systex | 0ee5d24785f2602e1dd2d86237115b810bc4ae857a1105fbcc48909e87fcadde

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 12:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-26_cf44534fe363ca63136e916385af14f6_amadey_darkgate_elex_smoke-loader_stop.exe
Size 384KB
Sample260629-pcrdxaev9n
SHA256 0ee5d24785f2602e1dd2d86237115b810bc4ae857a1105fbcc48909e87fcadde
MD5 cf44534fe363ca63136e916385af14f6
SHA1 6fe68e8fa78cb05ec44d9c1c2e893cbe8d107c11
SHA512 4d09ed180b159d20993a0f55135a018658cce3b8627443f15687c2bc9cfe3012435e1bef1396bee6651b8d3ffecc68650af02c5d0deff7505743c1081ebc1129
SSDEEP 3072:+O6UF5toCvty8dsaMj4ygtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ug:36QtpouIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1CC847B00BAA4F0F6D995043800EFAF36A67E74281B26CBC3E754CE5D99513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
4108	cxvpnhfcxusmkifd.exe
1156	cxvpnhfcxusmkifd.sys
5900	CreateProcess.exe
5028	fzxspkicav.exe
6032	CreateProcess.exe
5300	CreateProcess.exe
4684	i_fzxspkicav.exe
1996	caupnkfcxm.sys
4564	CreateProcess.exe
4924	pjhczxupmh.exe
3408	CreateProcess.exe
4476	CreateProcess.exe
2692	i_pjhczxupmh.exe
5836	ecwrpmhfzx.sys
2512	CreateProcess.exe
936	czurmbwuom.exe
3016	CreateProcess.exe
3372	CreateProcess.exe
2448	i_czurmbwuom.exe
1096	rljebzwuom.sys
1916	CreateProcess.exe
2472	romgecwuom.exe
5496	CreateProcess.exe
4172	CreateProcess.exe
5380	i_romgecwuom.exe
4608	omgeywqojg.sys
5948	CreateProcess.exe
1600	jebvtomgey.exe
712	CreateProcess.exe
2204	CreateProcess.exe
1224	i_jebvtomgey.exe
5368	dbvtgdbytq.sys
2692	CreateProcess.exe
3208	wqolgdbytq.exe
4440	CreateProcess.exe
2984	CreateProcess.exe
3384	i_wqolgdbytq.exe
4456	gaysqlidbv.sys
5992	CreateProcess.exe
996	yvtnlyvqoi.exe
2448	CreateProcess.exe
4540	CreateProcess.exe
2956	i_yvtnlyvqoi.exe
5204	sqnigaysqn.sys
948	CreateProcess.exe
4708	nlfcayvpnl.exe
6120	CreateProcess.exe
1156	CreateProcess.exe
3916	i_nlfcayvpnl.exe
2016	ifdxvsqnif.sys
248	CreateProcess.exe
1068	axspnhfaxs.exe
3448	CreateProcess.exe
5124	CreateProcess.exe
3656	i_axspnhfaxs.exe
1096	causmcxupn.sys
3152	CreateProcess.exe
2956	smkhfzxspj.exe
5456	CreateProcess.exe
880	CreateProcess.exe
4120	i_smkhfzxspj.exe
3584	xusmkhezwu.sys
3840	CreateProcess.exe
1772	czxrpmhfrp.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2004_1393678226\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2004_1319795828\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2004_1319795828\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2004_982355713\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2004_669490766\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2004_669490766\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2004_1556853284\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2004_1393678226\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2004_1393678226\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2004_1319795828\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2004_1319795828\sets.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2004_1556853284\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2004_1393678226\llm_user_input_extractor_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jebvtomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqolgdbytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axspnhfaxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrojgeywtr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrojgeywtr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jebvtomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lfdaywqolj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igayvqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xuspnhfcxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czusmkhcxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxvpnhfcxusmkifd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czurmbwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlfcayvpnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkhfzxspj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomgezwro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgdbvtolga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-26_cf44534fe363ca63136e916385af14f6_amadey_darkgate_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhczxupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axspnhfaxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lfdaywqolj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czusmkhcxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	romgecwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqolgdbytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhczxupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czurmbwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smkhfzxspj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvpnifay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_romgecwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvtnlyvqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlfcayvpnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czxrpmhfrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czxrpmhfrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomgezwro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxvpnifay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvtnlyvqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgdbvtolga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igayvqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xuspnhfcxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urpmheczxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxspkicav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxspkicav.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4112	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1524	ipconfig.exe
5836	ipconfig.exe
2056	ipconfig.exe
4712	ipconfig.exe
792	ipconfig.exe
1088	ipconfig.exe
4340	ipconfig.exe
5716	ipconfig.exe
3156	ipconfig.exe
5612	ipconfig.exe
1944	ipconfig.exe
3380	ipconfig.exe
5172	ipconfig.exe
1644	ipconfig.exe
1416	ipconfig.exe
3384	ipconfig.exe
4464	ipconfig.exe
5232	ipconfig.exe
2108	ipconfig.exe
3900	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-557124681-2609731375-3674401788-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-557124681-2609731375-3674401788-1000\{2B610BD3-B2E0-40EA-8562-7B2670130FC5}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5632	2026-06-26_cf44534fe363ca63136e916385af14f6_amadey_darkgate_elex_smoke-loader_stop.exe
5632	2026-06-26_cf44534fe363ca63136e916385af14f6_amadey_darkgate_elex_smoke-loader_stop.exe
5632	2026-06-26_cf44534fe363ca63136e916385af14f6_amadey_darkgate_elex_smoke-loader_stop.exe
5632	2026-06-26_cf44534fe363ca63136e916385af14f6_amadey_darkgate_elex_smoke-loader_stop.exe
5632	2026-06-26_cf44534fe363ca63136e916385af14f6_amadey_darkgate_elex_smoke-loader_stop.exe
5632	2026-06-26_cf44534fe363ca63136e916385af14f6_amadey_darkgate_elex_smoke-loader_stop.exe
5632	2026-06-26_cf44534fe363ca63136e916385af14f6_amadey_darkgate_elex_smoke-loader_stop.exe
5632	2026-06-26_cf44534fe363ca63136e916385af14f6_amadey_darkgate_elex_smoke-loader_stop.exe
5632	2026-06-26_cf44534fe363ca63136e916385af14f6_amadey_darkgate_elex_smoke-loader_stop.exe
5632	2026-06-26_cf44534fe363ca63136e916385af14f6_amadey_darkgate_elex_smoke-loader_stop.exe
5632	2026-06-26_cf44534fe363ca63136e916385af14f6_amadey_darkgate_elex_smoke-loader_stop.exe
5632	2026-06-26_cf44534fe363ca63136e916385af14f6_amadey_darkgate_elex_smoke-loader_stop.exe
5632	2026-06-26_cf44534fe363ca63136e916385af14f6_amadey_darkgate_elex_smoke-loader_stop.exe
5632	2026-06-26_cf44534fe363ca63136e916385af14f6_amadey_darkgate_elex_smoke-loader_stop.exe
5632	2026-06-26_cf44534fe363ca63136e916385af14f6_amadey_darkgate_elex_smoke-loader_stop.exe
5632	2026-06-26_cf44534fe363ca63136e916385af14f6_amadey_darkgate_elex_smoke-loader_stop.exe
5632	2026-06-26_cf44534fe363ca63136e916385af14f6_amadey_darkgate_elex_smoke-loader_stop.exe
5632	2026-06-26_cf44534fe363ca63136e916385af14f6_amadey_darkgate_elex_smoke-loader_stop.exe
5632	2026-06-26_cf44534fe363ca63136e916385af14f6_amadey_darkgate_elex_smoke-loader_stop.exe
5632	2026-06-26_cf44534fe363ca63136e916385af14f6_amadey_darkgate_elex_smoke-loader_stop.exe
5632	2026-06-26_cf44534fe363ca63136e916385af14f6_amadey_darkgate_elex_smoke-loader_stop.exe
5632	2026-06-26_cf44534fe363ca63136e916385af14f6_amadey_darkgate_elex_smoke-loader_stop.exe
5632	2026-06-26_cf44534fe363ca63136e916385af14f6_amadey_darkgate_elex_smoke-loader_stop.exe
5632	2026-06-26_cf44534fe363ca63136e916385af14f6_amadey_darkgate_elex_smoke-loader_stop.exe
5632	2026-06-26_cf44534fe363ca63136e916385af14f6_amadey_darkgate_elex_smoke-loader_stop.exe
5632	2026-06-26_cf44534fe363ca63136e916385af14f6_amadey_darkgate_elex_smoke-loader_stop.exe
5632	2026-06-26_cf44534fe363ca63136e916385af14f6_amadey_darkgate_elex_smoke-loader_stop.exe
5632	2026-06-26_cf44534fe363ca63136e916385af14f6_amadey_darkgate_elex_smoke-loader_stop.exe
5632	2026-06-26_cf44534fe363ca63136e916385af14f6_amadey_darkgate_elex_smoke-loader_stop.exe
5632	2026-06-26_cf44534fe363ca63136e916385af14f6_amadey_darkgate_elex_smoke-loader_stop.exe
5632	2026-06-26_cf44534fe363ca63136e916385af14f6_amadey_darkgate_elex_smoke-loader_stop.exe
5632	2026-06-26_cf44534fe363ca63136e916385af14f6_amadey_darkgate_elex_smoke-loader_stop.exe
5632	2026-06-26_cf44534fe363ca63136e916385af14f6_amadey_darkgate_elex_smoke-loader_stop.exe
5632	2026-06-26_cf44534fe363ca63136e916385af14f6_amadey_darkgate_elex_smoke-loader_stop.exe
5632	2026-06-26_cf44534fe363ca63136e916385af14f6_amadey_darkgate_elex_smoke-loader_stop.exe
5632	2026-06-26_cf44534fe363ca63136e916385af14f6_amadey_darkgate_elex_smoke-loader_stop.exe
5632	2026-06-26_cf44534fe363ca63136e916385af14f6_amadey_darkgate_elex_smoke-loader_stop.exe
5632	2026-06-26_cf44534fe363ca63136e916385af14f6_amadey_darkgate_elex_smoke-loader_stop.exe
5632	2026-06-26_cf44534fe363ca63136e916385af14f6_amadey_darkgate_elex_smoke-loader_stop.exe
5632	2026-06-26_cf44534fe363ca63136e916385af14f6_amadey_darkgate_elex_smoke-loader_stop.exe
5632	2026-06-26_cf44534fe363ca63136e916385af14f6_amadey_darkgate_elex_smoke-loader_stop.exe
5632	2026-06-26_cf44534fe363ca63136e916385af14f6_amadey_darkgate_elex_smoke-loader_stop.exe
5632	2026-06-26_cf44534fe363ca63136e916385af14f6_amadey_darkgate_elex_smoke-loader_stop.exe
5632	2026-06-26_cf44534fe363ca63136e916385af14f6_amadey_darkgate_elex_smoke-loader_stop.exe
5632	2026-06-26_cf44534fe363ca63136e916385af14f6_amadey_darkgate_elex_smoke-loader_stop.exe
5632	2026-06-26_cf44534fe363ca63136e916385af14f6_amadey_darkgate_elex_smoke-loader_stop.exe
5632	2026-06-26_cf44534fe363ca63136e916385af14f6_amadey_darkgate_elex_smoke-loader_stop.exe
5632	2026-06-26_cf44534fe363ca63136e916385af14f6_amadey_darkgate_elex_smoke-loader_stop.exe
5632	2026-06-26_cf44534fe363ca63136e916385af14f6_amadey_darkgate_elex_smoke-loader_stop.exe
5632	2026-06-26_cf44534fe363ca63136e916385af14f6_amadey_darkgate_elex_smoke-loader_stop.exe
5632	2026-06-26_cf44534fe363ca63136e916385af14f6_amadey_darkgate_elex_smoke-loader_stop.exe
5632	2026-06-26_cf44534fe363ca63136e916385af14f6_amadey_darkgate_elex_smoke-loader_stop.exe
5632	2026-06-26_cf44534fe363ca63136e916385af14f6_amadey_darkgate_elex_smoke-loader_stop.exe
5632	2026-06-26_cf44534fe363ca63136e916385af14f6_amadey_darkgate_elex_smoke-loader_stop.exe
5632	2026-06-26_cf44534fe363ca63136e916385af14f6_amadey_darkgate_elex_smoke-loader_stop.exe
5632	2026-06-26_cf44534fe363ca63136e916385af14f6_amadey_darkgate_elex_smoke-loader_stop.exe
4108	cxvpnhfcxusmkifd.exe
4108	cxvpnhfcxusmkifd.exe
4108	cxvpnhfcxusmkifd.exe
4108	cxvpnhfcxusmkifd.exe
4108	cxvpnhfcxusmkifd.exe
4108	cxvpnhfcxusmkifd.exe
4108	cxvpnhfcxusmkifd.exe
4108	cxvpnhfcxusmkifd.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	4684	i_fzxspkicav.exe
Token: SeDebugPrivilege	2692	i_pjhczxupmh.exe
Token: SeDebugPrivilege	2448	i_czurmbwuom.exe
Token: SeDebugPrivilege	5380	i_romgecwuom.exe
Token: SeDebugPrivilege	1224	i_jebvtomgey.exe
Token: SeDebugPrivilege	3384	i_wqolgdbytq.exe
Token: SeDebugPrivilege	2956	i_yvtnlyvqoi.exe
Token: SeDebugPrivilege	3916	i_nlfcayvpnl.exe
Token: SeDebugPrivilege	3656	i_axspnhfaxs.exe
Token: SeDebugPrivilege	4120	i_smkhfzxspj.exe
Token: SeDebugPrivilege	2116	i_czxrpmhfrp.exe
Token: SeDebugPrivilege	4684	i_wuomgezwro.exe
Token: SeDebugPrivilege	264	i_wrojgeywtr.exe
Token: SeDebugPrivilege	2328	i_lgdbvtolga.exe
Token: SeDebugPrivilege	2496	i_lfdaywqolj.exe
Token: SeDebugPrivilege	3156	i_igayvqoiga.exe
Token: SeDebugPrivilege	2832	i_fdxvpnifay.exe
Token: SeDebugPrivilege	1588	i_xuspnhfcxu.exe
Token: SeDebugPrivilege	5372	i_czusmkhcxu.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2004	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5632 wrote to memory of 4108	5632	2026-06-26_cf44534fe363ca63136e916385af14f6_amadey_darkgate_elex_smoke-loader_stop.exe	87
PID 5632 wrote to memory of 3228	5632	2026-06-26_cf44534fe363ca63136e916385af14f6_amadey_darkgate_elex_smoke-loader_stop.exe	88
PID 3228 wrote to memory of 2004	3228	iexplore.exe	89
PID 2004 wrote to memory of 3256	2004	msedge.exe	90
PID 2004 wrote to memory of 1036	2004	msedge.exe	92
PID 2004 wrote to memory of 4112	2004	msedge.exe	93
PID 2004 wrote to memory of 1036	2004	msedge.exe	92
PID 2004 wrote to memory of 1036	2004	msedge.exe	92
PID 2004 wrote to memory of 956	2004	msedge.exe	94
PID 2004 wrote to memory of 956	2004	msedge.exe	94
PID 2004 wrote to memory of 5856	2004	msedge.exe	95
PID 2004 wrote to memory of 3836	2004	msedge.exe	96
PID 2004 wrote to memory of 5856	2004	msedge.exe	95
PID 2004 wrote to memory of 5856	2004	msedge.exe	95
PID 2004 wrote to memory of 3836	2004	msedge.exe	96
PID 2004 wrote to memory of 3836	2004	msedge.exe	96
PID 2004 wrote to memory of 3012	2004	msedge.exe	98
PID 2004 wrote to memory of 1560	2004	msedge.exe	97
PID 2004 wrote to memory of 3012	2004	msedge.exe	98
PID 2004 wrote to memory of 3012	2004	msedge.exe	98
PID 2004 wrote to memory of 1560	2004	msedge.exe	97
PID 2004 wrote to memory of 1560	2004	msedge.exe	97
PID 2004 wrote to memory of 3832	2004	msedge.exe	99
PID 2004 wrote to memory of 3832	2004	msedge.exe	99
PID 2004 wrote to memory of 4260	2004	msedge.exe	103
PID 2004 wrote to memory of 4260	2004	msedge.exe	103
PID 2004 wrote to memory of 5996	2004	msedge.exe	104
PID 2004 wrote to memory of 5996	2004	msedge.exe	104
PID 4108 wrote to memory of 5900	4108	cxvpnhfcxusmkifd.exe	106
PID 2004 wrote to memory of 4384	2004	msedge.exe	107
PID 5028 wrote to memory of 6032	5028	fzxspkicav.exe	110
PID 2004 wrote to memory of 2632	2004	msedge.exe	113
PID 2004 wrote to memory of 2632	2004	msedge.exe	113
PID 2004 wrote to memory of 2328	2004	msedge.exe	114
PID 2004 wrote to memory of 2328	2004	msedge.exe	114
PID 4108 wrote to memory of 5300	4108	cxvpnhfcxusmkifd.exe	117
PID 4108 wrote to memory of 4564	4108	cxvpnhfcxusmkifd.exe	121
PID 4924 wrote to memory of 3408	4924	pjhczxupmh.exe	123
PID 4108 wrote to memory of 4476	4108	cxvpnhfcxusmkifd.exe	126
PID 4108 wrote to memory of 2512	4108	cxvpnhfcxusmkifd.exe	130
PID 936 wrote to memory of 3016	936	czurmbwuom.exe	132
PID 4108 wrote to memory of 3372	4108	cxvpnhfcxusmkifd.exe	135
PID 4108 wrote to memory of 1916	4108	cxvpnhfcxusmkifd.exe	139
PID 2472 wrote to memory of 5496	2472	romgecwuom.exe	141
PID 4108 wrote to memory of 4172	4108	cxvpnhfcxusmkifd.exe	144
PID 2004 wrote to memory of 3760	2004	msedge.exe	146
PID 2004 wrote to memory of 4852	2004	msedge.exe	147
PID 2004 wrote to memory of 3940	2004	msedge.exe	148
PID 4108 wrote to memory of 5948	4108	cxvpnhfcxusmkifd.exe	151
PID 1600 wrote to memory of 712	1600	jebvtomgey.exe	153
PID 4108 wrote to memory of 2204	4108	cxvpnhfcxusmkifd.exe	156
PID 4108 wrote to memory of 2692	4108	cxvpnhfcxusmkifd.exe	160
PID 3208 wrote to memory of 4440	3208	wqolgdbytq.exe	162
PID 4108 wrote to memory of 2984	4108	cxvpnhfcxusmkifd.exe	165
PID 4108 wrote to memory of 5992	4108	cxvpnhfcxusmkifd.exe	169
PID 996 wrote to memory of 2448	996	yvtnlyvqoi.exe	171
PID 4108 wrote to memory of 4540	4108	cxvpnhfcxusmkifd.exe	174
PID 4108 wrote to memory of 948	4108	cxvpnhfcxusmkifd.exe	178
PID 4708 wrote to memory of 6120	4708	nlfcayvpnl.exe	180
PID 4108 wrote to memory of 1156	4108	cxvpnhfcxusmkifd.exe	183
PID 2004 wrote to memory of 1896	2004	msedge.exe	185
PID 2004 wrote to memory of 1896	2004	msedge.exe	185
PID 4108 wrote to memory of 248	4108	cxvpnhfcxusmkifd.exe	191
PID 1068 wrote to memory of 3448	1068	axspnhfaxs.exe	193

C:\Users\Admin\AppData\Local\Temp\2026-06-26_cf44534fe363ca63136e916385af14f6_amadey_darkgate_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-26_cf44534fe363ca63136e916385af14f6_amadey_darkgate_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5632
- C:\Temp\cxvpnhfcxusmkifd.exe
  C:\Temp\cxvpnhfcxusmkifd.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4108
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fzxspkicav.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5900
  - - C:\Temp\fzxspkicav.exe
      C:\Temp\fzxspkicav.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5028
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6032
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:792
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fzxspkicav.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5300
  - - C:\Temp\i_fzxspkicav.exe
      C:\Temp\i_fzxspkicav.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4684
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pjhczxupmh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4564
  - - C:\Temp\pjhczxupmh.exe
      C:\Temp\pjhczxupmh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4924
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3408
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3380
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pjhczxupmh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4476
  - - C:\Temp\i_pjhczxupmh.exe
      C:\Temp\i_pjhczxupmh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2692
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\czurmbwuom.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2512
  - - C:\Temp\czurmbwuom.exe
      C:\Temp\czurmbwuom.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:936
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3016
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5232
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_czurmbwuom.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3372
  - - C:\Temp\i_czurmbwuom.exe
      C:\Temp\i_czurmbwuom.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2448
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\romgecwuom.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1916
  - - C:\Temp\romgecwuom.exe
      C:\Temp\romgecwuom.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2472
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5496
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5172
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_romgecwuom.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4172
  - - C:\Temp\i_romgecwuom.exe
      C:\Temp\i_romgecwuom.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5380
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jebvtomgey.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5948
  - - C:\Temp\jebvtomgey.exe
      C:\Temp\jebvtomgey.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1600
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:712
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2108
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jebvtomgey.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2204
  - - C:\Temp\i_jebvtomgey.exe
      C:\Temp\i_jebvtomgey.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1224
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wqolgdbytq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2692
  - - C:\Temp\wqolgdbytq.exe
      C:\Temp\wqolgdbytq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3208
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4440
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1088
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wqolgdbytq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2984
  - - C:\Temp\i_wqolgdbytq.exe
      C:\Temp\i_wqolgdbytq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3384
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\yvtnlyvqoi.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5992
  - - C:\Temp\yvtnlyvqoi.exe
      C:\Temp\yvtnlyvqoi.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:996
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2448
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1524
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_yvtnlyvqoi.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4540
  - - C:\Temp\i_yvtnlyvqoi.exe
      C:\Temp\i_yvtnlyvqoi.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2956
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nlfcayvpnl.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:948
  - - C:\Temp\nlfcayvpnl.exe
      C:\Temp\nlfcayvpnl.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4708
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6120
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1644
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nlfcayvpnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1156
  - - C:\Temp\i_nlfcayvpnl.exe
      C:\Temp\i_nlfcayvpnl.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3916
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\axspnhfaxs.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:248
  - - C:\Temp\axspnhfaxs.exe
      C:\Temp\axspnhfaxs.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1068
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3448
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5836
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_axspnhfaxs.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5124
  - - C:\Temp\i_axspnhfaxs.exe
      C:\Temp\i_axspnhfaxs.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3656
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\smkhfzxspj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3152
  - - C:\Temp\smkhfzxspj.exe
      C:\Temp\smkhfzxspj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2956
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5456
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4340
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_smkhfzxspj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:880
  - - C:\Temp\i_smkhfzxspj.exe
      C:\Temp\i_smkhfzxspj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4120
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\czxrpmhfrp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3840
  - - C:\Temp\czxrpmhfrp.exe
      C:\Temp\czxrpmhfrp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1772
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3380
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5716
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_czxrpmhfrp.exe ups_ins
    3⤵
    PID:1040
  - - C:\Temp\i_czxrpmhfrp.exe
      C:\Temp\i_czxrpmhfrp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2116
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wuomgezwro.exe ups_run
    3⤵
    PID:4472
  - - C:\Temp\wuomgezwro.exe
      C:\Temp\wuomgezwro.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1912
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3468
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2056
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wuomgezwro.exe ups_ins
    3⤵
    PID:2012
  - - C:\Temp\i_wuomgezwro.exe
      C:\Temp\i_wuomgezwro.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4684
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wrojgeywtr.exe ups_run
    3⤵
    PID:4412
  - - C:\Temp\wrojgeywtr.exe
      C:\Temp\wrojgeywtr.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:432
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2716
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4712
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wrojgeywtr.exe ups_ins
    3⤵
    PID:2424
  - - C:\Temp\i_wrojgeywtr.exe
      C:\Temp\i_wrojgeywtr.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:264
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lgdbvtolga.exe ups_run
    3⤵
    PID:2772
  - - C:\Temp\lgdbvtolga.exe
      C:\Temp\lgdbvtolga.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1696
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3032
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3156
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lgdbvtolga.exe ups_ins
    3⤵
    PID:1528
  - - C:\Temp\i_lgdbvtolga.exe
      C:\Temp\i_lgdbvtolga.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2328
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lfdaywqolj.exe ups_run
    3⤵
    PID:5536
  - - C:\Temp\lfdaywqolj.exe
      C:\Temp\lfdaywqolj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4304
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1752
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1416
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lfdaywqolj.exe ups_ins
    3⤵
    PID:1596
  - - C:\Temp\i_lfdaywqolj.exe
      C:\Temp\i_lfdaywqolj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2496
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\igayvqoiga.exe ups_run
    3⤵
    PID:3500
  - - C:\Temp\igayvqoiga.exe
      C:\Temp\igayvqoiga.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6036
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3104
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3384
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_igayvqoiga.exe ups_ins
    3⤵
    PID:4800
  - - C:\Temp\i_igayvqoiga.exe
      C:\Temp\i_igayvqoiga.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3156
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fdxvpnifay.exe ups_run
    3⤵
    PID:5748
  - - C:\Temp\fdxvpnifay.exe
      C:\Temp\fdxvpnifay.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:484
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5812
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5612
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fdxvpnifay.exe ups_ins
    3⤵
    PID:2764
  - - C:\Temp\i_fdxvpnifay.exe
      C:\Temp\i_fdxvpnifay.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2832
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xuspnhfcxu.exe ups_run
    3⤵
    PID:4856
  - - C:\Temp\xuspnhfcxu.exe
      C:\Temp\xuspnhfcxu.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:352
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:848
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1944
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xuspnhfcxu.exe ups_ins
    3⤵
    PID:5924
  - - C:\Temp\i_xuspnhfcxu.exe
      C:\Temp\i_xuspnhfcxu.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1588
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\czusmkhcxu.exe ups_run
    3⤵
    PID:1356
  - - C:\Temp\czusmkhcxu.exe
      C:\Temp\czusmkhcxu.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1532
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2172
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3900
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_czusmkhcxu.exe ups_ins
    3⤵
    PID:2584
  - - C:\Temp\i_czusmkhcxu.exe
      C:\Temp\i_czusmkhcxu.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5372
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\urpmheczxr.exe ups_run
    3⤵
    PID:616
  - - C:\Temp\urpmheczxr.exe
      C:\Temp\urpmheczxr.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3852
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4684
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4464
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x31c,0x7ffe311bc188,0x7ffe311bc194,0x7ffe311bc1a0
      4⤵
      PID:3256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1692,i,6177038754374278697,700143998474410795,262144 --field-trial-handle=2408,i,18171939155634458560,3990433756437534452,262144 --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:2
      4⤵
      PID:1036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1908,i,6068915349189418182,1148851779608719931,524288 --field-trial-handle=2408,i,18171939155634458560,3990433756437534452,262144 --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:11
      4⤵
      System Time Discovery
      PID:4112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2552,i,14035921534957608564,15112639780284627214,524288 --field-trial-handle=2408,i,18171939155634458560,3990433756437534452,262144 --variations-seed-version --mojo-platform-channel-handle=3180 /prefetch:13
      4⤵
      PID:956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3568,i,11620738732085854812,13515873954503420681,2097152 --field-trial-handle=2408,i,18171939155634458560,3990433756437534452,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
      4⤵
      PID:5856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3572,i,15007853168639829467,1947536028538299173,2097152 --field-trial-handle=2408,i,18171939155634458560,3990433756437534452,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
      4⤵
      PID:3836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,2427128633914695779,8450224037707104319,2097152 --field-trial-handle=2408,i,18171939155634458560,3990433756437534452,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:1
      4⤵
      PID:1560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4216,i,12866079501145162681,9662092474733439926,2097152 --field-trial-handle=2408,i,18171939155634458560,3990433756437534452,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:9
      4⤵
      PID:3012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,11369187660214819249,2551618144738828876,524288 --field-trial-handle=2408,i,18171939155634458560,3990433756437534452,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:14
      4⤵
      PID:3832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3724,i,2569680228214244066,11295679177132768408,524288 --field-trial-handle=2408,i,18171939155634458560,3990433756437534452,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:14
      4⤵
      PID:4260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3600,i,17678867084426046504,8980749980103580959,524288 --field-trial-handle=2408,i,18171939155634458560,3990433756437534452,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:14
      4⤵
      PID:5996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,16434649116019111682,1734699693725377578,524288 --field-trial-handle=2408,i,18171939155634458560,3990433756437534452,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
      4⤵
      PID:1932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,16434649116019111682,1734699693725377578,524288 --field-trial-handle=2408,i,18171939155634458560,3990433756437534452,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
      4⤵
      PID:4384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,6323328036591918369,10595789606132577313,524288 --field-trial-handle=2408,i,18171939155634458560,3990433756437534452,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:14
      4⤵
      PID:2632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6652,i,2180116663861448005,7497429779605452703,524288 --field-trial-handle=2408,i,18171939155634458560,3990433756437534452,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:14
      4⤵
      PID:2328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,10442299256092458342,10347971957117162722,524288 --field-trial-handle=2408,i,18171939155634458560,3990433756437534452,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:14
      4⤵
      PID:3760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,6492418681070303172,12345556240100893100,524288 --field-trial-handle=2408,i,18171939155634458560,3990433756437534452,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:14
      4⤵
      PID:4852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,11726972748920872572,9482964348207853424,524288 --field-trial-handle=2408,i,18171939155634458560,3990433756437534452,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:14
      4⤵
      PID:3940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,13296226961722341945,13316529148225608289,524288 --field-trial-handle=2408,i,18171939155634458560,3990433756437534452,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:14
      4⤵
      PID:1896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,6964430133822958361,5682523754117391685,524288 --field-trial-handle=2408,i,18171939155634458560,3990433756437534452,262144 --variations-seed-version --mojo-platform-channel-handle=2816 /prefetch:14
      4⤵
      PID:4620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,12649314030137795502,9327418175795038298,524288 --field-trial-handle=2408,i,18171939155634458560,3990433756437534452,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:14
      4⤵
      PID:3352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,3612319166548691466,6411007666014541664,524288 --field-trial-handle=2408,i,18171939155634458560,3990433756437534452,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:14
      4⤵
      PID:592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5860,i,10660316750254083585,17371388542787045216,262144 --field-trial-handle=2408,i,18171939155634458560,3990433756437534452,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:10
      4⤵
      PID:2116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6860,i,2522996980666665872,4540535938811119362,524288 --field-trial-handle=2408,i,18171939155634458560,3990433756437534452,262144 --variations-seed-version --mojo-platform-channel-handle=6884 /prefetch:14
      4⤵
      PID:4824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2976,i,6680000975692537705,6529771612684068776,524288 --field-trial-handle=2408,i,18171939155634458560,3990433756437534452,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:14
      4⤵
      PID:4228

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2816

C:\Temp\cxvpnhfcxusmkifd.sys
C:\Temp\cxvpnhfcxusmkifd.sys
1⤵
- Executes dropped EXE
PID:1156

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5812

C:\Temp\caupnkfcxm.sys
C:\Temp\caupnkfcxm.sys
1⤵
- Executes dropped EXE
PID:1996

C:\Temp\ecwrpmhfzx.sys
C:\Temp\ecwrpmhfzx.sys
1⤵
- Executes dropped EXE
PID:5836

C:\Temp\rljebzwuom.sys
C:\Temp\rljebzwuom.sys
1⤵
- Executes dropped EXE
PID:1096

C:\Temp\omgeywqojg.sys
C:\Temp\omgeywqojg.sys
1⤵
- Executes dropped EXE
PID:4608

C:\Temp\dbvtgdbytq.sys
C:\Temp\dbvtgdbytq.sys
1⤵
- Executes dropped EXE
PID:5368

C:\Temp\gaysqlidbv.sys
C:\Temp\gaysqlidbv.sys
1⤵
- Executes dropped EXE
PID:4456

C:\Temp\sqnigaysqn.sys
C:\Temp\sqnigaysqn.sys
1⤵
- Executes dropped EXE
PID:5204

C:\Temp\ifdxvsqnif.sys
C:\Temp\ifdxvsqnif.sys
1⤵
- Executes dropped EXE
PID:2016

C:\Temp\causmcxupn.sys
C:\Temp\causmcxupn.sys
1⤵
- Executes dropped EXE
PID:1096

C:\Temp\xusmkhezwu.sys
C:\Temp\xusmkhezwu.sys
1⤵
- Executes dropped EXE
PID:3584

C:\Temp\cwuomgezwr.sys
C:\Temp\cwuomgezwr.sys
1⤵
PID:4468

C:\Temp\rojhbzwqom.sys
C:\Temp\rojhbzwqom.sys
1⤵
PID:3940

C:\Temp\ztqojgbztr.sys
C:\Temp\ztqojgbztr.sys
1⤵
PID:5100

C:\Temp\nlgdbvtnlg.sys
C:\Temp\nlgdbvtnlg.sys
1⤵
PID:5020

C:\Temp\igayvqnlid.sys
C:\Temp\igayvqnlid.sys
1⤵
PID:5388

C:\Temp\fcavsqkica.sys
C:\Temp\fcavsqkica.sys
1⤵
PID:5888

C:\Temp\fcxvpnkifz.sys
C:\Temp\fcxvpnkifz.sys
1⤵
PID:5100

C:\Temp\fcxupmhfzx.sys
C:\Temp\fcxupmhfzx.sys
1⤵
PID:2224

C:\Temp\rpmheczurp.sys
C:\Temp\rpmheczurp.sys
1⤵
PID:6128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

caupnkfcxm.sys

Path C:\Temp\caupnkfcxm.sys
Size 293KB
SHA256 570f29de70da10f8df858babff7291ded7b0325077edfe927ffc3e1cf0fa5396
MD5 a3dde5fa336ab7bce4f69f9afedde368
SHA1 d1bf762dc816b9d647818e005b845111e2cda0c8
SHA512 16a98461beb6f1e03ebeae61f4464cdc93168be6abe56e592d1bfe05956a791dac8e9c81acc7b81487f33022337b656f02dfbd9ff6a9a4c411b29a70caaba0f7
SSDEEP 3072:qtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:qIJjiJcbI03GBc3ucY5DCSj
TLSH
T1D5545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cxvpnhfcxusmkifd.exe

Path C:\Temp\cxvpnhfcxusmkifd.exe
Size 384KB
SHA256 4cc3a067d6eaab8f85e3a770a665c94b964363393a233ae24cf1856302e51ddc
MD5 7d4c9463b1dca8a4c10f34160f6f8d01
SHA1 fc626b6255e3172605a39a3b63f69b0fcefc4812
SHA512 24d6d40e2b9bc00ad05349e8c48436d222f3a62f64c45600ce1335b5a0c61f00de11c3e180dedd2b9aa9f4d85489604846bbedde0aa812658504d135ba9339b9
SSDEEP 3072:yO6UF5toCvty8dsaMj4ygtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ug:L6QtpouIJjiJcbI03GBc3ucY5DCSjX
TLSH
T113847B00BAA4F0F6D995043800EFAF36A67E74281B26CBC3E754CE5D99513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cxvpnhfcxusmkifd.sys

Path C:\Temp\cxvpnhfcxusmkifd.sys
Size 293KB
SHA256 a2af857fb78b91630c78b5e50f03c940e1b5824d2d04ef239c3a02c56b2eae3b
MD5 1bd3b8a4ad65848d9a7b8e05518a456b
SHA1 bf24dc968c8ab24b8f877953d04c8618beb3baf4
SHA512 1b62ce326b3c33d7be7563b0e53ee954245f0cb1fbf0af60abe81ba884550579f574982c3a7bab96dcc9bd25c8694b50d3a3cdc3225cee340d7775f0961ba408
SSDEEP 3072:MtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:MIJjiJcbI03GBc3ucY5DCSj
TLSH
T13A545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

czurmbwuom.exe

Path C:\Temp\czurmbwuom.exe
Size 384KB
SHA256 86de9d79d8b478a311e5a86b5fe6990fdb05bafbf1a860455559e063d100e3df
MD5 0509048d240e8e5ff95c4edd1bb1c0ce
SHA1 7d771fcc594fd65952cccf8e4bdbc91efc5bfa9e
SHA512 b1b1a0bd4ce3b471f08c1b3ce97c65a87e549b6b2031df943348f91f39d8ebb58270ecbff4b54a552330649116033234607eeeaabeb0e291599b150d4cd241c4
SSDEEP 3072:sO6UF5toCvty8dsaMj4ygtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ug:96QtpouIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F7847B00BAA4F0F6D995043800EFAF36A67E74281B26CBC3E754CE5D99513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbvtgdbytq.sys

Path C:\Temp\dbvtgdbytq.sys
Size 293KB
SHA256 130982dccd5e7c693514ec3a7d73cd14b1b0588a09c5cd89e27e59d1dde0d205
MD5 72dd48715d1015304cb0eb53839f1ae3
SHA1 6edac52fd87c98ec307fb23019c06703ef28917d
SHA512 fcb5e60cb71715f855d21411590977be11a8709bc7464b18e7d4a6c85d6c672d6a20f3a8e074d92480ea7417764a2958e2a0504e84696004cc5e082b94908ad1
SSDEEP 3072:xtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:xIJjiJcbI03GBc3ucY5DCSj
TLSH
T1A1545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecwrpmhfzx.sys

Path C:\Temp\ecwrpmhfzx.sys
Size 293KB
SHA256 aa030d731468df6f673cd424c968560ed67ad39964f65e21e160d2aef05b7bf5
MD5 3824fa1488c6d794dd9fad86c1863a24
SHA1 2348254affdadc5c4f260b6cd91ca34acae3848d
SHA512 16be5b4fd83cb410c909948210b3e833a28f3e2ea8ba3fd173d7b9f3f1d4f5ac59aa20ed811fe285f077760dee75060d0fa8c94953dbe0dd22a05c2676d43a1c
SSDEEP 3072:TtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:TIJjiJcbI03GBc3ucY5DCSj
TLSH
T108545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fzxspkicav.exe

Path C:\Temp\fzxspkicav.exe
Size 384KB
SHA256 5903abfa4400d91e3a8dbccfdae275b3c8a5fd3bd94c49279f607181928c57a1
MD5 dfa20616847420492f4fe6ea0da33022
SHA1 cb8ffc2c1675308de4ccf9efb8a3db5f9538411d
SHA512 333ffef51459c3ef58c8fbae7f190754bb87899b46b018b1219c3d30625a8ad41e78ef3d3420e870f075e565fe8cc25864d27fbf84037106db49867f67d5f893
SSDEEP 3072:uO6UF5toCvty8dsaMj4ygtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ug:H6QtpouIJjiJcbI03GBc3ucY5DCSjX
TLSH
T134847B00BAA4F0F6D995043800EFAF36A67E74281B26CBC3E754CE5D99513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_czurmbwuom.exe

Path C:\Temp\i_czurmbwuom.exe
Size 384KB
SHA256 5df1dff28cfd741fde14062017d1ef0b687256ea65d471258307b13b049b11df
MD5 81448a14f8024b20d489f8598b3dd493
SHA1 eafa8d804def7e57bb960b41ab9c5c472911a733
SHA512 fb9b31cad7d092a4868e13c648f15267e4737d1e653d1268978fe9117709b34b8543d6b5f05181fea42161e01bf91d41aaf8c09c600e5495baf0c44614c8bd73
SSDEEP 3072:sO6UF5toCvty8dsaMj4ygtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ug:96QtpouIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C2847B00BAA4F0F6D995043800EFAF36A67E74281B26CBC3E754CE5D99513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fzxspkicav.exe

Path C:\Temp\i_fzxspkicav.exe
Size 384KB
SHA256 bf2d6c2fa3aef5cb82e79afb8c8a2e2847aad95c3060b10378e3429ef83284f1
MD5 454d5fc694d02799bd2ed7dbde617fa9
SHA1 235967d6c24b3aa9752fd38344fd745f5765d6c3
SHA512 8523d166686b8389cd7edbf400ac6f5904c61883c518f0d0b2b6c09b853e202862f3251697f9a760d289c8ff73662f9249d786df7119d5e0ae0400b70705884a
SSDEEP 3072:wO6UF5toCvty8dsaMj4ygtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ug:h6QtpouIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C2847B00BAA4F0F6D995043800EFAF36A67E74281B26CBC3E754CE5D99513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jebvtomgey.exe

Path C:\Temp\i_jebvtomgey.exe
Size 384KB
SHA256 36dad410627839a4acfd24ba5fdde679683e79f81ea53d7995c6bb7c18cab470
MD5 6929512461f8cf916e2306d0485510e5
SHA1 11347f50fa5c537ee613ccafa409eff874c648d5
SHA512 d1601da751d9e910b20c05ce8bda1383ac8f724db8b21b2793d55fd46520199479e382ffcf7d6129bb89d5b8c2dbab075ea54f4e62e260a40a60bcdb519b2aa1
SSDEEP 3072:5O6UF5toCvty8dsaMj4ygtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ug:g6QtpouIJjiJcbI03GBc3ucY5DCSjX
TLSH
T191847B00BAA4F0F6D995043800EFAF36A67E74281B26CBC3E754CE5D99513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pjhczxupmh.exe

Path C:\Temp\i_pjhczxupmh.exe
Size 384KB
SHA256 1d1099b7189c6b811cc9f7b77d5688826feccccc01899f5be41464ede63da2dd
MD5 6796e910c5e1ac1ecd8dfc033ad70296
SHA1 8498e01e0a197339aa19b704fcfcea31a4b9255c
SHA512 26bf6f70456984a6ab70a3a6fa6da5bdcb0d633f79aad5ce1e2e1f4e6e908e49e416db38e380049560e85592dc7e3602669d2885f0611c4c09eb75fc1b602acf
SSDEEP 3072:4O6UF5toCvty8dsaMj4ygtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ug:p6QtpouIJjiJcbI03GBc3ucY5DCSjX
TLSH
T12F847B00BAA4F0F6D995043800EFAF36A67E74281B26CBC3E754CE5D99513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_romgecwuom.exe

Path C:\Temp\i_romgecwuom.exe
Size 384KB
SHA256 30aeee7b75d3751520581024bcd7d89d0bcfd1a36cb106fa50aa4a18d7e35431
MD5 2c7903fd20e6125a7f255b4d560e78ff
SHA1 95c84f707540a29e402bcda2de5a07e65f8d5892
SHA512 00c7cde4036b8619f2e52386de30f92a69541f40d6f124687b4551410f80c8cbfb32b5b1f85f749c1931bdbc4cf41780c0f8ffff5c2ca285499e4ef4b97e61c1
SSDEEP 3072:7O6UF5toCvty8dsaMj4ygtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ug:i6QtpouIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A9847B00BAA4F0F6D995043800EFAF36A67E74281B26CBC3E754CE5D99513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jebvtomgey.exe

Path C:\Temp\jebvtomgey.exe
Size 384KB
SHA256 9d8585eb70b7c4521057955c3b314028c45b86bb2388e4a68285c7947a600683
MD5 eb3dee90f3fbd32eef384fa0125937ae
SHA1 1be952750aa0d8b31dc840e439f1d887aeabaa59
SHA512 8aeae085f16c024c63326efbc5fee1e62b7562d94816c3acda20aa3d99c2bd62be0213cf8f19e00274525480c881c715d98fda9be527e8bb594152fcca931cad
SSDEEP 3072:uO6UF5toCvty8dsaMj4ygtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ug:H6QtpouIJjiJcbI03GBc3ucY5DCSjX
TLSH
T15A847B00BAA4F0F6D995043800EFAF36A67E74281B26CBC3E754CE5D99513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omgeywqojg.sys

Path C:\Temp\omgeywqojg.sys
Size 293KB
SHA256 53a255388cf4a067bb78e3835cfcef50107a567665561456ed0da31eb43dfec1
MD5 7f172dae03f7ca4b466d317a1343d12c
SHA1 d399654483700eb51ea0b39506366f3590dcfc9c
SHA512 6d26b683c259190051a89ebcd7eeb28ddbdaff1688c7308fab4ba6c9038c3b89c0eec729f2fd4789a41d2fa51865695f35bc361d16b56caf03ee48edd27df9e2
SSDEEP 3072:TtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:TIJjiJcbI03GBc3ucY5DCSj
TLSH
T185545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pjhczxupmh.exe

Path C:\Temp\pjhczxupmh.exe
Size 384KB
SHA256 9db8e9b83b7ca351dc66b0633c23722be963738093155992bd632c8b4d211047
MD5 98b2dc7cfb85e9d2140466cbad5a4b1d
SHA1 6a4b53c82b4f778d0bd225fe4834738c6aca977e
SHA512 a45b59eda5515158673e334c2130958a6c3a300449dd9966093dfa66ff43ceea5afaab050fda07ffd1cb243fd3b97d7436f73cab5a775644b6fe0190703253f7
SSDEEP 3072:jO6UF5toCvty8dsaMj4ygtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ug:q6QtpouIJjiJcbI03GBc3ucY5DCSjX
TLSH
T13B847B00BAA4F0F6D995043800EFAF36A67E74281B26CBC3E754CE5D99513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rljebzwuom.sys

Path C:\Temp\rljebzwuom.sys
Size 293KB
SHA256 9a3ceb553810c89fdb619ae2b6004b7cee74e1374f5101dabf583baa46e5b595
MD5 7fc35a2007a8df899b6a3d07fff3f128
SHA1 877c2fa0bcb5e9ed18c8a4d9a29508b5b2baeda3
SHA512 5e54a5a1e424dd3c5b2b16cf8ba82d58d4a89b859e0d28f3dd2b87b202b98e4144a50231d46ffd1228a77af24c9f88f441cef21a4f7ad42a0df364bdc584c0a1
SSDEEP 3072:itKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:iIJjiJcbI03GBc3ucY5DCSj
TLSH
T1F7545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

romgecwuom.exe

Path C:\Temp\romgecwuom.exe
Size 384KB
SHA256 e46982aa2cca96439068f9001fe12b4517415180fbaeccaafea7a254f972d599
MD5 f5fb2d34fc374b0ebb7ff0e62b4676e8
SHA1 6746c179144d172d9fe917803216df0c24053a95
SHA512 0da29e35033f1ccaafe06de122e31e02bc59e8d0ca12721fde10a74e92c82e6a5b58c8670d22b95d5afaf1d4a6c667b67dcb4267e6cf631372654e7e46bc7599
SSDEEP 3072:hO6UF5toCvty8dsaMj4ygtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ug:o6QtpouIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A7847B00BAA4F0F6D995043800EFAF36A67E74281B26CBC3E754CE5D99513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wqolgdbytq.exe

Path C:\Temp\wqolgdbytq.exe
Size 384KB
SHA256 8db1663d70492cfde200fe89fb4918fcf98543f0113ee0d67bb932f0224f0fed
MD5 a2ec9331de09d1b7aee97717b4014a98
SHA1 3e381ef08493f3ec0175ec2de686804e22676f22
SHA512 63a642184ee68caee754f075f724453545945f1f827d2198f48f76b54212e9fc16a4a0865905bae2b60be7d0b12f30ef944278eeb1f3af04e2de40a512cf6d4e
SSDEEP 3072:vO6UF5toCvty8dsaMj4ygtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ug:26QtpouIJjiJcbI03GBc3ucY5DCSjX
TLSH
T117847B00BAA4F0F6D995043800EFAF36A67E74281B26CBC3E754CE5D99513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5ae221908285db4719a807e2425a6f6732ddc1c73479482370457ee753fc89c7
MD5 520c2031f5ecabbc157ceac9f596ecd8
SHA1 22edf0e64699c903241400bd6c846811295ca362
SHA512 08764eecf9136bd2ae304a8a479d84a9cdd4faad137bdd47172e9fb79dd70c63a1236c83111416df8577d12f9b471fa3323939c8e383beb748ee03fedb348751
TLSH
T119D080747F04A405C1911531BCD55751B51544711D7B874CD150E01DCC15185376F1E7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d4768ca53680cbe73471e7e7e20fcecca5f677c329e6dde10a9a5cd8c5d9aeea
MD5 350e276b7ad7e2ecef8bb501be41cc47
SHA1 23becb63d8e483408e7d4fddb258a53badd7ad36
SHA512 2bc8ca9b12d87d3ac8610b154b232960a01fc38689558de33b6a2c6e51358e0224147bc1a9fd6494fab448e063321ef4125089d341cdfd4762066fcffbf5dcae
TLSH
T1ECD080747F04A505C1911531BCD55751B52544716D7B874CD050E01DCC15185376F1FB
MD5 SHA1 SHA512 TLSH

Submit Download

1bb4737a-c298-4aad-82ad-9d09c6ae3f37.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1bb4737a-c298-4aad-82ad-9d09c6ae3f37.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f19f90cc0114c4c3a52abc81e1a0bc3438d62b1e5ab43651324d38fcc08fa97a
MD5 e2a55eb8c688801017e1010176f1191d
SHA1 a0f7929721774ce6ecaa30dbe6f67f3bd898af4e
SHA512 38cf346758c3b06ed9124b6cb4547e2f9fb720714600edf9f5ea501d2c6a12f7a22818767f83db9559512d79343dd86e2deb2e7705ba0bd60ab490dc6c1a4a55
TLSH
T1086130A909B54A35EB2AE1B101D1917473708F823D3BDE196C63BCF8CF1A708D092C30
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe593abd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe593abd.TMP
Size 3KB
SHA256 351f7c40aee5a4f5c3f353c5dad9309e37f7bf406807fdee4be857249e6b3021
MD5 72698f65f018afbafaf5e57a6518bf73
SHA1 5c08711d4fee344accc688c66ac945b7b85dd279
SHA512 23bfe6c6ca32fe70243461ed3e16561e657e453457096d9bb39ebbcc5b6ba7decc9030eae73f3cbfc1b34edb1fe9d56ced947e5060fe701e7fa6130252f4d449
TLSH
T11C6130A919B54A35EB2AE1B101D1917473708F923C3BDE196C67BCF8CF1A708D492C30
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

5fd1e04d-ba56-4cf4-8f6f-b17d45f4bcfa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\5fd1e04d-ba56-4cf4-8f6f-b17d45f4bcfa.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 d6a90180eff50476c21a6865383874b0ffd6f3bb24152eb17f0e29266e663bb6
MD5 d3729dc62bb0591c1551715939934e27
SHA1 f731847402b1f59fb987464bdeb35c077e3e8906
SHA512 438f475bf5bec7fd527208270520e98b47e0a70be94585fe2431f0ea76a70db8cc896dc2b02d95f61eca167fe460647116fef12bf453fcc0a98b264840b8c9ff
TLSH
T13651CEF3C7E8866ED90156F0BA187E2BCE1D0954832C3D5AC9E4AF1B93E2471D141A5E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 92866aaab21a2a9535c8f354a3f9f321bd80005bee2bbd7feceb366d431847da
MD5 5cd2d869767f3e470d2696c1d0ed2b31
SHA1 d939b668c8b2e7d52a01ed2128de91728a167e09
SHA512 4e568cfa64f187d0c8c499d831e30e5616209b93486fd021a38266dcec58048e155e845676f9d3f7ff1aa113024b0179259ac92305827fad5f3fd4ee755cf713
SSDEEP 192:sxR5RWyM/jK1Ml8wcM/fWHsXq4sZSnIzoA8p93/g6+WNCES/YGZBGZIgtJ:sxR5sCM/fWHs64SSRl/5g/y3
TLSH
T1D762D806AA34597B8CDBD209FA557F53D6F81573A2901E54AAFCDA0C01E7ADC221383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 228a43e5ce6e62941697a612bd56c0b5429f0ed29063789a64baf128a5751cf1
MD5 2b22424940ce4361f9d8c5d296c5de4c
SHA1 ce01076844d5f294014d7c5c2c00760586ac6f1f
SHA512 a414e8d314c5aa168d826b8fcf249dded45d22aeea2a767f001bf760aaf74cc37e23cb425c5bb042b5c785914748af6a782057a62e5bb0f2c6f9b0a4b3486643
SSDEEP 192:sxRKRWyM/jK1Ml8wcM/fWHsHq4sZSnIzoA8p93/g6+WNCES/YGZBGZIgDlJ:sxRKsCM/fWHsK4SSRl/5g/yT
TLSH
T1D062D806AA34597B8CDBD209FA557F53D6F81573A2901E54AAFCDA0C01E76DC221383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 b9a26c807e18412ea0ed8dddfd8493c9afa27e5491cdf4095c6ac3d7b5c0b303
MD5 201416a753f75b6cb3c98fa58a2b6a25
SHA1 06e6686d26bd67d091a1333c711787a73d708c3f
SHA512 4b876032a4997af6d7129a832ba4b34fc221a1964082f11b542d7cde37c552e123c4d1792d741dc897c3e9132a6c16c80aab58622fa978861946799e36d66471
SSDEEP 192:sxRKRWyM/jK1Ml8UQLcM/fWHsHq4sZSnIzoA8pr3/g6+WNCES/YGhBGZIgDlJ:sxRKsqQM/fWHsK4SSRb/5g/2T
TLSH
T10062D806AA34597B8CDBD209FA457F63D6F81573A2901E54AAFCDA0C01E76DC221383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 182e18a907710d81d6f7571618841017db1a5191ed3a558822d84906d318d53e
MD5 e060b079f04d6db8cfca6ff310da7656
SHA1 0600148e5f4e316089cee9fec51fa0bb47bcfe9c
SHA512 1c6c0b16e8d9949faed888b14b2598a5a7abc9837881eb0436c11f3dd84300c7c1e44bc688f544d76f593c122ef3e2080f74806277b3a4ffa545a052a604974b
SSDEEP 768:VJWhvm7pLuL7vWWgmcf458F1+UoAYDCx9Tuqh0VfUC9xbog/OVgzWiYCHroSn:VJWhvGE7vWWgmcf45u1jaPzWpCUSn
TLSH
T1AFE2ED3B680CCB7E4F804ADCEC29BD9AADA801CF56D8CD5447FA840C03C66EB55165EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3046198d-b452-4cc6-94c8-9fdafc52602d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\3046198d-b452-4cc6-94c8-9fdafc52602d.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 eec24fe255232aaf403989f8933d6a5f5f993bdbcffe1415600b37d1f9671b76
MD5 ab2d3a342c59e3fcab6369d296d0c249
SHA1 2a0e6461359c7c2a3e28ec58e5e456036245932e
SHA512 8cb3e94d953bcb145198faee2000224bc5faece72c8815e0aba4ea9ab1dfa036549628d624ac129563cee6abe1e1fba0498dfd750fb52ea4f9d86f156249a7b2
SSDEEP 768:bj+9e3VeOheVJ+vnxVE8cPE8Ye3W6s70H9oRzn12bfJy:O9e3H80VjctY+V9QByJy
TLSH
T1A9F2AE7498598CA34CEA86CAB7077752AEF0167385C41E54C8DCAE0E0697BDD271BC32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 6f419d24b2aa071bcbfdd7568b50c82bf871e9756252d1bd446f283b40296dff
MD5 0e6a59d3f6d1ef0d47d7276156c90c6e
SHA1 eb5a9e6f8ec730d49af28ada85685b6a022af47d
SHA512 d8789ffaad01c1f4b9c5afbaf2aefa639cc97f59e03595e9ba7e58f5c885629a7423fde4b7860890922f504359b78187a0a2f1eaf144a795bb9ae49543fc455d
SSDEEP 768:IF1j+9e3V8wggOhfanvnx6E8cPE8Ye3W6s70H9oRzn12bfJy:l9e3YA6jctY+V9QByJy
TLSH
T1531328F588D78976D8AE4787A33D7E429EBCC16375881984BBC85D4DCD862BFC306821
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 4be64e135876e7581e8a1b712864cb3581fea31ead579a4fc2da41b8a5b6e2cb
MD5 e303922093589d330b0c2cde11ac763a
SHA1 e6cd47ca1b43a576697184630a715c845af6f3fa
SHA512 d32d3398706aef83023eb14af589e3d4374f0f9e647ef0ffb914242ffdcf09a6e7e558545297552161cb5ad0aa8da97f45a9d2a9615056c4af2a6b768a265bdc
SSDEEP 768:5rv+4UNbdq3qzJ+vngE8cPE8Ye3W6s70H9Ic+8rWqW:5bsbo3KHjctY+V99DrWF
TLSH
T1AD03AE75985C89738DBA8A85B60B76137FF056634AC50B94C8CC3E0E069BADD631BC73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

d5457fb6-5d98-4cd0-b2af-e7312d279adc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d5457fb6-5d98-4cd0-b2af-e7312d279adc.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2004_159438975\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 63e67a98daa4d824b8760f464bfdc3398016f144b50ff9fd120044b52f6c1138
MD5 46954b3b23aa0c1278d819e107bc6ee9
SHA1 7f7bd1b35a1085edc4fc0a3e4a917522da6de18d
SHA512 b7d3a475d8aa0a40b6fc34d265a4188e1dfab8c3587f0cef6add131ba7911743f173d2e718170ba9d5496c246d94cda996cab476381d1f698df1892e4b8acb20
TLSH
T18F71008356A9C9B3C19A5BF002835244F5BB223C0B3370604B515586AA30A3A94B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1096-348-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1096-270-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1156-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1996-195-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2016-340-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2224-507-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3584-401-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3940-413-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4456-321-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4468-399-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4608-282-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5020-436-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5100-425-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5100-478-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5100-509-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5204-325-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5368-296-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5388-456-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5836-242-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5888-474-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5888-479-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6128-512-0x0000000000010000-0x00000000000AB000-memory.dmp

Download