systex | b06a1e969823e7504fadda865722f5d7b80eb0efec01c2f627c6aff9029da026

Analysis

max time kernel
149s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 13:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_981d9ac36f5e545c55a8bb75282f85ef_amadey_darkgate_elex_smoke-loader_stop.exe
Size 384KB
Sample260702-p91c3sey2x
SHA256 b06a1e969823e7504fadda865722f5d7b80eb0efec01c2f627c6aff9029da026
MD5 981d9ac36f5e545c55a8bb75282f85ef
SHA1 57c9059161f77c0bed5c08c027f614b32103040a
SHA512 5a9925db8ad301a9063484a419a57a556adb7f557f99254db17495ea34d6dc9fa51e8b7e264c4c73851f5e081a9c052692515157ac79e0b8fb2198f9c7ef6283
SSDEEP 3072:39ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:NctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T130847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
5820	xrpjhczusecwuomh.exe
3192	xrpjhczusecwuomh.sys
3248	CreateProcess.exe
4536	romgeztrpj.exe
6120	CreateProcess.exe
6004	CreateProcess.exe
3368	i_romgeztrpj.exe
6020	mgezwrojhb.sys
4868	CreateProcess.exe
3740	euomgeywro.exe
2688	CreateProcess.exe
4212	CreateProcess.exe
2476	i_euomgeywro.exe
2184	mgeywqojgb.sys
1572	CreateProcess.exe
4048	jdbytroige.exe
5608	CreateProcess.exe
5704	CreateProcess.exe
2092	i_jdbytroige.exe
1512	ytqoigbytq.sys
1748	CreateProcess.exe
3060	bvtnlgaysq.exe
3352	CreateProcess.exe
1764	CreateProcess.exe
2608	i_bvtnlgaysq.exe
3300	davtnlfdbv.sys
5616	CreateProcess.exe
2996	sqnifaysnl.exe
6060	CreateProcess.exe
4808	CreateProcess.exe
676	i_sqnifaysnl.exe
560	qnifdxvqni.sys
3116	CreateProcess.exe
6076	faxsqkicau.exe
2024	CreateProcess.exe
1740	CreateProcess.exe
3092	i_faxsqkicau.exe
1680	icausmkfcx.sys
3028	CreateProcess.exe
2076	hczxvsnkfa.exe
2424	CreateProcess.exe
1120	CreateProcess.exe
2508	i_hczxvsnkfa.exe
5460	zurpmkecwu.sys
4404	CreateProcess.exe
6100	czusmkecwu.exe
4092	CreateProcess.exe
1788	CreateProcess.exe
3736	i_czusmkecwu.exe
5848	ecwuomhezx.sys
2036	CreateProcess.exe
5652	wrpjhbzurp.exe
4684	CreateProcess.exe
3512	CreateProcess.exe
4848	i_wrpjhbzurp.exe
4912	wromkebzwr.sys
4372	CreateProcess.exe
464	omjdbwtomg.exe
5384	CreateProcess.exe
4728	CreateProcess.exe
5864	i_omjdbwtomg.exe
4272	ywqojgeywr.sys
3420	CreateProcess.exe
3052	ywqojgbztr.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1240_730470873\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1240_89481959\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1240_831211227\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1240_1434168225\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1240_1434168225\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1240_1434168225\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1240_89481959\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1240_831211227\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1240_1434168225\llm_user_input_extractor_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-02_981d9ac36f5e545c55a8bb75282f85ef_amadey_darkgate_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faxsqkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywqojgbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnifaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwtrojgbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpjhczusecwuomh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	romgeztrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvtnlgaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hczxvsnkfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_romgeztrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_euomgeywro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faxsqkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrojgezwro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omjdbwtomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbytroige.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrpjhbzurp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqojgbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czurpjhczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	euomgeywro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqnifaysnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrpjhbzurp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigaywqol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnifaxsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnifaxsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwtrojgbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtnlgaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czusmkecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvqnigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxvqnigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pkhfzxspki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pkhfzxspki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czurpjhczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbytroige.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqnifaysnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hczxvsnkfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czusmkecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omjdbwtomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigaywqol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnifaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrojgezwro.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5996	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3576	ipconfig.exe
4060	ipconfig.exe
2440	ipconfig.exe
4200	ipconfig.exe
708	ipconfig.exe
1280	ipconfig.exe
6124	ipconfig.exe
4736	ipconfig.exe
932	ipconfig.exe
1076	ipconfig.exe
5944	ipconfig.exe
4272	ipconfig.exe
1124	ipconfig.exe
960	ipconfig.exe
5652	ipconfig.exe
3592	ipconfig.exe
4968	ipconfig.exe
5864	ipconfig.exe
4272	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134274709590680445"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3047816590-610495838-277027736-1000\{A2F1AA57-1221-4308-AB4E-12BD789DE552}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3440	2026-07-02_981d9ac36f5e545c55a8bb75282f85ef_amadey_darkgate_elex_smoke-loader_stop.exe
3440	2026-07-02_981d9ac36f5e545c55a8bb75282f85ef_amadey_darkgate_elex_smoke-loader_stop.exe
3440	2026-07-02_981d9ac36f5e545c55a8bb75282f85ef_amadey_darkgate_elex_smoke-loader_stop.exe
3440	2026-07-02_981d9ac36f5e545c55a8bb75282f85ef_amadey_darkgate_elex_smoke-loader_stop.exe
3440	2026-07-02_981d9ac36f5e545c55a8bb75282f85ef_amadey_darkgate_elex_smoke-loader_stop.exe
3440	2026-07-02_981d9ac36f5e545c55a8bb75282f85ef_amadey_darkgate_elex_smoke-loader_stop.exe
3440	2026-07-02_981d9ac36f5e545c55a8bb75282f85ef_amadey_darkgate_elex_smoke-loader_stop.exe
3440	2026-07-02_981d9ac36f5e545c55a8bb75282f85ef_amadey_darkgate_elex_smoke-loader_stop.exe
3440	2026-07-02_981d9ac36f5e545c55a8bb75282f85ef_amadey_darkgate_elex_smoke-loader_stop.exe
3440	2026-07-02_981d9ac36f5e545c55a8bb75282f85ef_amadey_darkgate_elex_smoke-loader_stop.exe
3440	2026-07-02_981d9ac36f5e545c55a8bb75282f85ef_amadey_darkgate_elex_smoke-loader_stop.exe
3440	2026-07-02_981d9ac36f5e545c55a8bb75282f85ef_amadey_darkgate_elex_smoke-loader_stop.exe
3440	2026-07-02_981d9ac36f5e545c55a8bb75282f85ef_amadey_darkgate_elex_smoke-loader_stop.exe
3440	2026-07-02_981d9ac36f5e545c55a8bb75282f85ef_amadey_darkgate_elex_smoke-loader_stop.exe
3440	2026-07-02_981d9ac36f5e545c55a8bb75282f85ef_amadey_darkgate_elex_smoke-loader_stop.exe
3440	2026-07-02_981d9ac36f5e545c55a8bb75282f85ef_amadey_darkgate_elex_smoke-loader_stop.exe
3440	2026-07-02_981d9ac36f5e545c55a8bb75282f85ef_amadey_darkgate_elex_smoke-loader_stop.exe
3440	2026-07-02_981d9ac36f5e545c55a8bb75282f85ef_amadey_darkgate_elex_smoke-loader_stop.exe
3440	2026-07-02_981d9ac36f5e545c55a8bb75282f85ef_amadey_darkgate_elex_smoke-loader_stop.exe
3440	2026-07-02_981d9ac36f5e545c55a8bb75282f85ef_amadey_darkgate_elex_smoke-loader_stop.exe
3440	2026-07-02_981d9ac36f5e545c55a8bb75282f85ef_amadey_darkgate_elex_smoke-loader_stop.exe
3440	2026-07-02_981d9ac36f5e545c55a8bb75282f85ef_amadey_darkgate_elex_smoke-loader_stop.exe
3440	2026-07-02_981d9ac36f5e545c55a8bb75282f85ef_amadey_darkgate_elex_smoke-loader_stop.exe
3440	2026-07-02_981d9ac36f5e545c55a8bb75282f85ef_amadey_darkgate_elex_smoke-loader_stop.exe
3440	2026-07-02_981d9ac36f5e545c55a8bb75282f85ef_amadey_darkgate_elex_smoke-loader_stop.exe
3440	2026-07-02_981d9ac36f5e545c55a8bb75282f85ef_amadey_darkgate_elex_smoke-loader_stop.exe
3440	2026-07-02_981d9ac36f5e545c55a8bb75282f85ef_amadey_darkgate_elex_smoke-loader_stop.exe
3440	2026-07-02_981d9ac36f5e545c55a8bb75282f85ef_amadey_darkgate_elex_smoke-loader_stop.exe
3440	2026-07-02_981d9ac36f5e545c55a8bb75282f85ef_amadey_darkgate_elex_smoke-loader_stop.exe
3440	2026-07-02_981d9ac36f5e545c55a8bb75282f85ef_amadey_darkgate_elex_smoke-loader_stop.exe
3440	2026-07-02_981d9ac36f5e545c55a8bb75282f85ef_amadey_darkgate_elex_smoke-loader_stop.exe
3440	2026-07-02_981d9ac36f5e545c55a8bb75282f85ef_amadey_darkgate_elex_smoke-loader_stop.exe
3440	2026-07-02_981d9ac36f5e545c55a8bb75282f85ef_amadey_darkgate_elex_smoke-loader_stop.exe
3440	2026-07-02_981d9ac36f5e545c55a8bb75282f85ef_amadey_darkgate_elex_smoke-loader_stop.exe
3440	2026-07-02_981d9ac36f5e545c55a8bb75282f85ef_amadey_darkgate_elex_smoke-loader_stop.exe
3440	2026-07-02_981d9ac36f5e545c55a8bb75282f85ef_amadey_darkgate_elex_smoke-loader_stop.exe
3440	2026-07-02_981d9ac36f5e545c55a8bb75282f85ef_amadey_darkgate_elex_smoke-loader_stop.exe
3440	2026-07-02_981d9ac36f5e545c55a8bb75282f85ef_amadey_darkgate_elex_smoke-loader_stop.exe
3440	2026-07-02_981d9ac36f5e545c55a8bb75282f85ef_amadey_darkgate_elex_smoke-loader_stop.exe
3440	2026-07-02_981d9ac36f5e545c55a8bb75282f85ef_amadey_darkgate_elex_smoke-loader_stop.exe
3440	2026-07-02_981d9ac36f5e545c55a8bb75282f85ef_amadey_darkgate_elex_smoke-loader_stop.exe
3440	2026-07-02_981d9ac36f5e545c55a8bb75282f85ef_amadey_darkgate_elex_smoke-loader_stop.exe
3440	2026-07-02_981d9ac36f5e545c55a8bb75282f85ef_amadey_darkgate_elex_smoke-loader_stop.exe
3440	2026-07-02_981d9ac36f5e545c55a8bb75282f85ef_amadey_darkgate_elex_smoke-loader_stop.exe
3440	2026-07-02_981d9ac36f5e545c55a8bb75282f85ef_amadey_darkgate_elex_smoke-loader_stop.exe
3440	2026-07-02_981d9ac36f5e545c55a8bb75282f85ef_amadey_darkgate_elex_smoke-loader_stop.exe
3440	2026-07-02_981d9ac36f5e545c55a8bb75282f85ef_amadey_darkgate_elex_smoke-loader_stop.exe
3440	2026-07-02_981d9ac36f5e545c55a8bb75282f85ef_amadey_darkgate_elex_smoke-loader_stop.exe
3440	2026-07-02_981d9ac36f5e545c55a8bb75282f85ef_amadey_darkgate_elex_smoke-loader_stop.exe
3440	2026-07-02_981d9ac36f5e545c55a8bb75282f85ef_amadey_darkgate_elex_smoke-loader_stop.exe
3440	2026-07-02_981d9ac36f5e545c55a8bb75282f85ef_amadey_darkgate_elex_smoke-loader_stop.exe
3440	2026-07-02_981d9ac36f5e545c55a8bb75282f85ef_amadey_darkgate_elex_smoke-loader_stop.exe
5820	xrpjhczusecwuomh.exe
5820	xrpjhczusecwuomh.exe
3440	2026-07-02_981d9ac36f5e545c55a8bb75282f85ef_amadey_darkgate_elex_smoke-loader_stop.exe
3440	2026-07-02_981d9ac36f5e545c55a8bb75282f85ef_amadey_darkgate_elex_smoke-loader_stop.exe
5820	xrpjhczusecwuomh.exe
5820	xrpjhczusecwuomh.exe
3440	2026-07-02_981d9ac36f5e545c55a8bb75282f85ef_amadey_darkgate_elex_smoke-loader_stop.exe
3440	2026-07-02_981d9ac36f5e545c55a8bb75282f85ef_amadey_darkgate_elex_smoke-loader_stop.exe
5820	xrpjhczusecwuomh.exe
5820	xrpjhczusecwuomh.exe
5820	xrpjhczusecwuomh.exe
5820	xrpjhczusecwuomh.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe
1240	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	3368	i_romgeztrpj.exe
Token: SeDebugPrivilege	2476	i_euomgeywro.exe
Token: SeDebugPrivilege	2092	i_jdbytroige.exe
Token: SeDebugPrivilege	2608	i_bvtnlgaysq.exe
Token: SeDebugPrivilege	676	i_sqnifaysnl.exe
Token: SeDebugPrivilege	3092	i_faxsqkicau.exe
Token: SeDebugPrivilege	2508	i_hczxvsnkfa.exe
Token: SeDebugPrivilege	3736	i_czusmkecwu.exe
Token: SeDebugPrivilege	4848	i_wrpjhbzurp.exe
Token: SeDebugPrivilege	5864	i_omjdbwtomg.exe
Token: SeDebugPrivilege	2092	i_ywqojgbztr.exe
Token: SeDebugPrivilege	2480	i_qoigaywqol.exe
Token: SeDebugPrivilege	3532	i_fdxvqnigay.exe
Token: SeDebugPrivilege	1488	i_qnifaysqki.exe
Token: SeDebugPrivilege	6140	i_xvpnifaxsq.exe
Token: SeDebugPrivilege	4260	i_pkhfzxspki.exe
Token: SeDebugPrivilege	5488	i_czurpjhczu.exe
Token: SeDebugPrivilege	4912	i_wrojgezwro.exe
Token: SeDebugPrivilege	6140	i_bwtrojgbzt.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1240	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3440 wrote to memory of 5820	3440	2026-07-02_981d9ac36f5e545c55a8bb75282f85ef_amadey_darkgate_elex_smoke-loader_stop.exe	90
PID 3440 wrote to memory of 6056	3440	2026-07-02_981d9ac36f5e545c55a8bb75282f85ef_amadey_darkgate_elex_smoke-loader_stop.exe	91
PID 6056 wrote to memory of 1240	6056	iexplore.exe	92
PID 1240 wrote to memory of 3840	1240	msedge.exe	93
PID 1240 wrote to memory of 5996	1240	msedge.exe	94
PID 1240 wrote to memory of 5496	1240	msedge.exe	95
PID 1240 wrote to memory of 5496	1240	msedge.exe	95
PID 1240 wrote to memory of 6044	1240	msedge.exe	96
PID 1240 wrote to memory of 6044	1240	msedge.exe	96
PID 1240 wrote to memory of 6044	1240	msedge.exe	96
PID 1240 wrote to memory of 5944	1240	msedge.exe	98
PID 1240 wrote to memory of 2872	1240	msedge.exe	99
PID 1240 wrote to memory of 5944	1240	msedge.exe	98
PID 1240 wrote to memory of 5944	1240	msedge.exe	98
PID 1240 wrote to memory of 2872	1240	msedge.exe	99
PID 1240 wrote to memory of 2872	1240	msedge.exe	99
PID 1240 wrote to memory of 628	1240	msedge.exe	100
PID 1240 wrote to memory of 3348	1240	msedge.exe	101
PID 1240 wrote to memory of 628	1240	msedge.exe	100
PID 1240 wrote to memory of 628	1240	msedge.exe	100
PID 1240 wrote to memory of 3348	1240	msedge.exe	101
PID 1240 wrote to memory of 3348	1240	msedge.exe	101
PID 1240 wrote to memory of 2632	1240	msedge.exe	103
PID 1240 wrote to memory of 2632	1240	msedge.exe	103
PID 1240 wrote to memory of 5408	1240	msedge.exe	106
PID 1240 wrote to memory of 5408	1240	msedge.exe	106
PID 1240 wrote to memory of 1788	1240	msedge.exe	107
PID 1240 wrote to memory of 1788	1240	msedge.exe	107
PID 5820 wrote to memory of 3248	5820	xrpjhczusecwuomh.exe	108
PID 1240 wrote to memory of 4532	1240	msedge.exe	111
PID 4536 wrote to memory of 6120	4536	romgeztrpj.exe	113
PID 1240 wrote to memory of 3864	1240	msedge.exe	116
PID 1240 wrote to memory of 3864	1240	msedge.exe	116
PID 1240 wrote to memory of 5708	1240	msedge.exe	117
PID 1240 wrote to memory of 5708	1240	msedge.exe	117
PID 5820 wrote to memory of 6004	5820	xrpjhczusecwuomh.exe	120
PID 5820 wrote to memory of 4868	5820	xrpjhczusecwuomh.exe	124
PID 3740 wrote to memory of 2688	3740	euomgeywro.exe	126
PID 5820 wrote to memory of 4212	5820	xrpjhczusecwuomh.exe	129
PID 5820 wrote to memory of 1572	5820	xrpjhczusecwuomh.exe	133
PID 4048 wrote to memory of 5608	4048	jdbytroige.exe	135
PID 5820 wrote to memory of 5704	5820	xrpjhczusecwuomh.exe	138
PID 5820 wrote to memory of 1748	5820	xrpjhczusecwuomh.exe	143
PID 3060 wrote to memory of 3352	3060	bvtnlgaysq.exe	145
PID 5820 wrote to memory of 1764	5820	xrpjhczusecwuomh.exe	148
PID 1240 wrote to memory of 1120	1240	msedge.exe	150
PID 1240 wrote to memory of 4604	1240	msedge.exe	151
PID 1240 wrote to memory of 2732	1240	msedge.exe	152
PID 5820 wrote to memory of 5616	5820	xrpjhczusecwuomh.exe	155
PID 2996 wrote to memory of 6060	2996	sqnifaysnl.exe	157
PID 5820 wrote to memory of 4808	5820	xrpjhczusecwuomh.exe	160
PID 5820 wrote to memory of 3116	5820	xrpjhczusecwuomh.exe	164
PID 6076 wrote to memory of 2024	6076	faxsqkicau.exe	166
PID 5820 wrote to memory of 1740	5820	xrpjhczusecwuomh.exe	169
PID 5820 wrote to memory of 3028	5820	xrpjhczusecwuomh.exe	173
PID 2076 wrote to memory of 2424	2076	hczxvsnkfa.exe	175
PID 5820 wrote to memory of 1120	5820	xrpjhczusecwuomh.exe	178
PID 5820 wrote to memory of 4404	5820	xrpjhczusecwuomh.exe	182
PID 6100 wrote to memory of 4092	6100	czusmkecwu.exe	184
PID 5820 wrote to memory of 1788	5820	xrpjhczusecwuomh.exe	187
PID 1240 wrote to memory of 5892	1240	msedge.exe	189
PID 1240 wrote to memory of 5892	1240	msedge.exe	189
PID 5820 wrote to memory of 2036	5820	xrpjhczusecwuomh.exe	195
PID 5652 wrote to memory of 4684	5652	wrpjhbzurp.exe	197

C:\Users\Admin\AppData\Local\Temp\2026-07-02_981d9ac36f5e545c55a8bb75282f85ef_amadey_darkgate_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_981d9ac36f5e545c55a8bb75282f85ef_amadey_darkgate_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3440
- C:\Temp\xrpjhczusecwuomh.exe
  C:\Temp\xrpjhczusecwuomh.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5820
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\romgeztrpj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3248
  - - C:\Temp\romgeztrpj.exe
      C:\Temp\romgeztrpj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4536
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6120
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4968
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_romgeztrpj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6004
  - - C:\Temp\i_romgeztrpj.exe
      C:\Temp\i_romgeztrpj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3368
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\euomgeywro.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4868
  - - C:\Temp\euomgeywro.exe
      C:\Temp\euomgeywro.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3740
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2688
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1280
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_euomgeywro.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4212
  - - C:\Temp\i_euomgeywro.exe
      C:\Temp\i_euomgeywro.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2476
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jdbytroige.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1572
  - - C:\Temp\jdbytroige.exe
      C:\Temp\jdbytroige.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4048
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5608
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6124
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jdbytroige.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5704
  - - C:\Temp\i_jdbytroige.exe
      C:\Temp\i_jdbytroige.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2092
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bvtnlgaysq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1748
  - - C:\Temp\bvtnlgaysq.exe
      C:\Temp\bvtnlgaysq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3060
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3352
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4736
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bvtnlgaysq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1764
  - - C:\Temp\i_bvtnlgaysq.exe
      C:\Temp\i_bvtnlgaysq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2608
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqnifaysnl.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5616
  - - C:\Temp\sqnifaysnl.exe
      C:\Temp\sqnifaysnl.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2996
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6060
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4272
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqnifaysnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4808
  - - C:\Temp\i_sqnifaysnl.exe
      C:\Temp\i_sqnifaysnl.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:676
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\faxsqkicau.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3116
  - - C:\Temp\faxsqkicau.exe
      C:\Temp\faxsqkicau.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6076
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2024
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5652
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_faxsqkicau.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1740
  - - C:\Temp\i_faxsqkicau.exe
      C:\Temp\i_faxsqkicau.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3092
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hczxvsnkfa.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3028
  - - C:\Temp\hczxvsnkfa.exe
      C:\Temp\hczxvsnkfa.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2076
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2424
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:932
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hczxvsnkfa.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1120
  - - C:\Temp\i_hczxvsnkfa.exe
      C:\Temp\i_hczxvsnkfa.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2508
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\czusmkecwu.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4404
  - - C:\Temp\czusmkecwu.exe
      C:\Temp\czusmkecwu.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6100
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4092
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5864
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_czusmkecwu.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1788
  - - C:\Temp\i_czusmkecwu.exe
      C:\Temp\i_czusmkecwu.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3736
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wrpjhbzurp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2036
  - - C:\Temp\wrpjhbzurp.exe
      C:\Temp\wrpjhbzurp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5652
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4684
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1076
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wrpjhbzurp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3512
  - - C:\Temp\i_wrpjhbzurp.exe
      C:\Temp\i_wrpjhbzurp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4848
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\omjdbwtomg.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4372
  - - C:\Temp\omjdbwtomg.exe
      C:\Temp\omjdbwtomg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:464
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5384
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3592
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_omjdbwtomg.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4728
  - - C:\Temp\i_omjdbwtomg.exe
      C:\Temp\i_omjdbwtomg.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5864
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ywqojgbztr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3420
  - - C:\Temp\ywqojgbztr.exe
      C:\Temp\ywqojgbztr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3052
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2636
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5944
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ywqojgbztr.exe ups_ins
    3⤵
    PID:1856
  - - C:\Temp\i_ywqojgbztr.exe
      C:\Temp\i_ywqojgbztr.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2092
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qoigaywqol.exe ups_run
    3⤵
    PID:5964
  - - C:\Temp\qoigaywqol.exe
      C:\Temp\qoigaywqol.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2056
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4736
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4200
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qoigaywqol.exe ups_ins
    3⤵
    PID:3552
  - - C:\Temp\i_qoigaywqol.exe
      C:\Temp\i_qoigaywqol.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2480
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fdxvqnigay.exe ups_run
    3⤵
    PID:4532
  - - C:\Temp\fdxvqnigay.exe
      C:\Temp\fdxvqnigay.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5864
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5880
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4272
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fdxvqnigay.exe ups_ins
    3⤵
    PID:2936
  - - C:\Temp\i_fdxvqnigay.exe
      C:\Temp\i_fdxvqnigay.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3532
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qnifaysqki.exe ups_run
    3⤵
    PID:5492
  - - C:\Temp\qnifaysqki.exe
      C:\Temp\qnifaysqki.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4452
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5552
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:708
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qnifaysqki.exe ups_ins
    3⤵
    PID:2324
  - - C:\Temp\i_qnifaysqki.exe
      C:\Temp\i_qnifaysqki.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1488
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvpnifaxsq.exe ups_run
    3⤵
    PID:3672
  - - C:\Temp\xvpnifaxsq.exe
      C:\Temp\xvpnifaxsq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3292
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:828
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1124
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xvpnifaxsq.exe ups_ins
    3⤵
    PID:1504
  - - C:\Temp\i_xvpnifaxsq.exe
      C:\Temp\i_xvpnifaxsq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6140
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pkhfzxspki.exe ups_run
    3⤵
    PID:4960
  - - C:\Temp\pkhfzxspki.exe
      C:\Temp\pkhfzxspki.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2600
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2088
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3576
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pkhfzxspki.exe ups_ins
    3⤵
    PID:4640
  - - C:\Temp\i_pkhfzxspki.exe
      C:\Temp\i_pkhfzxspki.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4260
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\czurpjhczu.exe ups_run
    3⤵
    PID:3944
  - - C:\Temp\czurpjhczu.exe
      C:\Temp\czurpjhczu.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1832
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6112
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:960
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_czurpjhczu.exe ups_ins
    3⤵
    PID:3104
  - - C:\Temp\i_czurpjhczu.exe
      C:\Temp\i_czurpjhczu.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5488
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wrojgezwro.exe ups_run
    3⤵
    PID:4580
  - - C:\Temp\wrojgezwro.exe
      C:\Temp\wrojgezwro.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6128
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2984
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4060
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wrojgezwro.exe ups_ins
    3⤵
    PID:2432
  - - C:\Temp\i_wrojgezwro.exe
      C:\Temp\i_wrojgezwro.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4912
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bwtrojgbzt.exe ups_run
    3⤵
    PID:2396
  - - C:\Temp\bwtrojgbzt.exe
      C:\Temp\bwtrojgbzt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:996
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1972
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2440
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bwtrojgbzt.exe ups_ins
    3⤵
    PID:5760
  - - C:\Temp\i_bwtrojgbzt.exe
      C:\Temp\i_bwtrojgbzt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6140
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:6056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffad497c188,0x7ffad497c194,0x7ffad497c1a0
      4⤵
      PID:3840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,10101977263969156146,2064467236808692550,524288 --field-trial-handle=2328,i,14909272247208842070,5613423909687755795,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:11
      4⤵
      System Time Discovery
      PID:5996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2452,i,16350441250998459604,14451601214768852134,524288 --field-trial-handle=2328,i,14909272247208842070,5613423909687755795,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:13
      4⤵
      PID:5496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,15156934702799499639,6218685529529981282,262144 --field-trial-handle=2328,i,14909272247208842070,5613423909687755795,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:2
      4⤵
      PID:6044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3592,i,8085583599191964174,8735391747358644802,2097152 --field-trial-handle=2328,i,14909272247208842070,5613423909687755795,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
      4⤵
      PID:5944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3612,i,13976646860846318934,8805129134593309292,2097152 --field-trial-handle=2328,i,14909272247208842070,5613423909687755795,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
      4⤵
      PID:2872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4356,i,4374726273930631380,8357919301736579081,2097152 --field-trial-handle=2328,i,14909272247208842070,5613423909687755795,262144 --variations-seed-version --mojo-platform-channel-handle=4588 /prefetch:9
      4⤵
      PID:628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4344,i,14621498158528035643,7269418798022363301,2097152 --field-trial-handle=2328,i,14909272247208842070,5613423909687755795,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:1
      4⤵
      PID:3348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,14769184744783773569,710942767548934195,524288 --field-trial-handle=2328,i,14909272247208842070,5613423909687755795,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:14
      4⤵
      PID:2632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,16143419550018795025,5138241963030546689,524288 --field-trial-handle=2328,i,14909272247208842070,5613423909687755795,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:14
      4⤵
      PID:5408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,2541343526500323712,18222654061907794430,524288 --field-trial-handle=2328,i,14909272247208842070,5613423909687755795,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14
      4⤵
      PID:1788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,12482520857184891466,17652736061918873988,524288 --field-trial-handle=2328,i,14909272247208842070,5613423909687755795,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:14
      4⤵
      PID:4200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,12482520857184891466,17652736061918873988,524288 --field-trial-handle=2328,i,14909272247208842070,5613423909687755795,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:14
      4⤵
      PID:4532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,12256185334582751304,8760469744704399895,524288 --field-trial-handle=2328,i,14909272247208842070,5613423909687755795,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:14
      4⤵
      PID:3864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6580,i,186260200788964002,10841927216082899430,524288 --field-trial-handle=2328,i,14909272247208842070,5613423909687755795,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:14
      4⤵
      PID:5708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,12110163732455087083,3153636021441479112,524288 --field-trial-handle=2328,i,14909272247208842070,5613423909687755795,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:14
      4⤵
      PID:1120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4588,i,16329506306186942305,4796186750923219476,524288 --field-trial-handle=2328,i,14909272247208842070,5613423909687755795,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:14
      4⤵
      PID:4604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4632,i,7868801868672655404,15517970435226439954,524288 --field-trial-handle=2328,i,14909272247208842070,5613423909687755795,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:14
      4⤵
      PID:2732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4632,i,17116724195681228192,10592853968136803687,524288 --field-trial-handle=2328,i,14909272247208842070,5613423909687755795,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:14
      4⤵
      PID:5892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5568,i,15633756958130964060,4505472002989032741,524288 --field-trial-handle=2328,i,14909272247208842070,5613423909687755795,262144 --variations-seed-version --mojo-platform-channel-handle=3244 /prefetch:14
      4⤵
      PID:1804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5572,i,16629297245699845289,15524723130684813286,524288 --field-trial-handle=2328,i,14909272247208842070,5613423909687755795,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:14
      4⤵
      PID:1364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5632,i,12415638658040003265,2004907641167913800,524288 --field-trial-handle=2328,i,14909272247208842070,5613423909687755795,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:14
      4⤵
      PID:5828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5620,i,2721184695539531361,17685737810234978350,262144 --field-trial-handle=2328,i,14909272247208842070,5613423909687755795,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:10
      4⤵
      PID:4448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,5847411723273439765,8707701612333261923,524288 --field-trial-handle=2328,i,14909272247208842070,5613423909687755795,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:14
      4⤵
      PID:1684

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1076

C:\Temp\xrpjhczusecwuomh.sys
C:\Temp\xrpjhczusecwuomh.sys
1⤵
- Executes dropped EXE
PID:3192

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4856

C:\Temp\mgezwrojhb.sys
C:\Temp\mgezwrojhb.sys
1⤵
- Executes dropped EXE
PID:6020

C:\Temp\mgeywqojgb.sys
C:\Temp\mgeywqojgb.sys
1⤵
- Executes dropped EXE
PID:2184

C:\Temp\ytqoigbytq.sys
C:\Temp\ytqoigbytq.sys
1⤵
- Executes dropped EXE
PID:1512

C:\Temp\davtnlfdbv.sys
C:\Temp\davtnlfdbv.sys
1⤵
- Executes dropped EXE
PID:3300

C:\Temp\qnifdxvqni.sys
C:\Temp\qnifdxvqni.sys
1⤵
- Executes dropped EXE
PID:560

C:\Temp\icausmkfcx.sys
C:\Temp\icausmkfcx.sys
1⤵
- Executes dropped EXE
PID:1680

C:\Temp\zurpmkecwu.sys
C:\Temp\zurpmkecwu.sys
1⤵
- Executes dropped EXE
PID:5460

C:\Temp\ecwuomhezx.sys
C:\Temp\ecwuomhezx.sys
1⤵
- Executes dropped EXE
PID:5848

C:\Temp\wromkebzwr.sys
C:\Temp\wromkebzwr.sys
1⤵
- Executes dropped EXE
PID:4912

C:\Temp\ywqojgeywr.sys
C:\Temp\ywqojgeywr.sys
1⤵
- Executes dropped EXE
PID:4272

C:\Temp\olgebvtqol.sys
C:\Temp\olgebvtqol.sys
1⤵
PID:4240

C:\Temp\oigaysqlid.sys
C:\Temp\oigaysqlid.sys
1⤵
PID:6140

C:\Temp\gayvqnifay.sys
C:\Temp\gayvqnifay.sys
1⤵
PID:5872

C:\Temp\xvpnhfdavs.sys
C:\Temp\xvpnhfdavs.sys
1⤵
PID:1932

C:\Temp\mkecaxrpkh.sys
C:\Temp\mkecaxrpkh.sys
1⤵
PID:1392

C:\Temp\kecwupmhez.sys
C:\Temp\kecwupmhez.sys
1⤵
PID:2268

C:\Temp\hezxrpjhcz.sys
C:\Temp\hezxrpjhcz.sys
1⤵
PID:1896

C:\Temp\bwtrpjgebw.sys
C:\Temp\bwtrpjgebw.sys
1⤵
PID:5028

C:\Temp\dbvtolgeyw.sys
C:\Temp\dbvtolgeyw.sys
1⤵
PID:3616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bvtnlgaysq.exe

Path C:\Temp\bvtnlgaysq.exe
Size 384KB
SHA256 5bf0aec2252a887cb706e4eb6932de38c8cefb94fa288e2e39192db2aa2b2f05
MD5 29afdd2480163145723f989b23b5c59e
SHA1 5d9e554ae60e12ff0b21de65c3f27781108e5861
SHA512 55b47c28a4bf349e48c4e381ccdddce51dcadf8ba1349e2a0d81625a0e2ed872338ce056614983480931ec11cd04ea4fa89c0f84cf0f5a93eac3dc728b96f26d
SSDEEP 3072:59ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:TctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1CF847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

davtnlfdbv.sys

Path C:\Temp\davtnlfdbv.sys
Size 293KB
SHA256 6806f7d2e1ced91353be58cd1e4c62604beb538368057fa2b5c92746b9d3cceb
MD5 c351477e87eec4f905145f91063fe36b
SHA1 23895f36188c8e24f1caff568f4a19ae09fac773
SHA512 a291d26a8d4af57710408932d9b1260962e5626bf24e153d93a21c0c0da2154268152a922816ca0dc2e22f4b2962ceea85b5c8e95959484fbb1255b71dc295f4
SSDEEP 3072:wtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:wIJjiJcbI03GBc3ucY5DCSj
TLSH
T12F545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

euomgeywro.exe

Path C:\Temp\euomgeywro.exe
Size 384KB
SHA256 93c454820a003e2d44428cd70554d3680e2ce1226142fac6339631f2c09b801a
MD5 62d3db3564bbbe04b57a981b5481ee2b
SHA1 8cfd80c8141792635c0c59c82a34f699f3afa9df
SHA512 593a8f7ed9724c004d78e16bd84e68fa4b45a320dd1d7f63aae8b950f2df1f62967bd930927c0c34163834d339d25a046a70b3051e20a5ddf63bf7be094dcb86
SSDEEP 3072:N9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:fctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F4847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

faxsqkicau.exe

Path C:\Temp\faxsqkicau.exe
Size 384KB
SHA256 7df11880d05a47a9244aae88ef98fe22f0e6bc93989ae909e67253dff970f094
MD5 aab3e29cd7e7f6664367087048b0e701
SHA1 18aa1e386a498323903944ac0343b01684cd2334
SHA512 2619288da3727a150460847237f31f9bc7b3c19d378667ed1122a3cb3749cdab4af5513423a896d10edd9497a2d58f4b657007ec8515c0ab6a7239ce975ca564
SSDEEP 3072:A9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:SctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T12A847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bvtnlgaysq.exe

Path C:\Temp\i_bvtnlgaysq.exe
Size 384KB
SHA256 67c9ecd1250a6e2ee80e2b9120a6e78a4d8e10532427112e36dcd640e17e938b
MD5 f683c05b9140cadb5b1a115960da79e9
SHA1 718626897b2ae9af5c4de5db836b93a25e8d1a28
SHA512 b05b6f4d84c235a5f0caad6d1d91d0e286e180b509b7b717b4733dcb94f2c30f49cc6349b69784a4322a57e5f7c9846e621a12352e5d2772c4eb13d44179c26f
SSDEEP 3072:j9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:BctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T19E847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_euomgeywro.exe

Path C:\Temp\i_euomgeywro.exe
Size 384KB
SHA256 e6a4d9a08d744d729452439ab7c0167d7c33626608c845fe701d69be807e05a3
MD5 e4bd19d098dc0c9b42b21c0387b85642
SHA1 d7198b55ca4e2d047b4a8acec018f5e29a031a15
SHA512 cc41a34b10931e9e8423a497697b62117cd988ea24ef16e81c02b3646a4ae9d76d351fa714c117f7c350d821ddc86aba3b58f7af81789257a04d11f696825fa6
SSDEEP 3072:V9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:3ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D2847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jdbytroige.exe

Path C:\Temp\i_jdbytroige.exe
Size 384KB
SHA256 b4659c238684602fe07d7174cc8c2ed2be178318f7566e45b3ab60808400c66c
MD5 7de27fc878b87ddc59293cfae4867a7f
SHA1 2233654e6ee8226d66761edc220038336873600d
SHA512 b9f8efa685392de2b27c27772fbffd289ae8e9a28ccccdbc8d78b4bc1131caa65c5f582e8a6b0bade0e1f8ae174dd2aefa1f5e539f2cb7a314ba0f0f33ced3a1
SSDEEP 3072:n9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:9ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1AD847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_romgeztrpj.exe

Path C:\Temp\i_romgeztrpj.exe
Size 384KB
SHA256 e832117b8c1c55d73f453b7f706555057e33697f9e4ee4bb67957ba2d40b9a0a
MD5 42453611f09b0d27c544cc3ce3d2264c
SHA1 66de85ec5c3b993f2fbdd88928863e7707da06df
SHA512 97050ae71bd55736683b2e6dbc6bafe664bf620d570c06528df05e523b123c5ccb4dfa5570b93eea8a8856fb9058e355827ebc505d1a3d6252c75b20fe9340c4
SSDEEP 3072:w9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:CctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1CA847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_sqnifaysnl.exe

Path C:\Temp\i_sqnifaysnl.exe
Size 384KB
SHA256 539596a58364336a00cf877d73667182234f2a674e470eca47f78bfa160d8be2
MD5 def5b4f8e00c61889311c8b9cd2a2ec9
SHA1 170a74c82192ac79e8dccca2dc0d75cf3b816af2
SHA512 588405fe71c8ac1a6669da43e84cd2c9b7d62e4a0d407107a725bb6b8d09cdeb38393cfc641607d56b46a11a64e98633ebaaa85c6bf8ad3a9021c861b627e882
SSDEEP 3072:j9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:BctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T17F847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdbytroige.exe

Path C:\Temp\jdbytroige.exe
Size 384KB
SHA256 c4b208083a4a939647a72a69bbe1011a77eb6197d6d71e6479f5dbc727690ab6
MD5 1d87cfb6e2e38d23042d67f6661c0fde
SHA1 735fbe1745b77ff488648ba6c17e0f05cffb0f58
SHA512 0b6c57699da5c96f23d07e557be89670e9098ae0e290390dbcb05ffae77f304631f03cf9fa0a057f51137c004855cc11a85f2dff5f6f09d94509dbcc2228296d
SSDEEP 3072:l9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:HctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T190847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mgeywqojgb.sys

Path C:\Temp\mgeywqojgb.sys
Size 293KB
SHA256 692bc4185a2c10e30e211fff7ba9f0a4de69630369f01c2b444065eeb27d468a
MD5 0f5337c0d5906468e40321fd92cf1747
SHA1 fbcc3559e9a2a19e6ba70d5a776c5b4e834add7b
SHA512 b94ae74a6f41930d9313261135a766e32775372dce01808559da2ae6fab8c2740d6a9c03bcff5066c954061765edd8c7587a94b06960064a86bcdb0b136fc79b
SSDEEP 3072:ftKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:fIJjiJcbI03GBc3ucY5DCSj
TLSH
T1D1545B44AAA4B0F6D9D5043C40EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mgezwrojhb.sys

Path C:\Temp\mgezwrojhb.sys
Size 293KB
SHA256 8e7183c432135ac5268f55eb378ee692a160268dbd3fe380867dc92281d27b8a
MD5 95d6f9eceb3ca70f8f46221f6d8334e4
SHA1 a59cddefcaba63f3d54b0c9b75df96917dcde0e2
SHA512 8d9e1edd9e664574fb85b84944e10332ea6bfa015f8f1f95786daae9706110274a87079f953769dd994791636111ce05e82b2497fe5bf2826c8b957400096572
SSDEEP 3072:+tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:+IJjiJcbI03GBc3ucY5DCSj
TLSH
T16E545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qnifdxvqni.sys

Path C:\Temp\qnifdxvqni.sys
Size 293KB
SHA256 0540ada621ae309fae516981fd6a1021df9e75cb94157c978e3a536fa5c97889
MD5 0952804f0e1ce9f85407e6a52a3c9db9
SHA1 1d6c2715899c5242551b26913f1bbdfc585c7e75
SHA512 653a22b24faad42119553b54686ce8d3236842835c900c997e4402df12f2627862b353f5b8c2d4f06d406a37cbf75c010d636cc239cc289daa8caa423b99f137
SSDEEP 3072:OtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:OIJjiJcbI03GBc3ucY5DCSj
TLSH
T1B3545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

romgeztrpj.exe

Path C:\Temp\romgeztrpj.exe
Size 384KB
SHA256 c5891eba70a0d11ad54d91a2cf050ccaf81118ebf87ed13a9ce35cd01b38be60
MD5 721bc4cafbccae3c8c15e5be44858c34
SHA1 53811c534e8fc620588bef86137f5dfa7350bdc8
SHA512 0650c21f00ea66a06e6ec51002b66e0d48425e746138e7c147946d1a09e458a59e750c029dd83f3329b003ab8db98cf2796d37a0e09993edc380571c55aad286
SSDEEP 3072:c9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:mctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T18B847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqnifaysnl.exe

Path C:\Temp\sqnifaysnl.exe
Size 384KB
SHA256 77e4f961263ec55b8caca1b6ab98ae040d3a33becbc399cf3717e1c219d90201
MD5 ec0a12dac51fdb2d17f61be093ce5127
SHA1 9850cb786d520aa26428eff78f228dde973dc6ca
SHA512 c07a162beead87bc40a00219e291b004aa7de4744698bf439b929cbdfc8ded701ffdaba5688e55f644e21df345e292f6b46a0b9403a0778c1d2e1f5caee73800
SSDEEP 3072:09ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:OctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D1847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xrpjhczusecwuomh.exe

Path C:\Temp\xrpjhczusecwuomh.exe
Size 384KB
SHA256 df2332c842f01e8ca3456a17d248e3c8f898bbb1bcf46c1fc09f90a1da7e6949
MD5 8cd22c0b2da921890e01eb4403c2ccbf
SHA1 32f561cd4f87f4b0548e5da25c47096738009fec
SHA512 fd5c016d275425534e233e8eef97468dda796228a3f881b143392465a9e162e92de2309be174f7595d55aace64d3a1211281ebcb1e12e3f11b7e372b619f30cd
SSDEEP 3072:Q9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:ictFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T154847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xrpjhczusecwuomh.sys

Path C:\Temp\xrpjhczusecwuomh.sys
Size 293KB
SHA256 4e2814848918e6a50bef939410a12e6d4debd6f3bb0c208c3d113140d38e213a
MD5 693c86f12f383c7c31d11b9d2a268271
SHA1 f3a0c661ef131c1ec1ae5e4c1609018277ed1ecc
SHA512 f0c5b6f4cbbb73924f0d7de592b12b0b41435a3229720282770bcaaaaee9dd63522b58a1aa5deba53846e0c44a0555dabd9a8fb764d2346dbd6269997d2ddfb4
SSDEEP 3072:WtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:WIJjiJcbI03GBc3ucY5DCSj
TLSH
T12E545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ytqoigbytq.sys

Path C:\Temp\ytqoigbytq.sys
Size 293KB
SHA256 12aea84205349ef9a4f0ecd20ceda7de27d2f190b16b8c8a0e4fa5e828fdd628
MD5 caa63badb9cc674427127477a896a7f4
SHA1 b9fa5c3ff8f2bd80a1c79b3a4d594a4955da03aa
SHA512 7739dc4d426aa520506dc8f7853789a29ad5528423e5c6ddd5926b69ff7e13ac03d63fea3c31584eeed94b3b071b7c348a98daaa81fb8bff083670598ccb76e5
SSDEEP 3072:utKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:uIJjiJcbI03GBc3ucY5DCSj
TLSH
T196545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 233c07bfff48b5fbad30cd7d90579abd0886400017cd6e7fb037e5626abb1a4d
MD5 71fa6328268340b183c55defa643c474
SHA1 7c004defb21dc2981b3091495c900e02b34e3a86
SHA512 e5b634d358633981cd343c3da26ee18738fb6c54b2334814637e0a9a45343d14770fed7a09c63d55dd190bf7ef111664ba5872f5d5ce925e6bee783e166c75b7
TLSH
T1D4D080F437A5F505C786617357D0574173650872101647095151D02CCC645DD63DB1DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2fd9384e79508a77111bb6310e9414898358885ca508610502ff6f1a15ad704f
MD5 714e68787bb5a6d2fd82139f833a5d0d
SHA1 f7a22adc92641d05515b3ae096da910924f11c1a
SHA512 b133f27abfa4ed5bdbd3eaf997e0664f0627537d4882fdaa63c0b1b301219d07f8ba46857db9a196b1210c29ed9f79e6cfd8c688d502b118a21640805665f762
TLSH
T16DD080F43795F605C786617357D0574173750872241647095051D01CCC645DD63DB1EF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 89b655b0c0c27c9e59df61a5983b30d382d35d8e04d08aa6c30d58b0e44bdfec
MD5 07b2ca2a494bc84847bf87fd3e348c53
SHA1 9f3a5f36fc1c8cfc019cfcd671fcb5e904b8b767
SHA512 1cb2fe3219c537e99bd25215a1a96b2ae9805b239cad310c0ced443d0ebb9f47877e28a639e868948b2cf6035e63c3649137b2151b190fcb38594b836c2c2798
TLSH
T17061A42503C716A3DF7F87B143D3A3A73F74809E4987BD08AB54B974AA0AB2D9253120
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe597ff4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe597ff4.TMP
Size 3KB
SHA256 9ac10f920ef1cace68133db337269aec08637740e40457411d236fb89966641b
MD5 0e778f9d36e8950481e609ae0bd8ae03
SHA1 b244161fb52ecb00854027d5d39c2c51d2bc9f2b
SHA512 ae1915560672b47cfe7389f21024a904f5e905a41221f47f5713e6dbef5cc4efd429871ec0cf744aea95234b4f93c8c2ec9ab429f6a07ee8fa0cbbfebea33ea1
TLSH
T1D261A42503C716A3DF7F87B143D3A3A73F74809E4987BD08AB54B974AA0AB2D9253120
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 791a8b2ba1e2f1682ffe3c1872a359f12c2f9fe039117b7e1c43976b42c1fa66
MD5 334f558223cf6eabc311a86c9f5fdbb1
SHA1 5c859cf1cc47f0efb44faf38ca0f3af528c7fc87
SHA512 9ed692f0efd7b417928d705ff06e7504a3541a81f9e6035c23b0796bfe2ec963c134be76cfe09870da45cf56a1b09ae572d55945c44e43f5ee69bbaa76b6a04e
TLSH
T13B51BCF7C7E8863E890156F0BB186E2BCE2D0914832C7D5AC9E4AF1B97E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 fc30f60aba9733f0a5a26e24696363ff2c86f167b9bfe8a5748d87080636edbe
MD5 2f28fcbfd8c54a228c5639efa6045609
SHA1 395bb54d64b0ba12e607487f7892a8b6ce7c3c6f
SHA512 81fbefda58311181b0aecd051f6a8c03e06aa9d7d2626f8491505d67554312f8fa12bfb0e78cb504b37322b6114751e4f2d9a804ec9ec7937e0134a241f216a9
SSDEEP 192:sxRXRsyM/jK1Ml8wcK/f6sbkfbeZDkzoA8p93y/g6+WNCZI+/YypJuGDPIgtJ:sxRXSCK/f6sbyYDFNy/5y1/193
TLSH
T1C362C7556A34597B8CCBD209FA517F53D6F81573A2901E08AEFC8A0C41E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 7d2a79f0c36677f9136df139b299f2827890ebd24235912938b068506a1b53ec
MD5 fbcb4b412aabbe8be0a773760f1eef3b
SHA1 0300117c1115036693a6f08926c2d89a2f9df0ce
SHA512 5d9655fcfa16aa3c149d4963b30012a8d24d0c78098fb20be65ad1d17b9be71419d9634a5fb0798d2a802a52e3807e30116a26607001e57c4b90af51c30bb143
SSDEEP 192:sxRURsyM/jK1Ml8wcK/f6smkfbeZDkzoA8p93y/g6+WNCZI+/YypJuGDPIgDpJ:sxRUSCK/f6smyYDFNy/5y1/19H
TLSH
T1DE62C756AA34597B8CCBD309FA517F53D6F81572E2901E08AEFC8A0C01E76DD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 19e4154fedfdc1a8e58e55b15280b4e46fa3b9407b26b45e57c616f4fb7900c6
MD5 01acbb2530645cf904b4e7ec24091cd0
SHA1 598f7898da1a38fe43f5e045092a272b433b8bf3
SHA512 2790e4993b92979f73dd63b4687f79668dc061e9d267bf8c5bc4c79d11385a253c62beede3eb19b1a4e091d1e683676c18742378a0dac000d68579d217363a39
SSDEEP 192:sxRURsyM/jK1Ml8UQ1cK/f6smkfteZDkzoA8pr3y/g6+WNCZI+/YyeJuGDPIgDrJ:sxRUSq6K/f6smkYDFjy/5y1/K9h
TLSH
T16062C756A93499778CDBD309BA517F53D6F91572E2901E08AEFC8B0C01E7ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 cb826a69b7c7e0372589cfb415b6cf721efb5293f3072c1410bebbbc936684bd
MD5 f27f7aadb9e72228400fa3234941ec20
SHA1 28c6715a2d481f2dd0e24dc7af043988f9dc2e33
SHA512 3561ab0ce8b413cb712dafc889c3190d9c29631d89627da13e9a17c9e03bb9530bc9edada610698e286c94a50f7b2a24f5da6a4ce642d63735a3c39525b224ee
SSDEEP 768:AIox/O7pLuL7p0WguMfnA8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYGgcciQro5JDl1:AIox/OE7p0WguMfnAu1janGgXi75FP
TLSH
T14EE2EB3B680CCB7F4F804ADCEC29BE9A6DA801CF96D8CD5447FA841C03C66EB55165DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 0579fd41d1945384e1dbfcbb15ec37b1fa87217ff8b5cb692e425ebc3a4676b8
MD5 0e8219e1e658034c2d4d2c81f52363ee
SHA1 6000eba966e077c6f8430e4d7de44c6ddc0f9156
SHA512 596c91b12537d51b8240f0df6a0f04b7f7a66f204ec8e23a56a9c020dd715b799bfbe5ffd8b9b1aa0a341a681df2b3f305f65732a183be6b5ab9eda95bbd0b78
SSDEEP 96:KIHOKwQGGJKKiwyFSr/VPTXWbAOgHXK42gZXc9lYrj8HT8ZNbRRtWi:oddRFSr/VPTmbAvHN2gZM9lYrj8HT8ZZ
TLSH
T1F5917511327A2744383F37198369882F868275B2349AF42F3BE811A51F2BE155DFDACD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d5a8e454-e807-48e9-92e8-95a5ba8c3ee2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\d5a8e454-e807-48e9-92e8-95a5ba8c3ee2.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 b0645eccb54896741a0f5eca94e901a8b716b06ef6eae718ae6da899d9f340cb
MD5 25a6b0a3e062365c1fb5011d228ac935
SHA1 4f5f1ed39f6991dae801953e74fe2d1de4ac00d1
SHA512 14576d8c3e1017b21009403f21b0c2002167e44676e5d57d06670b26e0d6f948c766458ab59527c1d1740f365871f5daef597c9d964e032bc63b10eebde81a8a
SSDEEP 768:3j+973l108YQOJIFciL/hUAFjQIMyOV3N5E9E5Dl8BvTPajwm:6973znhNFUIpONNmoDl0Wjwm
TLSH
T135F2AEB1A8A19EA74CE7E3C5B7163687AFE4017794C11E88CADDAB0D418338D175BC39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 56d66ee3659554ac9d0538e07e72a0763f214e5c8e5c85c7c3746b1bfe632ea1
MD5 375b77ba0205661dd1d254c45da385c5
SHA1 1c6ab37f2d367b7250264810316c79f12b0876eb
SHA512 604d355e4f3ac109da36cd8912fbc0457dbc37c2cf44d421b3badf2d8385c7ea8c5eccc34443226e26fb876999082bc4e71bbab4201bc0b297830f9e089afff7
SSDEEP 768:9rv+4UNbdF3JEOQOJIFcQ/hUAFjQIMyOV3N5E9MSr+8r0mL:9bsbf3WhNFUIpONNmzDrv
TLSH
T1A903BF32E8A4DAB39CE7D7C5760A72437FF441A395C50A84C9DE2B0D824B1DE231BC62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 5580cc18680c475213516fdd9ccfdcdd709a934d05e6b92bec9cb145a2d28941
MD5 5c0b8910e3887d9f1b4511f652000fee
SHA1 e699b8ee480aab9d024f17db4c387c7a679f5306
SHA512 5d81f11a2f6564f8f1a98666e13db6a584c1e4a29340ec04d3a2d0946aadcc0ee0413d7c82297dd5f3e0a4b40ba2cb0da46c9323b6aa23c0994ab4b706daa461
SSDEEP 768:Cj+973k10fYQOJIFciL/hUAFjQIMyOV3N5E9E5Dl8BvTPajwm:x973WGhNFUIpONNmoDl0Wjwm
TLSH
T179F2AEB1A8A19EA74CE7A3C577167687AFE4017394C11E88CEDDAB0D418338D175BC39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 f15fbec00c30e0b2247784b62b7139c4f733e7892f084f209185328b6eef52cb
MD5 228e4505439f5bf19bbcab5e959b76a8
SHA1 77bbee5e2941c2e403bd65bb209060e1c5732a17
SHA512 3968d2fe70854f34f43c52b6862a3ea80db213b53fb8d2148bfe15c8d08a7fb7ce156083b8809166e0782cce0c82ac4c7a0dcb8761bc1a95247fe8241888b743
SSDEEP 768:1F1j+9i3fwgl10OFrOJIFcir/hUAFjQIMyOV3N5E9E5Dl8BvTPajwm:c9i3lVhNFUIpONNmoDl0Wjwm
TLSH
T1F31329F198D3CA76D8AE9787673D6D469AFCC16374845884BBC95E0CCC822BFC346825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1240_254887182\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 8e7f6e3f0c08278e50a82c9decbd831a03c3f74294f04766b757d004ef6fc7b1
MD5 a38663621a98f59302bd0f54f4dc196c
SHA1 46d629135a460a9b8eb96f4d55739b0891b75835
SHA512 73c2238e8e5b94a36e522b02c7a4a444b5f150bc1cfa2424639119c6d3d75a8dd0aa53c0c96ecde30b3143cfec4978be080b40e3d9eb116325b4bfd26aa55f18
TLSH
T12A7123835AB9DAF3C5DA5BF002C35648F1FF223C072330710B555546AB30A7A18B8F08
MD5 SHA1 SHA512 TLSH

Submit Download

memory/560-315-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/560-326-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1392-453-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1512-272-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1512-286-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1680-324-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1896-478-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1932-442-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2184-244-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2268-458-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3192-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3300-284-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3616-507-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4240-398-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4272-377-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4912-379-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4912-348-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5028-490-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5460-329-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5848-344-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5872-422-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6020-197-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6140-418-0x0000000000010000-0x00000000000AB000-memory.dmp

Download