systex | 3f0a301653626629cec88cd10d3cf70cfd583efa577a06b0a81cd7d1c9cfbde9

Analysis

max time kernel
149s
max time network
138s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 15:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-01_758bd8f2e5ab8ee4eec1dbd632fe09d9_amadey_darkgate_elex_smoke-loader_stop.exe
Size 384KB
Sample260701-snagbaay4v
SHA256 3f0a301653626629cec88cd10d3cf70cfd583efa577a06b0a81cd7d1c9cfbde9
MD5 758bd8f2e5ab8ee4eec1dbd632fe09d9
SHA1 1632b0926b066cbf3bf7196742b29952ae3167f1
SHA512 bf82ac4f4052dad24d7d7cc7f3196ba7e305a54b0fa1c918969b217ee5c7ea6444176b8fd39310867d5bce0276eb4895a1441013e22fd5e997a49af676e5d412
SSDEEP 3072:Q9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:ictFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1CC847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
4496	urmjecwurmjhbzwr.exe
824	urmjecwurmjhbzwr.sys
3204	CreateProcess.exe
5388	ztrojhbzur.exe
3392	CreateProcess.exe
5904	CreateProcess.exe
4964	i_ztrojhbzur.exe
3968	jebwuolgdb.sys
5036	CreateProcess.exe
720	dbytrljgbz.exe
2000	CreateProcess.exe
1084	CreateProcess.exe
2976	i_dbytrljgbz.exe
3916	jgbytqojgb.sys
1512	CreateProcess.exe
5136	ytqoigdyvt.exe
2740	CreateProcess.exe
1264	CreateProcess.exe
1108	i_ytqoigdyvt.exe
1760	vqoifdyvqo.sys
6072	CreateProcess.exe
1060	yvqnlgaysq.exe
1668	CreateProcess.exe
5192	CreateProcess.exe
5736	i_yvqnlgaysq.exe
1960	nlfdavtqlf.sys
5592	CreateProcess.exe
4692	dxvpnifdxv.exe
3304	CreateProcess.exe
5960	CreateProcess.exe
3732	i_dxvpnifdxv.exe
260	nkicauspnh.sys
3736	CreateProcess.exe
1076	qkicauspki.exe
1224	CreateProcess.exe
5996	CreateProcess.exe
5608	i_qkicauspki.exe
1040	fzxspkhcau.sys
1320	CreateProcess.exe
3488	spkhczusmk.exe
1500	CreateProcess.exe
200	CreateProcess.exe
4228	i_spkhczusmk.exe
2892	cwurpjhfca.sys
5444	CreateProcess.exe
3596	xrpmkecaur.exe
1508	CreateProcess.exe
2176	CreateProcess.exe
4168	i_xrpmkecaur.exe
3636	zwuomhezwr.sys
2960	CreateProcess.exe
6084	rmjhbwuomh.exe
1128	CreateProcess.exe
1688	CreateProcess.exe
2128	i_rmjhbwuomh.exe
6020	ojgbzwromg.sys
5608	CreateProcess.exe
3416	jebztromjd.exe
1040	CreateProcess.exe
2920	CreateProcess.exe
5732	i_jebztromjd.exe
3804	trojgdbztr.sys
1564	CreateProcess.exe
5284	oljdbvtrlj.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4648_138500836\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4648_957775088\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4648_957775088\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spkhczusmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpmkecaur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oljdbvtrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvpnifaxsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xsmkicxupn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ytqoigdyvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkicauspki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jebztromjd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdyvqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xsmkicxupn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fcxuspkhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbolgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ytqoigdyvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpmkecaur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmjhbwuomh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvpnifaxsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebwuoljebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spkhczusmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jebztromjd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oljdbvtrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcxuspkhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kecwupmhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kecwupmhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebwuoljebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bytolgebwq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvqnlgaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdyvqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvqnlfdays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztrojhbzur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbytrljgbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxvpnifdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmjhbwuomh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbolgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-01_758bd8f2e5ab8ee4eec1dbd632fe09d9_amadey_darkgate_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urmjecwurmjhbzwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztrojhbzur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbytrljgbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkicauspki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvqnlfdays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvqnlgaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dxvpnifdxv.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3584	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3288	ipconfig.exe
5848	ipconfig.exe
4692	ipconfig.exe
4700	ipconfig.exe
1124	ipconfig.exe
2456	ipconfig.exe
5104	ipconfig.exe
1616	ipconfig.exe
2116	ipconfig.exe
4512	ipconfig.exe
3232	ipconfig.exe
2752	ipconfig.exe
1396	ipconfig.exe
5436	ipconfig.exe
5052	ipconfig.exe
5712	ipconfig.exe
2564	ipconfig.exe
3464	ipconfig.exe
6112	ipconfig.exe
3364	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134273925580484930"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1086369643-1618123105-2567081378-1000\{6462821D-0727-42C1-B7CA-C422E70B3D3B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5272	2026-07-01_758bd8f2e5ab8ee4eec1dbd632fe09d9_amadey_darkgate_elex_smoke-loader_stop.exe
5272	2026-07-01_758bd8f2e5ab8ee4eec1dbd632fe09d9_amadey_darkgate_elex_smoke-loader_stop.exe
5272	2026-07-01_758bd8f2e5ab8ee4eec1dbd632fe09d9_amadey_darkgate_elex_smoke-loader_stop.exe
5272	2026-07-01_758bd8f2e5ab8ee4eec1dbd632fe09d9_amadey_darkgate_elex_smoke-loader_stop.exe
5272	2026-07-01_758bd8f2e5ab8ee4eec1dbd632fe09d9_amadey_darkgate_elex_smoke-loader_stop.exe
5272	2026-07-01_758bd8f2e5ab8ee4eec1dbd632fe09d9_amadey_darkgate_elex_smoke-loader_stop.exe
5272	2026-07-01_758bd8f2e5ab8ee4eec1dbd632fe09d9_amadey_darkgate_elex_smoke-loader_stop.exe
5272	2026-07-01_758bd8f2e5ab8ee4eec1dbd632fe09d9_amadey_darkgate_elex_smoke-loader_stop.exe
5272	2026-07-01_758bd8f2e5ab8ee4eec1dbd632fe09d9_amadey_darkgate_elex_smoke-loader_stop.exe
5272	2026-07-01_758bd8f2e5ab8ee4eec1dbd632fe09d9_amadey_darkgate_elex_smoke-loader_stop.exe
5272	2026-07-01_758bd8f2e5ab8ee4eec1dbd632fe09d9_amadey_darkgate_elex_smoke-loader_stop.exe
5272	2026-07-01_758bd8f2e5ab8ee4eec1dbd632fe09d9_amadey_darkgate_elex_smoke-loader_stop.exe
5272	2026-07-01_758bd8f2e5ab8ee4eec1dbd632fe09d9_amadey_darkgate_elex_smoke-loader_stop.exe
5272	2026-07-01_758bd8f2e5ab8ee4eec1dbd632fe09d9_amadey_darkgate_elex_smoke-loader_stop.exe
5272	2026-07-01_758bd8f2e5ab8ee4eec1dbd632fe09d9_amadey_darkgate_elex_smoke-loader_stop.exe
5272	2026-07-01_758bd8f2e5ab8ee4eec1dbd632fe09d9_amadey_darkgate_elex_smoke-loader_stop.exe
5272	2026-07-01_758bd8f2e5ab8ee4eec1dbd632fe09d9_amadey_darkgate_elex_smoke-loader_stop.exe
5272	2026-07-01_758bd8f2e5ab8ee4eec1dbd632fe09d9_amadey_darkgate_elex_smoke-loader_stop.exe
5272	2026-07-01_758bd8f2e5ab8ee4eec1dbd632fe09d9_amadey_darkgate_elex_smoke-loader_stop.exe
5272	2026-07-01_758bd8f2e5ab8ee4eec1dbd632fe09d9_amadey_darkgate_elex_smoke-loader_stop.exe
5272	2026-07-01_758bd8f2e5ab8ee4eec1dbd632fe09d9_amadey_darkgate_elex_smoke-loader_stop.exe
5272	2026-07-01_758bd8f2e5ab8ee4eec1dbd632fe09d9_amadey_darkgate_elex_smoke-loader_stop.exe
5272	2026-07-01_758bd8f2e5ab8ee4eec1dbd632fe09d9_amadey_darkgate_elex_smoke-loader_stop.exe
5272	2026-07-01_758bd8f2e5ab8ee4eec1dbd632fe09d9_amadey_darkgate_elex_smoke-loader_stop.exe
5272	2026-07-01_758bd8f2e5ab8ee4eec1dbd632fe09d9_amadey_darkgate_elex_smoke-loader_stop.exe
5272	2026-07-01_758bd8f2e5ab8ee4eec1dbd632fe09d9_amadey_darkgate_elex_smoke-loader_stop.exe
5272	2026-07-01_758bd8f2e5ab8ee4eec1dbd632fe09d9_amadey_darkgate_elex_smoke-loader_stop.exe
5272	2026-07-01_758bd8f2e5ab8ee4eec1dbd632fe09d9_amadey_darkgate_elex_smoke-loader_stop.exe
5272	2026-07-01_758bd8f2e5ab8ee4eec1dbd632fe09d9_amadey_darkgate_elex_smoke-loader_stop.exe
5272	2026-07-01_758bd8f2e5ab8ee4eec1dbd632fe09d9_amadey_darkgate_elex_smoke-loader_stop.exe
5272	2026-07-01_758bd8f2e5ab8ee4eec1dbd632fe09d9_amadey_darkgate_elex_smoke-loader_stop.exe
5272	2026-07-01_758bd8f2e5ab8ee4eec1dbd632fe09d9_amadey_darkgate_elex_smoke-loader_stop.exe
5272	2026-07-01_758bd8f2e5ab8ee4eec1dbd632fe09d9_amadey_darkgate_elex_smoke-loader_stop.exe
5272	2026-07-01_758bd8f2e5ab8ee4eec1dbd632fe09d9_amadey_darkgate_elex_smoke-loader_stop.exe
5272	2026-07-01_758bd8f2e5ab8ee4eec1dbd632fe09d9_amadey_darkgate_elex_smoke-loader_stop.exe
5272	2026-07-01_758bd8f2e5ab8ee4eec1dbd632fe09d9_amadey_darkgate_elex_smoke-loader_stop.exe
5272	2026-07-01_758bd8f2e5ab8ee4eec1dbd632fe09d9_amadey_darkgate_elex_smoke-loader_stop.exe
5272	2026-07-01_758bd8f2e5ab8ee4eec1dbd632fe09d9_amadey_darkgate_elex_smoke-loader_stop.exe
5272	2026-07-01_758bd8f2e5ab8ee4eec1dbd632fe09d9_amadey_darkgate_elex_smoke-loader_stop.exe
5272	2026-07-01_758bd8f2e5ab8ee4eec1dbd632fe09d9_amadey_darkgate_elex_smoke-loader_stop.exe
5272	2026-07-01_758bd8f2e5ab8ee4eec1dbd632fe09d9_amadey_darkgate_elex_smoke-loader_stop.exe
5272	2026-07-01_758bd8f2e5ab8ee4eec1dbd632fe09d9_amadey_darkgate_elex_smoke-loader_stop.exe
5272	2026-07-01_758bd8f2e5ab8ee4eec1dbd632fe09d9_amadey_darkgate_elex_smoke-loader_stop.exe
5272	2026-07-01_758bd8f2e5ab8ee4eec1dbd632fe09d9_amadey_darkgate_elex_smoke-loader_stop.exe
5272	2026-07-01_758bd8f2e5ab8ee4eec1dbd632fe09d9_amadey_darkgate_elex_smoke-loader_stop.exe
5272	2026-07-01_758bd8f2e5ab8ee4eec1dbd632fe09d9_amadey_darkgate_elex_smoke-loader_stop.exe
5272	2026-07-01_758bd8f2e5ab8ee4eec1dbd632fe09d9_amadey_darkgate_elex_smoke-loader_stop.exe
5272	2026-07-01_758bd8f2e5ab8ee4eec1dbd632fe09d9_amadey_darkgate_elex_smoke-loader_stop.exe
5272	2026-07-01_758bd8f2e5ab8ee4eec1dbd632fe09d9_amadey_darkgate_elex_smoke-loader_stop.exe
5272	2026-07-01_758bd8f2e5ab8ee4eec1dbd632fe09d9_amadey_darkgate_elex_smoke-loader_stop.exe
5272	2026-07-01_758bd8f2e5ab8ee4eec1dbd632fe09d9_amadey_darkgate_elex_smoke-loader_stop.exe
5272	2026-07-01_758bd8f2e5ab8ee4eec1dbd632fe09d9_amadey_darkgate_elex_smoke-loader_stop.exe
5272	2026-07-01_758bd8f2e5ab8ee4eec1dbd632fe09d9_amadey_darkgate_elex_smoke-loader_stop.exe
5272	2026-07-01_758bd8f2e5ab8ee4eec1dbd632fe09d9_amadey_darkgate_elex_smoke-loader_stop.exe
5272	2026-07-01_758bd8f2e5ab8ee4eec1dbd632fe09d9_amadey_darkgate_elex_smoke-loader_stop.exe
5272	2026-07-01_758bd8f2e5ab8ee4eec1dbd632fe09d9_amadey_darkgate_elex_smoke-loader_stop.exe
4496	urmjecwurmjhbzwr.exe
4496	urmjecwurmjhbzwr.exe
4496	urmjecwurmjhbzwr.exe
4496	urmjecwurmjhbzwr.exe
4496	urmjecwurmjhbzwr.exe
4496	urmjecwurmjhbzwr.exe
4496	urmjecwurmjhbzwr.exe
4496	urmjecwurmjhbzwr.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	4964	i_ztrojhbzur.exe
Token: SeDebugPrivilege	2976	i_dbytrljgbz.exe
Token: SeDebugPrivilege	1108	i_ytqoigdyvt.exe
Token: SeDebugPrivilege	5736	i_yvqnlgaysq.exe
Token: SeDebugPrivilege	3732	i_dxvpnifdxv.exe
Token: SeDebugPrivilege	5608	i_qkicauspki.exe
Token: SeDebugPrivilege	4228	i_spkhczusmk.exe
Token: SeDebugPrivilege	4168	i_xrpmkecaur.exe
Token: SeDebugPrivilege	2128	i_rmjhbwuomh.exe
Token: SeDebugPrivilege	5732	i_jebztromjd.exe
Token: SeDebugPrivilege	3788	i_oljdbvtrlj.exe
Token: SeDebugPrivilege	3428	i_gdyvqoigay.exe
Token: SeDebugPrivilege	5980	i_yvqnlfdays.exe
Token: SeDebugPrivilege	4656	i_yvpnifaxsq.exe
Token: SeDebugPrivilege	796	i_xsmkicxupn.exe
Token: SeDebugPrivilege	2716	i_fcxuspkhfz.exe
Token: SeDebugPrivilege	4820	i_kecwupmhfz.exe
Token: SeDebugPrivilege	4824	i_ebwuoljebw.exe
Token: SeDebugPrivilege	1848	i_ljdbolgeyw.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4648	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5272 wrote to memory of 4496	5272	2026-07-01_758bd8f2e5ab8ee4eec1dbd632fe09d9_amadey_darkgate_elex_smoke-loader_stop.exe	88
PID 5272 wrote to memory of 5216	5272	2026-07-01_758bd8f2e5ab8ee4eec1dbd632fe09d9_amadey_darkgate_elex_smoke-loader_stop.exe	89
PID 5216 wrote to memory of 4648	5216	iexplore.exe	90
PID 4648 wrote to memory of 1804	4648	msedge.exe	91
PID 4648 wrote to memory of 568	4648	msedge.exe	92
PID 4648 wrote to memory of 3584	4648	msedge.exe	94
PID 4648 wrote to memory of 568	4648	msedge.exe	92
PID 4648 wrote to memory of 568	4648	msedge.exe	92
PID 4648 wrote to memory of 5972	4648	msedge.exe	95
PID 4648 wrote to memory of 5972	4648	msedge.exe	95
PID 4648 wrote to memory of 2284	4648	msedge.exe	97
PID 4648 wrote to memory of 2116	4648	msedge.exe	96
PID 4648 wrote to memory of 2284	4648	msedge.exe	97
PID 4648 wrote to memory of 2284	4648	msedge.exe	97
PID 4648 wrote to memory of 2116	4648	msedge.exe	96
PID 4648 wrote to memory of 2116	4648	msedge.exe	96
PID 4648 wrote to memory of 6016	4648	msedge.exe	98
PID 4648 wrote to memory of 6016	4648	msedge.exe	98
PID 4648 wrote to memory of 6016	4648	msedge.exe	98
PID 4648 wrote to memory of 2588	4648	msedge.exe	99
PID 4648 wrote to memory of 2588	4648	msedge.exe	99
PID 4648 wrote to memory of 2588	4648	msedge.exe	99
PID 4648 wrote to memory of 5036	4648	msedge.exe	100
PID 4648 wrote to memory of 5036	4648	msedge.exe	100
PID 4648 wrote to memory of 1516	4648	msedge.exe	104
PID 4648 wrote to memory of 1516	4648	msedge.exe	104
PID 4648 wrote to memory of 3428	4648	msedge.exe	105
PID 4648 wrote to memory of 3428	4648	msedge.exe	105
PID 4648 wrote to memory of 4640	4648	msedge.exe	107
PID 4496 wrote to memory of 3204	4496	urmjecwurmjhbzwr.exe	108
PID 5388 wrote to memory of 3392	5388	ztrojhbzur.exe	113
PID 4648 wrote to memory of 4900	4648	msedge.exe	116
PID 4648 wrote to memory of 4900	4648	msedge.exe	116
PID 4648 wrote to memory of 5736	4648	msedge.exe	117
PID 4648 wrote to memory of 5736	4648	msedge.exe	117
PID 4496 wrote to memory of 5904	4496	urmjecwurmjhbzwr.exe	118
PID 4496 wrote to memory of 5036	4496	urmjecwurmjhbzwr.exe	122
PID 720 wrote to memory of 2000	720	dbytrljgbz.exe	124
PID 4496 wrote to memory of 1084	4496	urmjecwurmjhbzwr.exe	127
PID 4496 wrote to memory of 1512	4496	urmjecwurmjhbzwr.exe	131
PID 5136 wrote to memory of 2740	5136	ytqoigdyvt.exe	133
PID 4496 wrote to memory of 1264	4496	urmjecwurmjhbzwr.exe	136
PID 4496 wrote to memory of 6072	4496	urmjecwurmjhbzwr.exe	141
PID 1060 wrote to memory of 1668	1060	yvqnlgaysq.exe	143
PID 4496 wrote to memory of 5192	4496	urmjecwurmjhbzwr.exe	146
PID 4648 wrote to memory of 4176	4648	msedge.exe	148
PID 4648 wrote to memory of 1376	4648	msedge.exe	149
PID 4648 wrote to memory of 4644	4648	msedge.exe	150
PID 4496 wrote to memory of 5592	4496	urmjecwurmjhbzwr.exe	153
PID 4692 wrote to memory of 3304	4692	dxvpnifdxv.exe	155
PID 4496 wrote to memory of 5960	4496	urmjecwurmjhbzwr.exe	158
PID 4496 wrote to memory of 3736	4496	urmjecwurmjhbzwr.exe	162
PID 1076 wrote to memory of 1224	1076	qkicauspki.exe	164
PID 4496 wrote to memory of 5996	4496	urmjecwurmjhbzwr.exe	167
PID 4496 wrote to memory of 1320	4496	urmjecwurmjhbzwr.exe	171
PID 3488 wrote to memory of 1500	3488	spkhczusmk.exe	173
PID 4496 wrote to memory of 200	4496	urmjecwurmjhbzwr.exe	176
PID 4496 wrote to memory of 5444	4496	urmjecwurmjhbzwr.exe	180
PID 3596 wrote to memory of 1508	3596	xrpmkecaur.exe	182
PID 4496 wrote to memory of 2176	4496	urmjecwurmjhbzwr.exe	185
PID 4648 wrote to memory of 5264	4648	msedge.exe	187
PID 4648 wrote to memory of 5264	4648	msedge.exe	187
PID 4496 wrote to memory of 2960	4496	urmjecwurmjhbzwr.exe	193
PID 6084 wrote to memory of 1128	6084	rmjhbwuomh.exe	195

C:\Users\Admin\AppData\Local\Temp\2026-07-01_758bd8f2e5ab8ee4eec1dbd632fe09d9_amadey_darkgate_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-01_758bd8f2e5ab8ee4eec1dbd632fe09d9_amadey_darkgate_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5272
- C:\Temp\urmjecwurmjhbzwr.exe
  C:\Temp\urmjecwurmjhbzwr.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4496
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ztrojhbzur.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3204
  - - C:\Temp\ztrojhbzur.exe
      C:\Temp\ztrojhbzur.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5388
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3392
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1124
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ztrojhbzur.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5904
  - - C:\Temp\i_ztrojhbzur.exe
      C:\Temp\i_ztrojhbzur.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4964
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbytrljgbz.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5036
  - - C:\Temp\dbytrljgbz.exe
      C:\Temp\dbytrljgbz.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:720
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2000
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4692
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbytrljgbz.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1084
  - - C:\Temp\i_dbytrljgbz.exe
      C:\Temp\i_dbytrljgbz.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2976
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ytqoigdyvt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1512
  - - C:\Temp\ytqoigdyvt.exe
      C:\Temp\ytqoigdyvt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5136
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2740
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2456
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ytqoigdyvt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1264
  - - C:\Temp\i_ytqoigdyvt.exe
      C:\Temp\i_ytqoigdyvt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1108
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\yvqnlgaysq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6072
  - - C:\Temp\yvqnlgaysq.exe
      C:\Temp\yvqnlgaysq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1060
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1668
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1396
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_yvqnlgaysq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5192
  - - C:\Temp\i_yvqnlgaysq.exe
      C:\Temp\i_yvqnlgaysq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5736
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dxvpnifdxv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5592
  - - C:\Temp\dxvpnifdxv.exe
      C:\Temp\dxvpnifdxv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4692
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3304
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5436
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dxvpnifdxv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5960
  - - C:\Temp\i_dxvpnifdxv.exe
      C:\Temp\i_dxvpnifdxv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3732
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qkicauspki.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3736
  - - C:\Temp\qkicauspki.exe
      C:\Temp\qkicauspki.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1076
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1224
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5104
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qkicauspki.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5996
  - - C:\Temp\i_qkicauspki.exe
      C:\Temp\i_qkicauspki.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5608
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\spkhczusmk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1320
  - - C:\Temp\spkhczusmk.exe
      C:\Temp\spkhczusmk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3488
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1500
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5052
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_spkhczusmk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:200
  - - C:\Temp\i_spkhczusmk.exe
      C:\Temp\i_spkhczusmk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4228
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xrpmkecaur.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5444
  - - C:\Temp\xrpmkecaur.exe
      C:\Temp\xrpmkecaur.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3596
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1508
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5712
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xrpmkecaur.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2176
  - - C:\Temp\i_xrpmkecaur.exe
      C:\Temp\i_xrpmkecaur.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4168
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rmjhbwuomh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2960
  - - C:\Temp\rmjhbwuomh.exe
      C:\Temp\rmjhbwuomh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6084
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1128
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3288
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rmjhbwuomh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1688
  - - C:\Temp\i_rmjhbwuomh.exe
      C:\Temp\i_rmjhbwuomh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2128
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jebztromjd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5608
  - - C:\Temp\jebztromjd.exe
      C:\Temp\jebztromjd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3416
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1040
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2564
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jebztromjd.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2920
  - - C:\Temp\i_jebztromjd.exe
      C:\Temp\i_jebztromjd.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5732
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\oljdbvtrlj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1564
  - - C:\Temp\oljdbvtrlj.exe
      C:\Temp\oljdbvtrlj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5284
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3068
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1616
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_oljdbvtrlj.exe ups_ins
    3⤵
    PID:1396
  - - C:\Temp\i_oljdbvtrlj.exe
      C:\Temp\i_oljdbvtrlj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3788
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gdyvqoigay.exe ups_run
    3⤵
    PID:3040
  - - C:\Temp\gdyvqoigay.exe
      C:\Temp\gdyvqoigay.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4424
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4680
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2116
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gdyvqoigay.exe ups_ins
    3⤵
    PID:2476
  - - C:\Temp\i_gdyvqoigay.exe
      C:\Temp\i_gdyvqoigay.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3428
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\yvqnlfdays.exe ups_run
    3⤵
    PID:2588
  - - C:\Temp\yvqnlfdays.exe
      C:\Temp\yvqnlfdays.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:252
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6020
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3464
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_yvqnlfdays.exe ups_ins
    3⤵
    PID:2252
  - - C:\Temp\i_yvqnlfdays.exe
      C:\Temp\i_yvqnlfdays.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5980
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\yvpnifaxsq.exe ups_run
    3⤵
    PID:1124
  - - C:\Temp\yvpnifaxsq.exe
      C:\Temp\yvpnifaxsq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:960
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4228
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5848
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_yvpnifaxsq.exe ups_ins
    3⤵
    PID:4744
  - - C:\Temp\i_yvpnifaxsq.exe
      C:\Temp\i_yvpnifaxsq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4656
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xsmkicxupn.exe ups_run
    3⤵
    PID:3588
  - - C:\Temp\xsmkicxupn.exe
      C:\Temp\xsmkicxupn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4644
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4576
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4512
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xsmkicxupn.exe ups_ins
    3⤵
    PID:5776
  - - C:\Temp\i_xsmkicxupn.exe
      C:\Temp\i_xsmkicxupn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:796
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fcxuspkhfz.exe ups_run
    3⤵
    PID:5044
  - - C:\Temp\fcxuspkhfz.exe
      C:\Temp\fcxuspkhfz.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1756
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4332
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4700
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fcxuspkhfz.exe ups_ins
    3⤵
    PID:2004
  - - C:\Temp\i_fcxuspkhfz.exe
      C:\Temp\i_fcxuspkhfz.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2716
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kecwupmhfz.exe ups_run
    3⤵
    PID:2756
  - - C:\Temp\kecwupmhfz.exe
      C:\Temp\kecwupmhfz.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4488
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5576
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6112
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kecwupmhfz.exe ups_ins
    3⤵
    PID:5772
  - - C:\Temp\i_kecwupmhfz.exe
      C:\Temp\i_kecwupmhfz.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4820
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ebwuoljebw.exe ups_run
    3⤵
    PID:4872
  - - C:\Temp\ebwuoljebw.exe
      C:\Temp\ebwuoljebw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1144
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1932
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3232
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ebwuoljebw.exe ups_ins
    3⤵
    PID:2240
  - - C:\Temp\i_ebwuoljebw.exe
      C:\Temp\i_ebwuoljebw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4824
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljdbolgeyw.exe ups_run
    3⤵
    PID:1616
  - - C:\Temp\ljdbolgeyw.exe
      C:\Temp\ljdbolgeyw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:760
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3264
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2752
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljdbolgeyw.exe ups_ins
    3⤵
    PID:1604
  - - C:\Temp\i_ljdbolgeyw.exe
      C:\Temp\i_ljdbolgeyw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1848
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bytolgebwq.exe ups_run
    3⤵
    PID:2592
  - - C:\Temp\bytolgebwq.exe
      C:\Temp\bytolgebwq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3456
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3636
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3364
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x31c,0x7ffca710c188,0x7ffca710c194,0x7ffca710c1a0
      4⤵
      PID:1804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,12678670565219861507,18057342060717541535,262144 --field-trial-handle=2288,i,6625959482209470556,2920566914761974521,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
      4⤵
      PID:568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,10782709536490085233,18197377938828711733,524288 --field-trial-handle=2288,i,6625959482209470556,2920566914761974521,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:11
      4⤵
      System Time Discovery
      PID:3584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2444,i,3977616265970279661,2651829166619026059,524288 --field-trial-handle=2288,i,6625959482209470556,2920566914761974521,262144 --variations-seed-version --mojo-platform-channel-handle=3180 /prefetch:13
      4⤵
      PID:5972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3544,i,4222754707670913122,9037868731499560335,2097152 --field-trial-handle=2288,i,6625959482209470556,2920566914761974521,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
      4⤵
      PID:2116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3564,i,17154014066744960438,1862233228704198204,2097152 --field-trial-handle=2288,i,6625959482209470556,2920566914761974521,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
      4⤵
      PID:2284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,14992297133339450098,3737869843930640220,2097152 --field-trial-handle=2288,i,6625959482209470556,2920566914761974521,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:1
      4⤵
      PID:6016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4216,i,1875108261931944698,9631285569535005388,2097152 --field-trial-handle=2288,i,6625959482209470556,2920566914761974521,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:9
      4⤵
      PID:2588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3856,i,9527824384158101350,5569774771838867777,524288 --field-trial-handle=2288,i,6625959482209470556,2920566914761974521,262144 --variations-seed-version --mojo-platform-channel-handle=3848 /prefetch:14
      4⤵
      PID:5036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,7984753170185031717,9963045064692289703,524288 --field-trial-handle=2288,i,6625959482209470556,2920566914761974521,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:14
      4⤵
      PID:1516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,12316448525095515616,6888991268132083968,524288 --field-trial-handle=2288,i,6625959482209470556,2920566914761974521,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:14
      4⤵
      PID:3428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,9000942632559839755,9784953026761406114,524288 --field-trial-handle=2288,i,6625959482209470556,2920566914761974521,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:14
      4⤵
      PID:3464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,9000942632559839755,9784953026761406114,524288 --field-trial-handle=2288,i,6625959482209470556,2920566914761974521,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:14
      4⤵
      PID:4640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,15998408918346608536,16599574691974997292,524288 --field-trial-handle=2288,i,6625959482209470556,2920566914761974521,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:14
      4⤵
      PID:4900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,8489896109496538502,6220253357318726031,524288 --field-trial-handle=2288,i,6625959482209470556,2920566914761974521,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:14
      4⤵
      PID:5736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4200,i,17030259585147945972,16056882252538879766,524288 --field-trial-handle=2288,i,6625959482209470556,2920566914761974521,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:14
      4⤵
      PID:4176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4492,i,13831211562038223261,7901536530925626490,524288 --field-trial-handle=2288,i,6625959482209470556,2920566914761974521,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:14
      4⤵
      PID:1376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,5109757186197071885,17071389273422870908,524288 --field-trial-handle=2288,i,6625959482209470556,2920566914761974521,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:14
      4⤵
      PID:4644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,6112733536188264945,18262270098026372791,524288 --field-trial-handle=2288,i,6625959482209470556,2920566914761974521,262144 --variations-seed-version --mojo-platform-channel-handle=3852 /prefetch:14
      4⤵
      PID:5264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=924,i,11880506724659513931,11716507681753907503,524288 --field-trial-handle=2288,i,6625959482209470556,2920566914761974521,262144 --variations-seed-version --mojo-platform-channel-handle=3820 /prefetch:14
      4⤵
      PID:4580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5572,i,8646965224564570070,2280611394748277642,262144 --field-trial-handle=2288,i,6625959482209470556,2920566914761974521,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:10
      4⤵
      PID:1740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,9318728288808319170,14200586258964885891,524288 --field-trial-handle=2288,i,6625959482209470556,2920566914761974521,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:14
      4⤵
      PID:1108

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:416

C:\Temp\urmjecwurmjhbzwr.sys
C:\Temp\urmjecwurmjhbzwr.sys
1⤵
- Executes dropped EXE
PID:824

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2604

C:\Temp\jebwuolgdb.sys
C:\Temp\jebwuolgdb.sys
1⤵
- Executes dropped EXE
PID:3968

C:\Temp\jgbytqojgb.sys
C:\Temp\jgbytqojgb.sys
1⤵
- Executes dropped EXE
PID:3916

C:\Temp\vqoifdyvqo.sys
C:\Temp\vqoifdyvqo.sys
1⤵
- Executes dropped EXE
PID:1760

C:\Temp\nlfdavtqlf.sys
C:\Temp\nlfdavtqlf.sys
1⤵
- Executes dropped EXE
PID:1960

C:\Temp\nkicauspnh.sys
C:\Temp\nkicauspnh.sys
1⤵
- Executes dropped EXE
PID:260

C:\Temp\fzxspkhcau.sys
C:\Temp\fzxspkhcau.sys
1⤵
- Executes dropped EXE
PID:1040

C:\Temp\cwurpjhfca.sys
C:\Temp\cwurpjhfca.sys
1⤵
- Executes dropped EXE
PID:2892

C:\Temp\zwuomhezwr.sys
C:\Temp\zwuomhezwr.sys
1⤵
- Executes dropped EXE
PID:3636

C:\Temp\ojgbzwromg.sys
C:\Temp\ojgbzwromg.sys
1⤵
- Executes dropped EXE
PID:6020

C:\Temp\trojgdbztr.sys
C:\Temp\trojgdbztr.sys
1⤵
- Executes dropped EXE
PID:3804

C:\Temp\dbywqoigby.sys
C:\Temp\dbywqoigby.sys
1⤵
PID:800

C:\Temp\dxvqnlidbv.sys
C:\Temp\dxvqnlidbv.sys
1⤵
PID:5436

C:\Temp\aysqkicavs.sys
C:\Temp\aysqkicavs.sys
1⤵
PID:2560

C:\Temp\icausnkfdx.sys
C:\Temp\icausnkfdx.sys
1⤵
PID:764

C:\Temp\fcxusmkhca.sys
C:\Temp\fcxusmkhca.sys
1⤵
PID:4108

C:\Temp\hfzxrpjhcz.sys
C:\Temp\hfzxrpjhcz.sys
1⤵
PID:3864

C:\Temp\rmcwuomgez.sys
C:\Temp\rmcwuomgez.sys
1⤵
PID:2260

C:\Temp\omjebwtroj.sys
C:\Temp\omjebwtroj.sys
1⤵
PID:1216

C:\Temp\bwtolgeywq.sys
C:\Temp\bwtolgeywq.sys
1⤵
PID:5484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dbytrljgbz.exe

Path C:\Temp\dbytrljgbz.exe
Size 384KB
SHA256 6a2fe63cf7df2cddf530b9b5c5c5af1f4c3a25d005f5c93d415ef34dc9c897a8
MD5 d0111f490e1bf9a6faa0c263b683a934
SHA1 db389dabac8c5a4c37c4d4290b2014564fdd1eea
SHA512 01d400965b49cf95172a7cec9e0b1be5f7444b96511862c287380202f038351717d0c314a76b7a3b950189168463fc6618eb0d23d39ad81602f08f8b255b25ab
SSDEEP 3072:D9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:hctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1AF847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxvpnifdxv.exe

Path C:\Temp\dxvpnifdxv.exe
Size 384KB
SHA256 778b15803d0edd8ad7796389bf7bc3daf9fa5c2afb0e32d57c5282c71ca5c810
MD5 286fb390a5e343578d0d107722c5af33
SHA1 c23fb3e84c60b9f1702b6d03173f59e9301426e7
SHA512 fdb6358082664f6bc37bb7ba6d320c39a21f3373409bd2a80aaddb0ccfee35cb0b72866f7e645b72b3de1fcfd5bff77c57701adfdedc0b87792cd6ff87589825
SSDEEP 3072:A9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:SctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T144847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dbytrljgbz.exe

Path C:\Temp\i_dbytrljgbz.exe
Size 384KB
SHA256 9ee25f9f57eabd5433eb4a75342005c0939a0b682791da6d5667f6245018d6c8
MD5 4447e1716932858550d305691219b666
SHA1 39676bfc6705f3417f7e41a649461e83aa1c3acb
SHA512 768a0953e59778f4f33d1e13e3d13f09bb698cebb5332d9f1ca5c67096c65b4838ac50d24937805798759c32b70515d9858d8bfabca97a5c1b5cd0ddc8312625
SSDEEP 3072:m9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:UctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T104847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dxvpnifdxv.exe

Path C:\Temp\i_dxvpnifdxv.exe
Size 384KB
SHA256 0ca61767e1a093c2a419c22270929efd028bb2befd031613d457c2ed130f9d43
MD5 4f8219d3a3a86a959d32cddca1cc29d6
SHA1 9a1e12635f1f12a7fa89271332f04a7ba54d813c
SHA512 9511300897fb0cab870be319e58c4ba4b37e2a69a38eb7f1f4b54729859d39ed16b4d6e6592a5cfe347829b9652e23fd6265ba09322b6f9c9de54d6dad6ad9dc
SSDEEP 3072:+9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:cctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T192847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ytqoigdyvt.exe

Path C:\Temp\i_ytqoigdyvt.exe
Size 384KB
SHA256 cdcc4cfb36d0f82fcc2a0a67f39621817034ee028efcd77693b76dbcc07b599f
MD5 2cd58f09de41efc825c5c2c4ee23cea4
SHA1 fc102c555beb55c0f7b09afd67696d11062f78ec
SHA512 a4163cda583542672f3f528901ef56ea6d96bb74f9879964a70e875542be011dcbb2dd2dec8201ff2b8ed99bd580632b196a3acd2e2a3a53a1836ac84cafe404
SSDEEP 3072:q9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:QctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B5847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_yvqnlgaysq.exe

Path C:\Temp\i_yvqnlgaysq.exe
Size 384KB
SHA256 f8361bff964eb2dea9af294739c32c132b3043a015e3cbc316757c44375cfc87
MD5 99981b6b1c6c82b1a7656704199cab4e
SHA1 2a16f04127ffdc30c825d86e9388823448a28d55
SHA512 f8c46ba4185b37f47cc36203e822003ac4002259a842590616482e9d9f68e38a1b48a9486cc3f97e4ae9d9657d4a8ac985752a30d211f8707f2e473a02804b25
SSDEEP 3072:/9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:FctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T145847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ztrojhbzur.exe

Path C:\Temp\i_ztrojhbzur.exe
Size 384KB
SHA256 62431187f77dca9f9d5bf327e9d0d3a32b0f2031b6bc9f03a8fcd5762366e2af
MD5 eb60c9953e393609fd6db838fa29357c
SHA1 f1bdf8d7e855382cd6de3d68be08f125912400f8
SHA512 d9e58ac21b74167acfd030c5d28de1f3106a02b88ff7458e70e97c8772b1415b8171d07cccb068903be649fbb56f4add772a3278402fad3f3ec29f19e648776d
SSDEEP 3072:19ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:XctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T196847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jebwuolgdb.sys

Path C:\Temp\jebwuolgdb.sys
Size 293KB
SHA256 14b230276a097d291218374f96f5f417273d9def1a297c65a06f2f9055a60c89
MD5 fff3ed0162bb5a8e2a41e64e1177b3f6
SHA1 258b245fbb5542c26a43321e88a93263e1e37ece
SHA512 dfd2338c85a7c88c6acbe219e588725929dfe09e5874bc65130b5421da586fadc24c765ba18b14a7ca19da358cdc1dd980bd3eec3d75021837c3ce8cddd6dc9c
SSDEEP 3072:AtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:AIJjiJcbI03GBc3ucY5DCSj
TLSH
T12D545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jgbytqojgb.sys

Path C:\Temp\jgbytqojgb.sys
Size 293KB
SHA256 fff2905390c65c5f01457defb0c53e96939771e02291e8210c2163583c04612f
MD5 6e980bf8d59dfcfc3723d316dc71897d
SHA1 a74238cd35dec164dc5d9dd15e336cd3ceff072f
SHA512 ccbb804f9898e79135e50fd169bd53ac84a46e9e7fa8f1c8ee4d850c97e16705e28eb7cd109ceba947b2c2c001521c9ac06c79ba4de3bb9291d9250303ad9055
SSDEEP 3072:LtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:LIJjiJcbI03GBc3ucY5DCSj
TLSH
T175545B44AAA4B0F6D9D5043C00EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nkicauspnh.sys

Path C:\Temp\nkicauspnh.sys
Size 293KB
SHA256 c813aafb184aec45fba58f0a42b4b77b2d3be2e1a5688ace42abcb8b391b1543
MD5 babfd97741097cd571944ba9bc1c27fb
SHA1 904b1fbde63e7b78568074161c416dbb2a0896f9
SHA512 e0c1268dbbdd413ceaba85cb7c8fb8fb12c451427d4c8df21c3db468307cca47eafc49f92bbd90a6eeeaa2bf4fec43e6ae1ca8d4d4abee57c30a6fbb269eb1b9
SSDEEP 3072:BtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:BIJjiJcbI03GBc3ucY5DCSj
TLSH
T15E545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlfdavtqlf.sys

Path C:\Temp\nlfdavtqlf.sys
Size 293KB
SHA256 9e8febdf560256d882d76b0aab6f724b3ed671860ca0a44fe4795af916df6376
MD5 513cf574827d9a899366cf9634dde200
SHA1 26c771107f2995d8d66aa1129b76ff2d1b81f713
SHA512 d72b98b53cf0bab2effb5ec2d11472b8bc7905a134567e04c406a575ad58297f7b9e1b79adcbef5347c4f11203a5b7cd8e324cfb77223d6f774335b5028c0f51
SSDEEP 3072:otKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:oIJjiJcbI03GBc3ucY5DCSj
TLSH
T124545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qkicauspki.exe

Path C:\Temp\qkicauspki.exe
Size 384KB
SHA256 d4227eab29ecc9dcb974ccbb577b96f3d74f3ca6af5b88a638a30968a98cdfbf
MD5 8fa0d69e8ef1dd5eae6936df1f848435
SHA1 f19e14d25b3f9793993c6bf587a42e00bbd45376
SHA512 2a4284657715005e1750561350205109ce6ebd4882bc334249a0fc0639f64cb0bc9171d6e08b0a5e36d4a060065eb6ce1a139748bc1d5856b8c638b504869d78
SSDEEP 3072:79ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:pctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T17E847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urmjecwurmjhbzwr.exe

Path C:\Temp\urmjecwurmjhbzwr.exe
Size 384KB
SHA256 96d2a299032eb5806d8d9bef1edbaf84140accbe7c2a85b754765a87e44d9a8a
MD5 426c2e5bf80241a604dc3e81bdea0816
SHA1 12c506539848e6eeb97dbba5dd1e6fc29a5ec4e3
SHA512 4ff45bb418ca2fe034f844973de9736a9e0d68fc8801fdc957e91614600dd5b8f11d9b681d37cac846aa455379271ff3efbeefb03570275879ae78f590df3101
SSDEEP 3072:d9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:vctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T100847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urmjecwurmjhbzwr.sys

Path C:\Temp\urmjecwurmjhbzwr.sys
Size 293KB
SHA256 cb6f1ddaef0fd193c7dbc8c125ced4e727398c6fcc37c99cf2ae04577f4b2e71
MD5 0564b56c4fbdf4888cd33bd7c1d37a35
SHA1 a1433fab6ee2eebe3a7d0f389a04fa3bd25937be
SHA512 1a9ca8b860c82dd1d2e2c49645cff60c86bc2aaf660450809668bed233d862c4eff3e1abeba9de98f995e8203f8dd5dc2bfa1327ef1700a2b396e37fb49f7208
SSDEEP 3072:xtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:xIJjiJcbI03GBc3ucY5DCSj
TLSH
T19F545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vqoifdyvqo.sys

Path C:\Temp\vqoifdyvqo.sys
Size 293KB
SHA256 054ba5e8c435e58f8f0b12635183d5b0a55029bb20960b1da10bb3fa69743181
MD5 afae67cba6f0707fd67deb4b16c59de8
SHA1 9ee2b415e5318f28a79907f0009ff34ec793892d
SHA512 cec73c19b6e36ea033b25b70e9ef73282ab4eece735fcd737fcd6b82d3183b4925d1bc9b5af1226352da402a63fd73048100adfb056790919ea145a2715928cd
SSDEEP 3072:btKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:bIJjiJcbI03GBc3ucY5DCSj
TLSH
T1C3545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ytqoigdyvt.exe

Path C:\Temp\ytqoigdyvt.exe
Size 384KB
SHA256 3fcaacc6fb5a63c7fea491b20235f42fc8a684a447127c7f817912c96466dd94
MD5 b8164cce30c3fd3d570e4053e0cf2816
SHA1 71b9a1ec32090327f3b01eeaba0ee2123d4ec324
SHA512 c7c2010944fed04330b5c0abf104bc88ba483cbf921265549b381a41d67bc87c951f476f86dc8607172ba326e06aff141bb9886de997d3fa4f41c3c36826c32f
SSDEEP 3072:/9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:FctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D5847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yvqnlgaysq.exe

Path C:\Temp\yvqnlgaysq.exe
Size 384KB
SHA256 a407264cac4ba2b7c7f4e48c172ca03962b4885dd495ce8c1c6588addde42c49
MD5 f0de2913eaf51ccec5bab3c699e6ad7c
SHA1 ec0f37054727c81bd71de6350ab88379b54c4f75
SHA512 32c9f066fa24d72d9f1af5716d189ad6dbe70270213efff8f4b7690e5678004bb04b17bca2d7826f405d67961927fbd06379b241d33aeddfca71f57a3b0bc231
SSDEEP 3072:i9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:4ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B1847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ztrojhbzur.exe

Path C:\Temp\ztrojhbzur.exe
Size 384KB
SHA256 4a47a6752596b5edf24319504fdd0c394f889e01f872ebf6ee16c6c9054999e7
MD5 4cae627080cbd5f80f4a9fc8fcbcf5da
SHA1 5a24301d6c4b5f7fb1b4f066e179fa7927706208
SHA512 979eb3e48e026ad9ce91d621891a201d48751159b1734ae20c20c005c350d99e5be4fe096a10d00ed24f540e5274b924d067cac986f5fe29320d164240dee389
SSDEEP 3072:F9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:nctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1CD847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
MD5 f5ed4946834be586ac6410ed88740a7c
SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
TLSH
T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e6f2ec3da5a55b94951d91a6f68f09f5b5302626e9b44f9c5ae85087d4b011ce
MD5 8b9572b87c690bba0911ee169fe3145a
SHA1 13949d8863f21886aac212914e50a63f98fc3bb7
SHA512 7e95e8da9da23d57209d6c9e77c4f541610f40a846f3d7f4e86fa753400725decbbb597f6f5a37185d9772cbccee30e292f8166bd22e61b5a143ce28a34d7562
TLSH
T110D080303B15D404D684303B68E1571377258DB124F587495151F12FDC785D5735F1DB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 285edd241c61b650f4ebb0af692fa8c3d423cd90ceb6cc13a4b1822090ff7f06
MD5 1ee4bd81bebf6a852c6b54515323121f
SHA1 adf27a1ea63272fb43f4920a3b1a89af6bc47898
SHA512 d0806667d6103fe42ef7bf71acd230ca635df50a2173225c0edf389977fa5eb0e18b2e196eeaaf466f38c23aa14f637dbb68a39dea3ce483c41b7f120f6ac9fb
TLSH
T116D012243A159504D684203668A05613662589A164A586495151E11FDC68595635F1AB
MD5 SHA1 SHA512 TLSH

Submit Download

67dc6f44-72b2-47f0-bf24-5321782ec1aa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\67dc6f44-72b2-47f0-bf24-5321782ec1aa.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 3009b9df2cb69053f8529334c4f5185595c400e0c1f4548860d5d979f9f686b8
MD5 05ff265a7bbe4748b36fcd37c851c4e0
SHA1 3a26593eda563ab0e3bf96a695fea0f4ad744fd3
SHA512 982f01e684df2d065784d5bdbb0bb6d05fc744578e3bd0d664e9aae3daee4ea7d3aa44c1b2b1bc32bfb1fbe1cf03a09998adaf652e4499e42c87e043b8efaf67
TLSH
T1FF514C063DAF0816C76603FD0BE2128DFF6894F645037E94C0DB91FAB986328635A473
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 c93b9dfae77ec091ee879d4e2c6570e33181b0380c0c5147c6fcb2d296a46954
MD5 757f39419261c57e08fa08d8394f7196
SHA1 662835833c27494ab984face1a7ec58aca78c7ee
SHA512 2ee65e4785844295f8e505452c80c2067b07abb3b78e73720838fe07cdfe1df90b7033e52d767863287bc260971d090542ecdddd32152823e833ed798b650a27
TLSH
T16C51ADF7C7E8866D890156F0BA186E2BCE1D0914832C3D5AC9E4EF1B93E3471E24195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 b9f5731e62d78ece707c10215e5a1c39fedc35ef4496b87391ad07129ee28e6b
MD5 742d722aa271fdcae8415db2e8b7807a
SHA1 c3ad41e20bbde5a4db666cbce936c69433943b66
SHA512 18f0dbfe7425b9ee5ea42fac864e9fb474a772e09ed3d327fd1a1ab2b2b000e6ab8627db551a77176fcd324bb9832d349a6a965b0df9dcdde346ffb56b864ceb
SSDEEP 192:sxRVHRRI3yM/jK1Ml8wcYp/fQ1s1/xddZVupPjWzoA8p9VJ/g6+WNCV9H/YweeZo:sxRn8Cm/f8s15dTclt/5A/w3
TLSH
T17062FC55AA38597BCCCBD20DFA45BB63D6F9157392901E44A9FC8A0C01E76DD2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 23a3e3900f86150ef0818d3c8b98e0450cfe4a0ea8496650c8faec8203c5d3e4
MD5 bb574073bb4a0378f19616aa522f4eec
SHA1 0a76bcb50adf53cf7abfe7a4e6ad331fed7bb46c
SHA512 1204582bf8ec1ac96ad90c05a760b93f3657c392b6e4f1e9511f732e108241996ee5393c98b916c49eadf2db0656d06a608ad24a3665b382e5e5c336c3e7c75c
SSDEEP 192:sxRVSRRI3yM/jK1Ml8wcYp/fQ1sYds/xddZVupPjWzoA8p9VJ/g6+WNCV9H/YweN:sxR08Cm/f8sH5dTclt/5A/wx
TLSH
T115620B56AA38597BCCCBD20DFA45BB63D6F9157392901E44A9FC8A0C01E76DC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 10d9a7fafbc04078ffc08e058f3d621b1bb06935fc2e109f40061d3421646ee6
MD5 c24eace2013ba38a631664a3b9b4a3d5
SHA1 697e2a5a413cb9db60bb8e0f6c9a59408d118cd8
SHA512 e986fc25afa7237ec37d679ece90bb02236b7b54c097bce2d93b8704716064f0ef7c94df0dfbbadf572440f9f6ae6bb6e243970dc358aff4965613c837fda90d
SSDEEP 192:sxRVSRRI3yM/jK1Ml8UQY5cYp/fQ1sYds/4TtddZVupPjWzoA8prVJ/g6+WNCV9C:sxR08qpm/f8sHCtdTclD/5A/e/
TLSH
T17162FA56A9285977CCCBD20DFA45BB63D6F9257392901E44AAFC8A0C01E76DD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 62c77caca20fc9157ff144e2b8731e524dcda7453227e06ef25caaf7ac15c707
MD5 8206f96dffd8def50b328b251cdcdb24
SHA1 9647fb17dba225c087d8a22571d99ee3bd784550
SHA512 acd56906eabbf2a6c901ed47b3c0871fce89d72b5a8ab69dd2b256a536fe6e2a523f92881934c21e24000ee68ef38dc44c195cd34c3b9f19821e038d2acea39d
SSDEEP 768:Ra7VjA7pLuL7wZWgmofLk8F1+UoAYDCx9Tuqh0VfUC9xbog/OVqkid4viroICkB:Ra7VjME7wZWgmofLku1ja1kiav5GB
TLSH
T16AE20D3B680CCB7E4F804A9CEC29BD9EADAD01CF5AD8C95447EA840C03C67EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 c0ec5cc95c3dfd2603cdae348a8f224ed43becca64c3e464fa7429bef6b279be
MD5 940c3e7782c1876ee26d393601c00c1c
SHA1 4737316ed772fb77e2c7e73a2905a57c57f0dec7
SHA512 26b61fde6bf7e85ecfa1c71784bf0b327565bceeeb4dc1741d580b790cba3539b1788abafdc111ef3e447fe6c110991c8ca99eac011641dc1af1325680867fac
SSDEEP 96:KOWhIEeUITx4Li38TKfK3iTDGuTQIw4xslRHffexPaF3xeKfr37eDJxiLmAxEwCd:9WhIEeUI94LU82K3iXGuTQIw4xslRHfC
TLSH
T1A891531532BA17403C3D680992F5986B578234F230D9A42F7BE976E12F66E054EFCDCA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a2aca.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a2aca.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 8376b5a53fa94fff70d8fe1e844441f782a71137a828c496a1fa91aa5dd561c3
MD5 9b9ae5db085feb2868f6f0e17ee76fea
SHA1 45847a4bd415ed99d7960f19d7b8ad55b8240d38
SHA512 4b2ef210acaba0fa6a822056f1c921432c6141c5d9d1ca33ff74e12e9f854153613de511c6a1008d307d26db8b8fdbb0b53192bcb0d1ea80c159bbd5d1780a6d
SSDEEP 768:Bj+9/3sJi/jy6iFceq2dlcnSl0bCTwZWkwx0aQ:c9/3sciiB2dynSl6briO
TLSH
T148F2AE31BC59DE738CE6D285B2073A96FEF810A345811F948EDD6F0D028779E171B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 eb0adfd47e75d817299456184744a9971b398e37c2a0998835c1eae7221f54ea
MD5 dbe5fa55f4bb74376d33f0a53d0716bc
SHA1 4bd2cd10cee952a2992f2fcea47c0a34c44b9793
SHA512 f775cace48a8cceea2fb468fffbda716d40b2fe2ddfc44cf85e2db85746f4865f5634eb3c50b8a8912089fbed0fb8f8d9e5cf218528501a64460cbfd97defe32
SSDEEP 768:Jrv+4UNbdr3NP/jy6i7q2dlcnSl0bCTwZijQ+8rEnk:Jbsbl35iW2dynSl6b7DrEk
TLSH
T1B703BF31ED58DA739CE2D685B14B3A13BEF841A356C60BD4CDDE2B0D428B59E131B862
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 b9457213d7ca2769f935e1173e501881bca959ed2bf06872eeb9798741e989dc
MD5 ee2e7f4657eac46cfcf1b190dde89177
SHA1 17272cb33358464962e0c1ce4dca23aa2d2bf60d
SHA512 07ecccce61db115abb2790d89f67060b1b5c8e251ad94a9bf5d1ef217f552133aa7e84cb361e91f8a8b9e1c2d97b88d3a7c426787a10510552a0d240956d4620
SSDEEP 768:oj+9/3nJi/jy6iFceq2dlcnSl0bCTwZWkwx0aQ:39/3nciiB2dynSl6briO
TLSH
T1F8F2BE30BC58DE738CE6D285B2073A96BEF810A345811F948DD96F0D028739E171B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 9f554dd5cbb13e655c9be3be96fc538be41690991eec9820bf4b8581fffc1ec8
MD5 37a45a42d66ddc1fadf9b20f4c70750b
SHA1 37d073d820dd71030468e8e30be9a74b267ae277
SHA512 5c5af6fc18c5595daec7aeace0a4e1cff41a1d09efed47325bb20fd7d93501258409bd0c2766d9b4cf137fccd2ee11b2aa4c39ae57c6bbe37dea438049c66584
SSDEEP 768:jrv+4UNbdJ37i/jy6iFceq2dlcnSl0bCTwZWk+8rEnM:jbsbz3KiiB2dynSl6brDrEM
TLSH
T1F613BE30BD58EA739CE6D645B14B7A43BEF810A345C10F94CDDA1B0D028BA9E271F927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 fd134cf465a09757b038dff55def52a68c02a0d86ffeff9d0f08cf5746a40299
MD5 319e400d8366d7f633cd12e1fa392a0a
SHA1 5efe0e706b8bc425184055ef086fdf47eb09501a
SHA512 2699001efd989737308d15b48751e5e89b7d5e03f7bbdd3b5c0ed5e1971a3d72633e6060757a6c08c4062223ef74cc768ab4067c494cd3281f6ab7f74e986493
SSDEEP 768:9F1j+9E38wgpo2SiFcyq2dlcnSl0bCTwZWkwx0aQ:U9E364iid2dynSl6briO
TLSH
T1C41329F598D78976D8EE8787A33E6D56ADBCC05375845984BBC81E0CCD822BFC20A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

32ab547f-43ce-488f-8073-e8b9df2471c1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\32ab547f-43ce-488f-8073-e8b9df2471c1.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4648_1073404461\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 239a79b015f7f435158e607b981105fe1b8941862cbf5e66e6895d9666b3fa05
MD5 782d6407296351f1720ba5ca8c651d06
SHA1 3bfbe55d13314fab907145b427aaf4a54a4d0308
SHA512 64819808e45a66d3c1fef287a110d10ff3d5a1ee25d30e3dfc0b9975ca9cfa539fdbfe5a427a87976fb4d00c2e8ef67285fa05c5f82a76cc618a23ff16e8e686
TLSH
T11671008356B9C9F3C29A5FF402835648F1BB22384B23303407555586AA30A7E28B8F08
MD5 SHA1 SHA512 TLSH

Submit Download

memory/260-302-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/764-428-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/800-387-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/824-62-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1040-327-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1216-459-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1760-269-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1960-289-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2260-460-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2560-408-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2892-331-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3636-346-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3804-375-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3864-437-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3916-242-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3968-193-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4108-432-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5436-400-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5484-480-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6020-350-0x0000000000010000-0x00000000000AB000-memory.dmp

Download