384KB
SHA256 0c86e8d708d0b08c380d9fadd69179c5013a878369c93da664dcb4daf5a51c1f
MD5 849e3784750ae775c14538e021cf0f14
SHA1 26a58d09fc312f10adb78f64490870f4d7d869c2
SHA512 55e0f2851da1e438076599e0aadbcf4cb0d4ffbe482be02370e2cc8e18166e3451694de6dc7ff36601362356b0941ace9113ffe44066300a6b8e33bcc83acb39
SSDEEP 3072:g9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:yctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T157847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ljebztrljh.exe

Path C:\Temp\i_ljebztrljh.exe
Size 384KB
SHA256 347148499063dd4ca5f074a026bf49a82fb9da41188f941d8f5eb40d81976173
MD5 2b3af7a4c1f6d18f9a6674fa96b8f3fc
SHA1 4bfa3af4addae34ea1ede155c1c11ae99f355784
SHA512 6ef7bd46ce032e26a46eb0fd8dd1a038ee3d0a5a6d19b9c81f9c5d1bc6efafa284817fc91213a70fb8d6a1eb3e18a6b8fb85e7d1b9cbef74c9810dfcae81b328
SSDEEP 3072:n9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:9ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F5846A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mhezwrpjhe.exe

Path C:\Temp\i_mhezwrpjhe.exe
Size 384KB
SHA256 06180604d478f44dd4587fd392b7bbeee55bd50203df01b02567d57f2de2c122
MD5 52b405a7fd383e52ca764de08b4dd777
SHA1 07a10396c12f1fca2df059f6d4b23c875837f435
SHA512 52f7d3d8a6900f5ebdf5f6865237dde3c9b5eb82926644bf6e984d9bd44ef81042aa1aa3105daa07692ea388a3084d7ba8f522270efe7a13d20a110d88acb89f
SSDEEP 3072:H9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:dctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T129847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nkigaytqki.exe

Path C:\Temp\i_nkigaytqki.exe
Size 384KB
SHA256 75e3e60906465422b370fb84f61ec010d7952e412d52a1550c459594143e3572
MD5 dfcedbee2f02cad7caf4e4b9b213d6eb
SHA1 76fb19948e8bff674f00703ae97147c87b2c2c6d
SHA512 d52d002ebb6fc1d9931a91e0a5f2890ef64f627e9f248081f1083b29ce96db0ce75a88682a61aba818637be17d2ac53792325bb25d2d2bcb7fdf7f43a235a647
SSDEEP 3072:69ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:gctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T17C847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ywqoigaywq.exe

Path C:\Temp\i_ywqoigaywq.exe
Size 384KB
SHA256 f164743631b2a85e047a1437d83c406124e5cd4d446b0f4d82f238ba8326bbc3
MD5 2ad33e2009ec330e9b4cd9e08bf710b8
SHA1 279dbfb27b8633054c7f770702353a64a60558a5
SHA512 8035a7654bbf1765872e630d47623ffa0fd792251a5638b898d3ca6de73ac932e6b87ebc87f3865f844245a90f6d5c3e1c05777a781ced58143052f9fee04663
SSDEEP 3072:T9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:xctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1EB847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljebztrljh.exe

Path C:\Temp\ljebztrljh.exe
Size 384KB
SHA256 f2a05adc1aabc2736d935231193319d07b4782155ec80b56164b7e097262dd23
MD5 865c5e48f5a5ebd2d9c78dfc44019247
SHA1 21a8c643cf9e535f6cb44ebcc72d2c3e13f40f81
SHA512 197328afe3512872a13088f3887a3f8aa4257fdd639a9c48fae29bedaf6287d90a4002fb96e82dde4d8f246a084f98813c2cfa576f9b61816294403bb6088a88
SSDEEP 3072:79ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:pctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C8847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mhezwrpjhe.exe

Path C:\Temp\mhezwrpjhe.exe
Size 384KB
SHA256 43e7241e5ef01c173127a2578d80ded6461e5a77d2d1285fe719911592130c3b
MD5 e4c3af72e36738c466859f8015440b56
SHA1 7b87947404474cc3a38904eff3c39c337870dee3
SHA512 dab2cce9c399cded081657dcf837b2747b620fa3dd93aae1a2648a8e740b35bb8d60fc741160160ab0510b2f0905cf58a8f8aa879aa547f5264773f6831972e6
SSDEEP 3072:R9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:bctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A0847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nkigaytqki.exe

Path C:\Temp\nkigaytqki.exe
Size 384KB
SHA256 327b421637f75fb199e9eb62467ec8f4b48075125bdf1387a5b2bb2c2ee612d3
MD5 4c1025fccb764dffb582e7fac800121d
SHA1 7b3448d8ba938569936bfffbfd10e56596abd5c6
SHA512 544fd65b8f20f3f0a2f3588d998be8bd07d57cbc70fd98a3c9a8b5376d05f42f044bcf20b44dfd83dd9c91d41b552dbfea7ed04cb1c7bef3d993ff3cecb709d5
SSDEEP 3072:F9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:nctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T128847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rljebztrmj.sys

Path C:\Temp\rljebztrmj.sys
Size 293KB
SHA256 14ad977ce2230b0e0846b3650c9fb30ae2a8e88a924570b1ab226d4bc30c3d6d
MD5 918287df0d008645815835ddefdc41b4
SHA1 4f3689dcffeb3329ec37896f587c8b54f5eef365
SHA512 8ccdb040cfef270efc64147c07d0146a46daee3a8790ccfcdbca13a1faa0a1103919ffef1c4b20037a35f8fb32e0624d71861bd42388f8e4cc5407b93d2bd563
SSDEEP 3072:LtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:LIJjiJcbI03GBc3ucY5DCSj
TLSH
T19C545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urmkeczusmkecwus.exe

Path C:\Temp\urmkeczusmkecwus.exe
Size 384KB
SHA256 1a7e541816b6d2fd664666d1f02c92139b48334310395e912b0c1f8a49502e6b
MD5 d01af7db72e899c5c5d8799d56a86b07
SHA1 3ecb41385ddbda44c81f0a872293f8c614c33f37
SHA512 1c9302f990c98aceebd217148d2a815fee767f3126e356ef2250f9157fd8ac471b273cbe998a1e2a8e68015003a6542e95f6ec5ce9e6874639bb5c0920315473
SSDEEP 3072:v9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:1ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T150847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urmkeczusmkecwus.sys

Path C:\Temp\urmkeczusmkecwus.sys
Size 293KB
SHA256 1a115c3bfb600a4d77dc228d9067d330871385207a1291a28236f49f4562e3e7
MD5 9f2085ae37a99c8a558c616497203615
SHA1 92d492f3ec5103a15b8b1a8dbdcb544b62551822
SHA512 3b186834109e9911337bcd00258d23cc319757f39d7469313e5e7f7e3f58afdfda13b3829ba6f3b0cdc34babb9af9ceb8ad576d02401c008d71520d8c866fd27
SSDEEP 3072:ftKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:fIJjiJcbI03GBc3ucY5DCSj
TLSH
T12B545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywqoigaywq.exe

Path C:\Temp\ywqoigaywq.exe
Size 384KB
SHA256 bd0baae9387127162c01f3a03b313af4739cd8a608bf8163c9cdb782d6e1a29c
MD5 af781b0bfd885410c4a05e87f0c68c25
SHA1 9e4316b4b7247e4c9d6dcbfe15ee70cf3074ecfb
SHA512 c97db23540d51935c91ae876933404ca9efe864695e0883a3a61e4bdc9270de6307047be4dfd12d6fc7aafbf9d7f71352124928a7840773d0f6b0f166d8552c5
SSDEEP 3072:R9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:bctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T171847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxrpjhbzur.sys

Path C:\Temp\zxrpjhbzur.sys
Size 293KB
SHA256 179f75a841310956dfd963b4a6787d416b7665b31c72afa691cd16810bc908aa
MD5 6f16980d765ae82b94e28527c081b170
SHA1 31f4f7572065e275222f8646238f935f15f77857
SHA512 720fc7a98ad53ac5cc595b64c32b138903958d44813573dbd56c9be2fc44f8752347f7e86e76358ff27a414713b393c93d524b67c0e2834a116eac532a885564
SSDEEP 3072:ZtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:ZIJjiJcbI03GBc3ucY5DCSj
TLSH
T136545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b4edbbe62f29386512f6cd1726c675b23fdeee21a26a2896a394ff9b87143167
MD5 c0060c375421fc206e85d98fc2ea6677
SHA1 2189b0dd881564dfef39585cc2cffda4dcd3ec91
SHA512 338dc8a4791fbbe759582d4a8fd55c1a6245fcc722bff11ff926118daa91041d62e98b05cb2e63b22ea119d41a557c511dcfb12592ab416dab9980af0b5ca713
TLSH
T1F2D0C0703F42F008C04904F08534EF101337B81230839900F170C80E84E40C0A3C8043
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b778cc535cfe9ef8131b9d727f221c5d63c7f15bcd4cd19db345f2c97bdf5594
MD5 a4b8f3b6133ca4686118d40b6c8d4ea7
SHA1 cbca41492cec17181764c1371da84a0e0481f93f
SHA512 65135f099a2e372c9a11538ad8ff73abdfa24612895545773034b613318a9166b5560e41026d2ec245dda6b088efde1566126dae35182ddcb3fe795a786554ad
TLSH
T1B7D0C0743F42F108C04904F08534EF101337B81230839900F070C80E84E40C0A3C9053
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 5248fc4e6cfc74c81919a3356ef3c5875109cf2f51f48ea791ee18371c7133b8
MD5 46ca5f3b8d067ec0f60c25675259d4db
SHA1 15fa7aff71f550622a1d29ddbb1091838e46dc2a
SHA512 1009e849632154a4319e8b9ff33a202c49105edc939087e69d318cc0facfb4a0f104dfe78326ade3919238b6977ee4c8bc4ebee216dd8b625b9cd919ac7c3577
TLSH
T1CF711B246962CBA5EB6BE37471C21CEF33B4E1D80C0B2FA00BD07230C56B7C9A071989
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe595efe.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe595efe.TMP
Size 3KB
SHA256 46165ee16fc45382b327066161c18eb88020cff7d15dc66850108dd701ea4fae
MD5 ac413d398e6599594b3f4c435722a426
SHA1 8839de83ea62c1fe957adadb841b63381644caaf
SHA512 d77edb4f6b43b24bebdfa45277e27d2b700a0b0b611983471982fbb82500b0fbad7b5b3adcb94e07a4131619e761959fc78306a5d052e63635202469cca48953
TLSH
T138711B246962CBA5EB6BE27470D21CEF33B4E0D80C0B2FA40BD07230C56B7C86070989
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 894dc2a1229be73a1772577ec610602049a26f23598578074c964e7acb75547c
MD5 c2eafc59395f7ddb5342404c61afb1d7
SHA1 3aae07dcb2428fef0a12e76fbcbda437bd4e284a
SHA512 23397d09cffa90786260b27f3fcb1a065dba79221f449394b66b96cacdf993e616824f948ddb596c519ccefa140f4c9ca5fe8d520f3841d37954253738e42852
TLSH
T1A951BDF3C2E8866D8A0195F0BA147E2BCE1D0914832C3D5AC9E4AF5BA3E2471D14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 e85265aebc622cecf595deb72693b4aa536c98bb273d464eeb470d834b23e595
MD5 871de3962c9238881e23b818789f9f7b
SHA1 fd949ddb09838d5b25e0b92d6408f21535014753
SHA512 1b954b71e9b45f4847e9729d2aea03aaf1ed2d5314d6a73894675fe934f2e02d177091fefec66240b6a3901170b6463748129fe4f067195c802a7443fe75a1b7
SSDEEP 192:sxRoRSyM/jK1Ml8wc0/fgsPz1JZxjzoA8p9D/g6+WNCed/YYMvYuqjG1IgVnJ:sxRo8C0/fgsPz1Ho9/5V/aq4r
TLSH
T17E62FA16AA34597BCDCBD30DFA527B53D6F81563A2940E48A9FCCA0C04E7ADD221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 56902eb414c26fb00ad7ad02a80eb21c865a2151c92fbe47d68a074f2e33bfa5
MD5 e5ae678ac583a5c475a1f7ef2800263e
SHA1 2ace8ac520e7cfd39f8acbfaf6288bf945dc9bdd
SHA512 151898d3f140e136fa81430697a9994ac0ac37cad393251d47bda8e073d37fb1730532deef3e23610defc30864f623ca29b72ddcf857fea6ccab907b03a25fac
SSDEEP 192:sxRHRSyM/jK1Ml8wc0/fgsIz1JZxjzoA8p9D/g6+WNCed/YYMvYuqjG1IgD8nJ:sxRH8C0/fgsIz1Ho9/5V/aq4c
TLSH
T18662FB16AA34597BCDCBD30DFA917B53D6F81573A2940E48A9FC8A0C04E7ADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 ea2add1f275c407dcd49b6be62ed3192e04447418183f72445b277baed452e6d
MD5 c3c182c38ef6d0200dbc4b996dc9d5e3
SHA1 a82d76e0d41e62a7f1c75c01aee464073b2bd7f5
SHA512 3a21ad69878d2b2ed00628ba28ef1dc66bc4fc9195893490ceaafbae9579fecb54511d342f8c69c63bd8be12cb8210e3f6377e59ebf1ae5696b4c8e2b0d43277
SSDEEP 192:sxRHRSyM/jK1Ml8UQpc0/fgsIzlJZxjzoA8prD/g6+WNCed/YYM9YuqjG1IgDunJ:sxRH8q+0/fgsIzlHo3/5V/aq4K
TLSH
T12762D916AA345977CDCBD309F9927B53D2F85563A2940E48A9FCCB0C04E7ADD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 9ee64ce3ff30446690ab56f8455637adb84af73958c3373cbdd5f71ffe118f09
MD5 07fdd97ef4f3b280a954b690f38fed68
SHA1 91f54dc31e15daa48f9fca44f4fc95cab6a6a5ce
SHA512 4fa9800294847bc9d8cc2dd358c0b937a8c3f1bad9385ab244bd33b5f0f4010fb3034688a376a90285de9613a2861cf38f49a3e998a5121f2dbe8c2e0ddcd522
SSDEEP 768:j+8uVA7pLuL7q7WgNVfq38F1+UoAYDCx9Tuqh0VfUC9xbog/OVMEpBJ60rolzz:j+8uVME7q7WgNVfq3u1jaLEpH6flzz
TLSH
T10FE2EC3B680CCB7E4F804DDCEC25BE9A6DE801CB96D8CD5447EA841C03C6AEB551A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 82c240bbba82d73962055f460ef76e5850e54cb7c70978555a0ce5d020218433
MD5 7e452fc9670ac7e5a0ace200a9226cf5
SHA1 533704bf184a638dbd862c2f56a22705eace478d
SHA512 cb48e10cdd59f5cd869626a009f65e6b778faf40bf876944256ce29a18f4ba1a4385fb60766a8e4e5fe98f38ec23702dc6693988d8f7d2344a70f86094df320b
SSDEEP 96:KMswK1aufwrkwe2Gm4WJNWwmKejWymSYQRCQ3aGwKnqiqQ:Krfwrkwe2GFWJQwAjWy5YQRCQ33PN
TLSH
T154A14A12707B278429BE2A899594B55E024170A735E6B46F3FD820E22F3FF411EFD4D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d6069d89-f9da-4070-94ae-4395e9e4968e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\d6069d89-f9da-4070-94ae-4395e9e4968e.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 25a96daa46a5cfca4d100b8994acf962ca45e78bac4164959a10ea28a55e8d30
MD5 bfd638151bef80f43042183fb9b5c256
SHA1 088ebb89c78ee1ca34566ec836e98bd8c1cbe91c
SHA512 09fb5187d30e3f3b8678a5495bdfde79a91369896a48f517e566ea834d84de87f13c3265199e05dee97d0231bad8e7fbdd6e52fdec5c93f1c303e1f3f9ab7850
SSDEEP 768:UjaeqD4MlshiLdMmQ3w3gafftfnAHyJ5p3EFlnNMLmK+yjWtTzTb:UqcjhIdMH3Wftfvp3EFlSCFyj2v
TLSH
T18403D03A98A09C678CA696C5760B77976DB046A3CB913B49DCCC7A0E01A77DF130BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 299ecd992b95a053ce66a403103df60e9619caa86f55e9166cddde114b715f7e
MD5 b550fd49e233bb8bce2a317aa2b26e74
SHA1 4d121717f908c9ebde5798ed64b1b96890b492a3
SHA512 823619892c81f8bfc47aa40d2b34c798ed08206054261beb9a1279d821b48b95e8bafbae73702aba132b8f54184f3ea1f9a17e59f2d0137b4e1a572251fb1c55
SSDEEP 768:EjaeqD4MlshiLdMmm35Wwhe8gafftfnAYfn72yJ5p3EFlnNMLmOvzn12bfJcYTX:EqcjhIdMV35e2ftfjf7jp3EFlSCgByJ/
TLSH
T15513CF35ACA09D635EA6A685754773C3AEB005B7CA912A4CDCD45E0E01973CE170FC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 526e240ff9afd8ce12ac1a09117756cfa5f795b925a9bf48eeb95bd66fdb6690
MD5 df2b8f10173110cbe25ebf227d75d604
SHA1 a3fd596985d14be5d90694416eac0d5b0a8640aa
SHA512 1e81a89cbfaec71b4be6f9c5ff9b46ed7eba4894432ae0875ae0afc483f7617d994ebca6d08e6812983c22ead5543d399031ec7fb8a3d1cbc88175064f9feb44
SSDEEP 768:1j+943iWwje8gafftfnAYfn7zyJ5p3EFlnNMLmOvzn12bfJcj:A943ic2ftfjf7kp3EFlSCgByJcj
TLSH
T119F2BE31A8A09E535ED6D7C8754B7387BEE446739A811A48C8D89F0E01D77DE170BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 0a87bf2f80f7868ba4142961bf6de6b8f1c8567ec3c42f976f4218cf385d67aa
MD5 e74503c16802b8ab83d09ebe6e24604e
SHA1 fa4f6138b1576a022a8460f7f6350a1e72a0ee69
SHA512 ce37c5fffa086432294253164ced791c67b834a2b49ef6b488cc4fd37aaca5d6186c5b746c0735536fd2832faaf5f324c04c9ab2c0b8895435a2d8471059eb65
SSDEEP 768:bj+943DWwje8gafftfnAYfn7zyJ5p3EFlnNMLmOvzn12bfJcj:O943Dc2ftfjf7kp3EFlSCgByJcj
TLSH
T135F2BE31A8A09E635ED6D7C8754B6387BEE446739A811A48C8D89F0E01D77DE170FC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 411384e049eed93406fa7628c16668373813c4215a927f3f09a9d35804bec302
MD5 b1e38f3c2c93c3ff4a07715726754d60
SHA1 5c535f32972d8220bc43c055ec48a9e2e14a126e
SHA512 1cc4f4603c57a144c6cf6674de14df23174c10ee53ec0cc0c1d4600e9e1d5e4b0f4b1fa567a79e16ea2515bcee84a2134355f71aa869bf9e847ea334ffe1ecb0
SSDEEP 768:gF1j+9t3+wgXWwqeSXftfnAYfn7YyJ5p3EFlnNMLmOvzn12bfJcj:t9t3Unkftfjf7hp3EFlSCgByJcj
TLSH
T1681349F598D38A36D99E8787673E2E46ADBCC163B5845984BBC45D0DCC832BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

95ad8679-7add-40c0-859a-89c05c757ea2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\95ad8679-7add-40c0-859a-89c05c757ea2.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3696_2040494770\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 8020bf08d0f6cdf21d3570db83b453e3244b5b8b940c3b562402964224a2f98e
MD5 55a764bb8a6a6a36c5c78dfa1d784008
SHA1 4842bfd6291fc53ef583b5ab27bf78fccb179874
SHA512 a4659d8b0dd6fd2a5be01dea028149d4fad02b6df57c9ad647dac8df20453635b25155e220522be830a3b661ffbcb4f38c686f9086a3925594e8c2e0cf22143e
TLSH
T1C971008357A9CAB2C29A5BF002835248F1BB2278072370214B565686AA30A7A58B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/616-282-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1232-297-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1400-416-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1780-395-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2028-478-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2064-452-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2112-327-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2428-342-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2624-491-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2624-510-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2628-440-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2628-454-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2688-480-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2688-457-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2788-195-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2804-420-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2804-442-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4488-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4808-281-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5048-508-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5060-323-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5252-397-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5252-375-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5472-242-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6136-346-0x0000000000010000-0x00000000000AB000-memory.dmp

Download