systex | 184c9a669c7205e131547a697fde2895c7ced9e11c7751093559a7357c53a91c

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 16:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-10_d51b1682a569d7e080a55cd97f4575ee_amadey_darkgate_elex_smoke-loader_stop.exe
Size 384KB
Sample260710-th3rcaey7w
SHA256 184c9a669c7205e131547a697fde2895c7ced9e11c7751093559a7357c53a91c
MD5 d51b1682a569d7e080a55cd97f4575ee
SHA1 1b59313fe1d303c45506f7750d63626c434e8029
SHA512 d91b195eac245e6ca59de14dd3812bdd757a2adcafe5e7a1b4bcff3d32f552843029cf11a17c8eb7a90db54ee8c6d378051cf39e1fd838d33791f8fcfbda89ad
SSDEEP 3072:79ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:pctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T142847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
5992	geywuomgeywtrmje.exe
3188	geywuomgeywtrmje.sys
4344	CreateProcess.exe
2880	ljebzuojhz.exe
4280	CreateProcess.exe
3324	CreateProcess.exe
4992	i_ljebzuojhz.exe
5420	ywrojgbytq.sys
4360	CreateProcess.exe
940	qoigeytqoi.exe
1372	CreateProcess.exe
2552	CreateProcess.exe
5212	i_qoigeytqoi.exe
1868	idbvtnlfdy.sys
2060	CreateProcess.exe
5140	vtnlfdyvqo.exe
2404	CreateProcess.exe
4176	CreateProcess.exe
6084	i_vtnlfdyvqo.exe
1852	lyvqnlfaxs.sys
1456	CreateProcess.exe
6000	vsnlfdxvqn.exe
5432	CreateProcess.exe
3160	CreateProcess.exe
6004	i_vsnlfdxvqn.exe
3392	nifaxvpnif.sys
1708	CreateProcess.exe
1548	sqkicausnk.exe
1980	CreateProcess.exe
2556	CreateProcess.exe
4204	i_sqkicausnk.exe
3716	dxusmkfdxv.sys
836	CreateProcess.exe
3356	smkicxusnk.exe
3800	CreateProcess.exe
4196	CreateProcess.exe
1480	i_smkicxusnk.exe
6084	zxrpnhfzxu.sys
5384	CreateProcess.exe
2708	zurpnhfcwu.exe
2604	CreateProcess.exe
2288	CreateProcess.exe
1948	i_zurpnhfcwu.exe
2144	pmhezwrpjh.sys
5972	CreateProcess.exe
2484	hezurmkecw.exe
1880	CreateProcess.exe
5380	CreateProcess.exe
724	i_hezurmkecw.exe
4508	trmjecwuom.sys
1244	CreateProcess.exe
4868	jgbztrljdb.exe
3944	CreateProcess.exe
1500	CreateProcess.exe
3364	i_jgbztrljdb.exe
4340	jhbztrmgey.sys
3140	CreateProcess.exe
1852	bwqojgeywt.exe
5536	CreateProcess.exe
5872	CreateProcess.exe
1268	i_bwqojgeywt.exe
3000	ljgbytqoig.sys
1984	CreateProcess.exe
3788	ljdbytrljd.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping412_1145293889\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping412_1988012999\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping412_17204805\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping412_17204805\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping412_1145293889\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping412_1145293889\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping412_949457391\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping412_949457391\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping412_1145293889\llm_user_input_extractor_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hezurmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ojgeywrlje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigeytqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnlfdyvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgbztrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbytrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causnkfvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causmkecxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbytrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaysqkigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-10_d51b1682a569d7e080a55cd97f4575ee_amadey_darkgate_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljebzuojhz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hezurmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urmkecwusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojgeywrlje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtomgeywrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsnlfdxvqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojgbywqolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ojgbywqolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkicxusnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gaysqkigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_causnkfvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkicausnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smkicxusnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwqojgeywt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_causmkecxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtomgeywrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgbztrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywuomgeywtrmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljebzuojhz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigeytqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkicausnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zurpnhfcwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnifcaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urmkecwusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlfdyvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsnlfdxvqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zurpnhfcwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwqojgeywt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnifcaus.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5488	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1760	ipconfig.exe
5580	ipconfig.exe
2356	ipconfig.exe
2536	ipconfig.exe
5672	ipconfig.exe
5456	ipconfig.exe
5304	ipconfig.exe
3136	ipconfig.exe
5176	ipconfig.exe
836	ipconfig.exe
5788	ipconfig.exe
5024	ipconfig.exe
5420	ipconfig.exe
2972	ipconfig.exe
4140	ipconfig.exe
3060	ipconfig.exe
6016	ipconfig.exe
4336	ipconfig.exe
3240	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134281730740269096"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{B983735A-535C-4AE0-BA11-73E245294A2E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1012	2026-07-10_d51b1682a569d7e080a55cd97f4575ee_amadey_darkgate_elex_smoke-loader_stop.exe
1012	2026-07-10_d51b1682a569d7e080a55cd97f4575ee_amadey_darkgate_elex_smoke-loader_stop.exe
1012	2026-07-10_d51b1682a569d7e080a55cd97f4575ee_amadey_darkgate_elex_smoke-loader_stop.exe
1012	2026-07-10_d51b1682a569d7e080a55cd97f4575ee_amadey_darkgate_elex_smoke-loader_stop.exe
1012	2026-07-10_d51b1682a569d7e080a55cd97f4575ee_amadey_darkgate_elex_smoke-loader_stop.exe
1012	2026-07-10_d51b1682a569d7e080a55cd97f4575ee_amadey_darkgate_elex_smoke-loader_stop.exe
1012	2026-07-10_d51b1682a569d7e080a55cd97f4575ee_amadey_darkgate_elex_smoke-loader_stop.exe
1012	2026-07-10_d51b1682a569d7e080a55cd97f4575ee_amadey_darkgate_elex_smoke-loader_stop.exe
1012	2026-07-10_d51b1682a569d7e080a55cd97f4575ee_amadey_darkgate_elex_smoke-loader_stop.exe
1012	2026-07-10_d51b1682a569d7e080a55cd97f4575ee_amadey_darkgate_elex_smoke-loader_stop.exe
1012	2026-07-10_d51b1682a569d7e080a55cd97f4575ee_amadey_darkgate_elex_smoke-loader_stop.exe
1012	2026-07-10_d51b1682a569d7e080a55cd97f4575ee_amadey_darkgate_elex_smoke-loader_stop.exe
1012	2026-07-10_d51b1682a569d7e080a55cd97f4575ee_amadey_darkgate_elex_smoke-loader_stop.exe
1012	2026-07-10_d51b1682a569d7e080a55cd97f4575ee_amadey_darkgate_elex_smoke-loader_stop.exe
1012	2026-07-10_d51b1682a569d7e080a55cd97f4575ee_amadey_darkgate_elex_smoke-loader_stop.exe
1012	2026-07-10_d51b1682a569d7e080a55cd97f4575ee_amadey_darkgate_elex_smoke-loader_stop.exe
1012	2026-07-10_d51b1682a569d7e080a55cd97f4575ee_amadey_darkgate_elex_smoke-loader_stop.exe
1012	2026-07-10_d51b1682a569d7e080a55cd97f4575ee_amadey_darkgate_elex_smoke-loader_stop.exe
1012	2026-07-10_d51b1682a569d7e080a55cd97f4575ee_amadey_darkgate_elex_smoke-loader_stop.exe
1012	2026-07-10_d51b1682a569d7e080a55cd97f4575ee_amadey_darkgate_elex_smoke-loader_stop.exe
1012	2026-07-10_d51b1682a569d7e080a55cd97f4575ee_amadey_darkgate_elex_smoke-loader_stop.exe
1012	2026-07-10_d51b1682a569d7e080a55cd97f4575ee_amadey_darkgate_elex_smoke-loader_stop.exe
1012	2026-07-10_d51b1682a569d7e080a55cd97f4575ee_amadey_darkgate_elex_smoke-loader_stop.exe
1012	2026-07-10_d51b1682a569d7e080a55cd97f4575ee_amadey_darkgate_elex_smoke-loader_stop.exe
1012	2026-07-10_d51b1682a569d7e080a55cd97f4575ee_amadey_darkgate_elex_smoke-loader_stop.exe
1012	2026-07-10_d51b1682a569d7e080a55cd97f4575ee_amadey_darkgate_elex_smoke-loader_stop.exe
1012	2026-07-10_d51b1682a569d7e080a55cd97f4575ee_amadey_darkgate_elex_smoke-loader_stop.exe
1012	2026-07-10_d51b1682a569d7e080a55cd97f4575ee_amadey_darkgate_elex_smoke-loader_stop.exe
1012	2026-07-10_d51b1682a569d7e080a55cd97f4575ee_amadey_darkgate_elex_smoke-loader_stop.exe
1012	2026-07-10_d51b1682a569d7e080a55cd97f4575ee_amadey_darkgate_elex_smoke-loader_stop.exe
1012	2026-07-10_d51b1682a569d7e080a55cd97f4575ee_amadey_darkgate_elex_smoke-loader_stop.exe
1012	2026-07-10_d51b1682a569d7e080a55cd97f4575ee_amadey_darkgate_elex_smoke-loader_stop.exe
1012	2026-07-10_d51b1682a569d7e080a55cd97f4575ee_amadey_darkgate_elex_smoke-loader_stop.exe
1012	2026-07-10_d51b1682a569d7e080a55cd97f4575ee_amadey_darkgate_elex_smoke-loader_stop.exe
1012	2026-07-10_d51b1682a569d7e080a55cd97f4575ee_amadey_darkgate_elex_smoke-loader_stop.exe
1012	2026-07-10_d51b1682a569d7e080a55cd97f4575ee_amadey_darkgate_elex_smoke-loader_stop.exe
1012	2026-07-10_d51b1682a569d7e080a55cd97f4575ee_amadey_darkgate_elex_smoke-loader_stop.exe
1012	2026-07-10_d51b1682a569d7e080a55cd97f4575ee_amadey_darkgate_elex_smoke-loader_stop.exe
1012	2026-07-10_d51b1682a569d7e080a55cd97f4575ee_amadey_darkgate_elex_smoke-loader_stop.exe
1012	2026-07-10_d51b1682a569d7e080a55cd97f4575ee_amadey_darkgate_elex_smoke-loader_stop.exe
1012	2026-07-10_d51b1682a569d7e080a55cd97f4575ee_amadey_darkgate_elex_smoke-loader_stop.exe
1012	2026-07-10_d51b1682a569d7e080a55cd97f4575ee_amadey_darkgate_elex_smoke-loader_stop.exe
1012	2026-07-10_d51b1682a569d7e080a55cd97f4575ee_amadey_darkgate_elex_smoke-loader_stop.exe
1012	2026-07-10_d51b1682a569d7e080a55cd97f4575ee_amadey_darkgate_elex_smoke-loader_stop.exe
1012	2026-07-10_d51b1682a569d7e080a55cd97f4575ee_amadey_darkgate_elex_smoke-loader_stop.exe
1012	2026-07-10_d51b1682a569d7e080a55cd97f4575ee_amadey_darkgate_elex_smoke-loader_stop.exe
1012	2026-07-10_d51b1682a569d7e080a55cd97f4575ee_amadey_darkgate_elex_smoke-loader_stop.exe
1012	2026-07-10_d51b1682a569d7e080a55cd97f4575ee_amadey_darkgate_elex_smoke-loader_stop.exe
1012	2026-07-10_d51b1682a569d7e080a55cd97f4575ee_amadey_darkgate_elex_smoke-loader_stop.exe
1012	2026-07-10_d51b1682a569d7e080a55cd97f4575ee_amadey_darkgate_elex_smoke-loader_stop.exe
1012	2026-07-10_d51b1682a569d7e080a55cd97f4575ee_amadey_darkgate_elex_smoke-loader_stop.exe
1012	2026-07-10_d51b1682a569d7e080a55cd97f4575ee_amadey_darkgate_elex_smoke-loader_stop.exe
1012	2026-07-10_d51b1682a569d7e080a55cd97f4575ee_amadey_darkgate_elex_smoke-loader_stop.exe
1012	2026-07-10_d51b1682a569d7e080a55cd97f4575ee_amadey_darkgate_elex_smoke-loader_stop.exe
1012	2026-07-10_d51b1682a569d7e080a55cd97f4575ee_amadey_darkgate_elex_smoke-loader_stop.exe
1012	2026-07-10_d51b1682a569d7e080a55cd97f4575ee_amadey_darkgate_elex_smoke-loader_stop.exe
5992	geywuomgeywtrmje.exe
5992	geywuomgeywtrmje.exe
5992	geywuomgeywtrmje.exe
5992	geywuomgeywtrmje.exe
5992	geywuomgeywtrmje.exe
5992	geywuomgeywtrmje.exe
5992	geywuomgeywtrmje.exe
5992	geywuomgeywtrmje.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe
412	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	4992	i_ljebzuojhz.exe
Token: SeDebugPrivilege	5212	i_qoigeytqoi.exe
Token: SeDebugPrivilege	6084	i_vtnlfdyvqo.exe
Token: SeDebugPrivilege	6004	i_vsnlfdxvqn.exe
Token: SeDebugPrivilege	4204	i_sqkicausnk.exe
Token: SeDebugPrivilege	1480	i_smkicxusnk.exe
Token: SeDebugPrivilege	1948	i_zurpnhfcwu.exe
Token: SeDebugPrivilege	724	i_hezurmkecw.exe
Token: SeDebugPrivilege	3364	i_jgbztrljdb.exe
Token: SeDebugPrivilege	1268	i_bwqojgeywt.exe
Token: SeDebugPrivilege	724	i_ljdbytrljd.exe
Token: SeDebugPrivilege	2836	i_gaysqkigay.exe
Token: SeDebugPrivilege	4256	i_xvpnifcaus.exe
Token: SeDebugPrivilege	5668	i_causnkfvpn.exe
Token: SeDebugPrivilege	2568	i_causmkecxu.exe
Token: SeDebugPrivilege	5000	i_urmkecwusm.exe
Token: SeDebugPrivilege	2620	i_ojgeywrlje.exe
Token: SeDebugPrivilege	1052	i_wtomgeywrl.exe
Token: SeDebugPrivilege	6096	i_ojgbywqolg.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
412	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1012 wrote to memory of 5992	1012	2026-07-10_d51b1682a569d7e080a55cd97f4575ee_amadey_darkgate_elex_smoke-loader_stop.exe	87
PID 1012 wrote to memory of 3168	1012	2026-07-10_d51b1682a569d7e080a55cd97f4575ee_amadey_darkgate_elex_smoke-loader_stop.exe	88
PID 3168 wrote to memory of 412	3168	iexplore.exe	89
PID 412 wrote to memory of 5004	412	msedge.exe	90
PID 412 wrote to memory of 3388	412	msedge.exe	92
PID 412 wrote to memory of 5488	412	msedge.exe	93
PID 412 wrote to memory of 3388	412	msedge.exe	92
PID 412 wrote to memory of 3388	412	msedge.exe	92
PID 412 wrote to memory of 3756	412	msedge.exe	94
PID 412 wrote to memory of 3756	412	msedge.exe	94
PID 412 wrote to memory of 4960	412	msedge.exe	95
PID 412 wrote to memory of 4960	412	msedge.exe	95
PID 412 wrote to memory of 4960	412	msedge.exe	95
PID 412 wrote to memory of 968	412	msedge.exe	96
PID 412 wrote to memory of 968	412	msedge.exe	96
PID 412 wrote to memory of 968	412	msedge.exe	96
PID 412 wrote to memory of 4124	412	msedge.exe	97
PID 412 wrote to memory of 4548	412	msedge.exe	98
PID 412 wrote to memory of 4124	412	msedge.exe	97
PID 412 wrote to memory of 4124	412	msedge.exe	97
PID 412 wrote to memory of 4548	412	msedge.exe	98
PID 412 wrote to memory of 4548	412	msedge.exe	98
PID 412 wrote to memory of 4940	412	msedge.exe	100
PID 412 wrote to memory of 4940	412	msedge.exe	100
PID 5992 wrote to memory of 4344	5992	geywuomgeywtrmje.exe	103
PID 2880 wrote to memory of 4280	2880	ljebzuojhz.exe	106
PID 412 wrote to memory of 2612	412	msedge.exe	109
PID 412 wrote to memory of 2572	412	msedge.exe	110
PID 412 wrote to memory of 2612	412	msedge.exe	109
PID 412 wrote to memory of 2572	412	msedge.exe	110
PID 412 wrote to memory of 1708	412	msedge.exe	112
PID 412 wrote to memory of 1596	412	msedge.exe	113
PID 412 wrote to memory of 1596	412	msedge.exe	113
PID 412 wrote to memory of 2216	412	msedge.exe	116
PID 412 wrote to memory of 2216	412	msedge.exe	116
PID 5992 wrote to memory of 3324	5992	geywuomgeywtrmje.exe	117
PID 5992 wrote to memory of 4360	5992	geywuomgeywtrmje.exe	121
PID 940 wrote to memory of 1372	940	qoigeytqoi.exe	123
PID 5992 wrote to memory of 2552	5992	geywuomgeywtrmje.exe	126
PID 5992 wrote to memory of 2060	5992	geywuomgeywtrmje.exe	130
PID 5140 wrote to memory of 2404	5140	vtnlfdyvqo.exe	132
PID 5992 wrote to memory of 4176	5992	geywuomgeywtrmje.exe	135
PID 412 wrote to memory of 4704	412	msedge.exe	137
PID 412 wrote to memory of 4704	412	msedge.exe	137
PID 412 wrote to memory of 4704	412	msedge.exe	137
PID 412 wrote to memory of 5220	412	msedge.exe	138
PID 412 wrote to memory of 5220	412	msedge.exe	138
PID 412 wrote to memory of 5220	412	msedge.exe	138
PID 5992 wrote to memory of 1456	5992	geywuomgeywtrmje.exe	142
PID 6000 wrote to memory of 5432	6000	vsnlfdxvqn.exe	144
PID 5992 wrote to memory of 3160	5992	geywuomgeywtrmje.exe	147
PID 412 wrote to memory of 2064	412	msedge.exe	149
PID 412 wrote to memory of 5444	412	msedge.exe	150
PID 412 wrote to memory of 5372	412	msedge.exe	151
PID 5992 wrote to memory of 1708	5992	geywuomgeywtrmje.exe	154
PID 1548 wrote to memory of 1980	1548	sqkicausnk.exe	156
PID 5992 wrote to memory of 2556	5992	geywuomgeywtrmje.exe	159
PID 5992 wrote to memory of 836	5992	geywuomgeywtrmje.exe	163
PID 3356 wrote to memory of 3800	3356	smkicxusnk.exe	165
PID 5992 wrote to memory of 4196	5992	geywuomgeywtrmje.exe	168
PID 412 wrote to memory of 2940	412	msedge.exe	172
PID 412 wrote to memory of 2940	412	msedge.exe	172
PID 412 wrote to memory of 2940	412	msedge.exe	172
PID 5992 wrote to memory of 5384	5992	geywuomgeywtrmje.exe	173

C:\Users\Admin\AppData\Local\Temp\2026-07-10_d51b1682a569d7e080a55cd97f4575ee_amadey_darkgate_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_d51b1682a569d7e080a55cd97f4575ee_amadey_darkgate_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1012
- C:\Temp\geywuomgeywtrmje.exe
  C:\Temp\geywuomgeywtrmje.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5992
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljebzuojhz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4344
  - - C:\Temp\ljebzuojhz.exe
      C:\Temp\ljebzuojhz.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2880
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4280
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3240
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljebzuojhz.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3324
  - - C:\Temp\i_ljebzuojhz.exe
      C:\Temp\i_ljebzuojhz.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4992
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qoigeytqoi.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4360
  - - C:\Temp\qoigeytqoi.exe
      C:\Temp\qoigeytqoi.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:940
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1372
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5024
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qoigeytqoi.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2552
  - - C:\Temp\i_qoigeytqoi.exe
      C:\Temp\i_qoigeytqoi.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5212
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtnlfdyvqo.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2060
  - - C:\Temp\vtnlfdyvqo.exe
      C:\Temp\vtnlfdyvqo.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5140
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2404
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:836
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtnlfdyvqo.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4176
  - - C:\Temp\i_vtnlfdyvqo.exe
      C:\Temp\i_vtnlfdyvqo.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6084
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vsnlfdxvqn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1456
  - - C:\Temp\vsnlfdxvqn.exe
      C:\Temp\vsnlfdxvqn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6000
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5432
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5420
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vsnlfdxvqn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3160
  - - C:\Temp\i_vsnlfdxvqn.exe
      C:\Temp\i_vsnlfdxvqn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6004
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqkicausnk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1708
  - - C:\Temp\sqkicausnk.exe
      C:\Temp\sqkicausnk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1548
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1980
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2972
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqkicausnk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2556
  - - C:\Temp\i_sqkicausnk.exe
      C:\Temp\i_sqkicausnk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4204
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\smkicxusnk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:836
  - - C:\Temp\smkicxusnk.exe
      C:\Temp\smkicxusnk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3356
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3800
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1760
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_smkicxusnk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4196
  - - C:\Temp\i_smkicxusnk.exe
      C:\Temp\i_smkicxusnk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1480
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zurpnhfcwu.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5384
  - - C:\Temp\zurpnhfcwu.exe
      C:\Temp\zurpnhfcwu.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2708
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2604
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5580
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zurpnhfcwu.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2288
  - - C:\Temp\i_zurpnhfcwu.exe
      C:\Temp\i_zurpnhfcwu.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1948
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hezurmkecw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5972
  - - C:\Temp\hezurmkecw.exe
      C:\Temp\hezurmkecw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2484
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1880
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4140
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hezurmkecw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5380
  - - C:\Temp\i_hezurmkecw.exe
      C:\Temp\i_hezurmkecw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:724
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jgbztrljdb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1244
  - - C:\Temp\jgbztrljdb.exe
      C:\Temp\jgbztrljdb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4868
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3944
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3060
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jgbztrljdb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1500
  - - C:\Temp\i_jgbztrljdb.exe
      C:\Temp\i_jgbztrljdb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3364
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bwqojgeywt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3140
  - - C:\Temp\bwqojgeywt.exe
      C:\Temp\bwqojgeywt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1852
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5536
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2536
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bwqojgeywt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5872
  - - C:\Temp\i_bwqojgeywt.exe
      C:\Temp\i_bwqojgeywt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1268
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljdbytrljd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1984
  - - C:\Temp\ljdbytrljd.exe
      C:\Temp\ljdbytrljd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3788
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4140
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5672
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljdbytrljd.exe ups_ins
    3⤵
    PID:4784
  - - C:\Temp\i_ljdbytrljd.exe
      C:\Temp\i_ljdbytrljd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:724
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gaysqkigay.exe ups_run
    3⤵
    PID:4920
  - - C:\Temp\gaysqkigay.exe
      C:\Temp\gaysqkigay.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1544
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1308
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5788
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gaysqkigay.exe ups_ins
    3⤵
    PID:1596
  - - C:\Temp\i_gaysqkigay.exe
      C:\Temp\i_gaysqkigay.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2836
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvpnifcaus.exe ups_run
    3⤵
    PID:1732
  - - C:\Temp\xvpnifcaus.exe
      C:\Temp\xvpnifcaus.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6112
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3300
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5456
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xvpnifcaus.exe ups_ins
    3⤵
    PID:4832
  - - C:\Temp\i_xvpnifcaus.exe
      C:\Temp\i_xvpnifcaus.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4256
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\causnkfvpn.exe ups_run
    3⤵
    PID:5964
  - - C:\Temp\causnkfvpn.exe
      C:\Temp\causnkfvpn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5372
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6004
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5304
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_causnkfvpn.exe ups_ins
    3⤵
    PID:4752
  - - C:\Temp\i_causnkfvpn.exe
      C:\Temp\i_causnkfvpn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5668
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\causmkecxu.exe ups_run
    3⤵
    PID:5740
  - - C:\Temp\causmkecxu.exe
      C:\Temp\causmkecxu.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3296
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5976
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2356
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_causmkecxu.exe ups_ins
    3⤵
    PID:4852
  - - C:\Temp\i_causmkecxu.exe
      C:\Temp\i_causmkecxu.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2568
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\urmkecwusm.exe ups_run
    3⤵
    PID:2004
  - - C:\Temp\urmkecwusm.exe
      C:\Temp\urmkecwusm.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3860
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2276
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6016
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_urmkecwusm.exe ups_ins
    3⤵
    PID:5540
  - - C:\Temp\i_urmkecwusm.exe
      C:\Temp\i_urmkecwusm.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5000
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ojgeywrlje.exe ups_run
    3⤵
    PID:5436
  - - C:\Temp\ojgeywrlje.exe
      C:\Temp\ojgeywrlje.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4892
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1684
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4336
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ojgeywrlje.exe ups_ins
    3⤵
    PID:5720
  - - C:\Temp\i_ojgeywrlje.exe
      C:\Temp\i_ojgeywrlje.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2620
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wtomgeywrl.exe ups_run
    3⤵
    PID:4136
  - - C:\Temp\wtomgeywrl.exe
      C:\Temp\wtomgeywrl.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3112
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1156
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3136
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wtomgeywrl.exe ups_ins
    3⤵
    PID:5884
  - - C:\Temp\i_wtomgeywrl.exe
      C:\Temp\i_wtomgeywrl.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1052
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ojgbywqolg.exe ups_run
    3⤵
    PID:4400
  - - C:\Temp\ojgbywqolg.exe
      C:\Temp\ojgbywqolg.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:632
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3460
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5176
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ojgbywqolg.exe ups_ins
    3⤵
    PID:4760
  - - C:\Temp\i_ojgbywqolg.exe
      C:\Temp\i_ojgbywqolg.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6096
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffc4b38c188,0x7ffc4b38c194,0x7ffc4b38c1a0
      4⤵
      PID:5004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1616,i,7332237324023829434,18192243667061760248,262144 --field-trial-handle=2352,i,17840117632531008331,6043268157650004768,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:2
      4⤵
      PID:3388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,3750116770720588698,7979587926557537310,524288 --field-trial-handle=2352,i,17840117632531008331,6043268157650004768,262144 --variations-seed-version --mojo-platform-channel-handle=3216 /prefetch:11
      4⤵
      System Time Discovery
      PID:5488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2384,i,10785091138146692149,3040790110901501107,524288 --field-trial-handle=2352,i,17840117632531008331,6043268157650004768,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:13
      4⤵
      PID:3756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3336,i,6600689954083249913,3927321726032017113,2097152 --field-trial-handle=2352,i,17840117632531008331,6043268157650004768,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:1
      4⤵
      PID:4960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3352,i,1069180037576832313,6358703712040627022,2097152 --field-trial-handle=2352,i,17840117632531008331,6043268157650004768,262144 --variations-seed-version --mojo-platform-channel-handle=3188 /prefetch:1
      4⤵
      PID:968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,15917976852418732254,10488762500841188386,2097152 --field-trial-handle=2352,i,17840117632531008331,6043268157650004768,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:1
      4⤵
      PID:4124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,6501479340646770832,8534887914383866263,2097152 --field-trial-handle=2352,i,17840117632531008331,6043268157650004768,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:9
      4⤵
      PID:4548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5224,i,9145027661730701187,1911287302588750726,524288 --field-trial-handle=2352,i,17840117632531008331,6043268157650004768,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:14
      4⤵
      PID:4940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,16863013814705572218,3662035741574618199,524288 --field-trial-handle=2352,i,17840117632531008331,6043268157650004768,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:14
      4⤵
      PID:2612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,16493205626576838653,1504392389701861270,524288 --field-trial-handle=2352,i,17840117632531008331,6043268157650004768,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:14
      4⤵
      PID:2572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,2244218261673298684,6481545769186390531,524288 --field-trial-handle=2352,i,17840117632531008331,6043268157650004768,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14
      4⤵
      PID:2160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,2244218261673298684,6481545769186390531,524288 --field-trial-handle=2352,i,17840117632531008331,6043268157650004768,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14
      4⤵
      PID:1708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,2001500673180034035,13669519649424193452,524288 --field-trial-handle=2352,i,17840117632531008331,6043268157650004768,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:14
      4⤵
      PID:1596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6580,i,2439535249538118412,7898760324853758271,524288 --field-trial-handle=2352,i,17840117632531008331,6043268157650004768,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:14
      4⤵
      PID:2216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4828,i,7860487397461989661,7749343818924181386,2097152 --field-trial-handle=2352,i,17840117632531008331,6043268157650004768,262144 --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:1
      4⤵
      PID:4704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3740,i,1776008404118194914,1104723071492542648,2097152 --field-trial-handle=2352,i,17840117632531008331,6043268157650004768,262144 --variations-seed-version --mojo-platform-channel-handle=3960 /prefetch:1
      4⤵
      PID:5220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=744,i,980757388113435257,5573216925007907149,524288 --field-trial-handle=2352,i,17840117632531008331,6043268157650004768,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:14
      4⤵
      PID:2064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4912,i,576672360713350053,12044254345635618365,524288 --field-trial-handle=2352,i,17840117632531008331,6043268157650004768,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:14
      4⤵
      PID:5444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,8811668732979034851,3403416746724026148,524288 --field-trial-handle=2352,i,17840117632531008331,6043268157650004768,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14
      4⤵
      PID:5372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6704,i,5957554368523075584,3962358334854070022,2097152 --field-trial-handle=2352,i,17840117632531008331,6043268157650004768,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:1
      4⤵
      PID:2940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2520,i,16498538658988232170,7928629886185538800,524288 --field-trial-handle=2352,i,17840117632531008331,6043268157650004768,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:14
      4⤵
      PID:204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,3529067041661125477,1716026681075805609,524288 --field-trial-handle=2352,i,17840117632531008331,6043268157650004768,262144 --variations-seed-version --mojo-platform-channel-handle=3972 /prefetch:14
      4⤵
      PID:4212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4812,i,13543707306030572960,2366793231131566745,524288 --field-trial-handle=2352,i,17840117632531008331,6043268157650004768,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:14
      4⤵
      PID:5220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=3960,i,1158521625313014485,18063368273640460706,2097152 --field-trial-handle=2352,i,17840117632531008331,6043268157650004768,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:1
      4⤵
      PID:3540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4240,i,6345359601609448970,14742107884542889551,524288 --field-trial-handle=2352,i,17840117632531008331,6043268157650004768,262144 --variations-seed-version --mojo-platform-channel-handle=4008 /prefetch:14
      4⤵
      PID:6068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6096,i,2924526229205728721,10762837461971573827,262144 --field-trial-handle=2352,i,17840117632531008331,6043268157650004768,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:10
      4⤵
      PID:1760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,15010817553191108200,15095918297337645387,524288 --field-trial-handle=2352,i,17840117632531008331,6043268157650004768,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:14
      4⤵
      PID:2252

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3064

C:\Temp\geywuomgeywtrmje.sys
C:\Temp\geywuomgeywtrmje.sys
1⤵
- Executes dropped EXE
PID:3188

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5600

C:\Temp\ywrojgbytq.sys
C:\Temp\ywrojgbytq.sys
1⤵
- Executes dropped EXE
PID:5420

C:\Temp\idbvtnlfdy.sys
C:\Temp\idbvtnlfdy.sys
1⤵
- Executes dropped EXE
PID:1868

C:\Temp\lyvqnlfaxs.sys
C:\Temp\lyvqnlfaxs.sys
1⤵
- Executes dropped EXE
PID:1852

C:\Temp\nifaxvpnif.sys
C:\Temp\nifaxvpnif.sys
1⤵
- Executes dropped EXE
PID:3392

C:\Temp\dxusmkfdxv.sys
C:\Temp\dxusmkfdxv.sys
1⤵
- Executes dropped EXE
PID:3716

C:\Temp\zxrpnhfzxu.sys
C:\Temp\zxrpnhfzxu.sys
1⤵
- Executes dropped EXE
PID:6084

C:\Temp\pmhezwrpjh.sys
C:\Temp\pmhezwrpjh.sys
1⤵
- Executes dropped EXE
PID:2144

C:\Temp\trmjecwuom.sys
C:\Temp\trmjecwuom.sys
1⤵
- Executes dropped EXE
PID:4508

C:\Temp\jhbztrmgey.sys
C:\Temp\jhbztrmgey.sys
1⤵
- Executes dropped EXE
PID:4340

C:\Temp\ljgbytqoig.sys
C:\Temp\ljgbytqoig.sys
1⤵
- Executes dropped EXE
PID:3000

C:\Temp\gdyvtnlidb.sys
C:\Temp\gdyvtnlidb.sys
1⤵
PID:4844

C:\Temp\fdaysqndxv.sys
C:\Temp\fdaysqndxv.sys
1⤵
PID:3740

C:\Temp\ifaxvpnkfd.sys
C:\Temp\ifaxvpnkfd.sys
1⤵
PID:6116

C:\Temp\zxspkhfcxu.sys
C:\Temp\zxspkhfcxu.sys
1⤵
PID:468

C:\Temp\usmjhczusm.sys
C:\Temp\usmjhczusm.sys
1⤵
PID:5352

C:\Temp\zwrpjhbztr.sys
C:\Temp\zwrpjhbztr.sys
1⤵
PID:4052

C:\Temp\wromgebwtr.sys
C:\Temp\wromgebwtr.sys
1⤵
PID:608

C:\Temp\qoigbytqlj.sys
C:\Temp\qoigbytqlj.sys
1⤵
PID:5212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dxusmkfdxv.sys

Path C:\Temp\dxusmkfdxv.sys
Size 293KB
SHA256 01d7e296ea4de27496ee5ac57f75e6526ad495899ec3be3fb3c7fa817df605a2
MD5 013ef32aa9de0caa786395abc655393a
SHA1 bd9e50aa2e2af6758b3f1dc886024b37cf0ffc46
SHA512 3757fc319ff0a368c94516b27581c6c16b452c4ef71765dea50f6761b5a2100f7922ebd7ff54929fdfc4446f961fd5b5d1ccda59e484fad8a741966e79bfdf1c
SSDEEP 3072:jtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:jIJjiJcbI03GBc3ucY5DCSj
TLSH
T1F4545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geywuomgeywtrmje.exe

Path C:\Temp\geywuomgeywtrmje.exe
Size 384KB
SHA256 1449ab254133c44da016e8ad433e40908ea7924e9b562c6336683d0275a800f0
MD5 4adba3113f7783777e34317551a7ac15
SHA1 aabf18ae992cf780fac2c19bcdfe3bc4bb00bebc
SHA512 af6434621f766a8c70da7a5e0b7552e001464f7c6cd824713de8c61196d600c75464c52bfc296d60469ad84e9e3c119689898af9d6dd8ba214e0737646c44e50
SSDEEP 3072:29ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:kctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1DA847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geywuomgeywtrmje.sys

Path C:\Temp\geywuomgeywtrmje.sys
Size 293KB
SHA256 78869084acad56eea39725a5d622fd53525b56a753da3ea055fb0d0ea266e156
MD5 8e60d41561094beab64bf4f96fe2706a
SHA1 926c63a44e58b0a68eae7e49afb19c19f727e870
SHA512 f7fb7bb5fef45b5d6f5bed7000ab1697ea77e282f4d24859633b664c7628e2a43acb39019db6cc9c6ba55782200f42a444d14fc522824ae1c171fc928fd80b4e
SSDEEP 3072:ItKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9Ed/:IIJjiJcbI03GBc3ucY5DCSj
TLSH
T1C4545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ljebzuojhz.exe

Path C:\Temp\i_ljebzuojhz.exe
Size 384KB
SHA256 4e81a19128e7f191016f5bd252eb018dbf3ae74e7e23b48092393add859f0551
MD5 2476afb0ed719b62837184e057594942
SHA1 54efc40a86b9af53867dac2b500128db759b1371
SHA512 9ad5f757b198f2ca3bcff84e80b962ff46e3855c1e2ad96a9676f9a2154ea9c5f729356c2e55b6eafbed8fa0285da5b7c9b204ff0224ce4a115687c1d8529554
SSDEEP 3072:99ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:PctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1DF847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qoigeytqoi.exe

Path C:\Temp\i_qoigeytqoi.exe
Size 384KB
SHA256 5250fc0324efa7c8186a00de4e91f48175eb7c98a30aebe9a6819276d196d64f
MD5 c93c66a078d3801dd03831d4b2ecd1e6
SHA1 e8e94a95773ca0196b14661bd5fc7a3bf856055c
SHA512 23cd6f044e3b1f5800622a1d6b126a8575563f1a32ee4d59f6877d80a953b934bd79bc02c98dce90e8aeec34035cbbf49cdc7e6b1ecf9909645f35ca5e40db2c
SSDEEP 3072:j9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:BctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T132847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_sqkicausnk.exe

Path C:\Temp\i_sqkicausnk.exe
Size 384KB
SHA256 066987f36bf3a48402e530a3e4c0e6fb66007c84c41f771ef3850d6b1ccf604c
MD5 dbef117153fa7107a6bbc68a3193ada4
SHA1 960d3ff3312f48e78c89fb748de428bf8f3e5e02
SHA512 cb2dabdc4534be3566e3957e817cf3632f84e0d5b299f986e7d570f6ec1e8ab1782024773178579dd7e371d34d1a27ff73e239e316b54ee34c4c4a6e8bc8dbaa
SSDEEP 3072:g9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:yctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T198847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vsnlfdxvqn.exe

Path C:\Temp\i_vsnlfdxvqn.exe
Size 384KB
SHA256 4ff85b03a5d1e0dc60b48c6c7612c6fd56c188fa8553cfedd77b9844b5ff1038
MD5 935c295d2ac9b1f756bf049781ef63ce
SHA1 8ec63bc33b0898a50f754c1b7426ec2e7fc1d97b
SHA512 85c5dacfd111963519c15b419b573415810488ef7d2efdcfc1b35638f227ea0b0b7045dc15bbdfa081db035d14ed606a42e68fcf940a90e8bb04312b6d34a0e9
SSDEEP 3072:59ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:TctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T139847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vtnlfdyvqo.exe

Path C:\Temp\i_vtnlfdyvqo.exe
Size 384KB
SHA256 2025d04fa6cf3a10c5ad45baa6104c1b46929d629b21bf1f473335d8953692aa
MD5 7ef4f112b22c12f2c7149c4281afb955
SHA1 b2cf3726a2847dad84b00303a2e359707712792e
SHA512 0be062f8fdea91184586418be32af938bd8c3bb01055206e20af11f8204094ea61f64a4d3d5ec20add870a2b9ea3cbf2052a47d4957e81d021d08d7c6a86be5f
SSDEEP 3072:W9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:EctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T17C847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idbvtnlfdy.sys

Path C:\Temp\idbvtnlfdy.sys
Size 293KB
SHA256 a85e1262b6bf11ee015b3ca943194174be0498348c8553488af3ef937aa3e09d
MD5 0bafeb11f8b5e7bd26906d1fe21bc0b1
SHA1 826e4b85e29cedcdb0ec4f5cba4b485f2e6f1678
SHA512 5a8e5546f86991f4c4a945ca6bf60ca8270898fef74e5fda998625e5cb12d4b1789c44e333022c31eb94a9937c11f1d383cf59dc6d78ee21e24ba6b5eb513728
SSDEEP 3072:gtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:gIJjiJcbI03GBc3ucY5DCSj
TLSH
T1EB545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljebzuojhz.exe

Path C:\Temp\ljebzuojhz.exe
Size 384KB
SHA256 fc2fd663e128911b8320bae1ef74ba34764c9c2b79ed666d7163a18c7547f5cb
MD5 34ac01d40631414b2186710828d0e064
SHA1 f19be086c0986db2cf8d291e4cf6238a3ab9ac03
SHA512 f9115c09f3773d978014978c74f68ec4970463114f71b1a55197f6f850dd267b18b212fb9629643b34727b3c327f2a8f933a95135a991ae865b1d71f5a71e6f2
SSDEEP 3072:U9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:uctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1CC847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lyvqnlfaxs.sys

Path C:\Temp\lyvqnlfaxs.sys
Size 293KB
SHA256 ab2b598fe6cad8e63dd4fdbe41938390a7d0353efeb006f7b8d10a7adc089d27
MD5 c562960d174279cb3c6315ea096962f8
SHA1 df06864317535f8063dd40fcdc9b81f9eec0275e
SHA512 793e7a711d275456bfaa41ca5aaac0a1dd8bd73f20b60d51f7ad70d7c80d6631e7cf44fc4bb595a482c5d5d4909ee00bb07225d502a0ef66d2dcb572c993caa1
SSDEEP 3072:ltKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:lIJjiJcbI03GBc3ucY5DCSj
TLSH
T1F3545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nifaxvpnif.sys

Path C:\Temp\nifaxvpnif.sys
Size 293KB
SHA256 15fb532c0c8192fdb18884a3f7e7d5bd18b6c388569c5fca63944fd76617f3a1
MD5 07b44bcb4db892118eae123a323b53ed
SHA1 a60002a8ef5cecfa82ae426cd0d9cc8d3eab6d7c
SHA512 68d703c2bf2c5e21220f92ad67c94226decdcd9b878796d5e661cb82facdf0a81f2ff68e001d795c7bcf5b4d41c54b3761b9ce155997d2fb4802e328d4c553a7
SSDEEP 3072:btKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:bIJjiJcbI03GBc3ucY5DCSj
TLSH
T154545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qoigeytqoi.exe

Path C:\Temp\qoigeytqoi.exe
Size 384KB
SHA256 032809afa77c3992a5f9ba928a336e6e8b2883d17e05053902b5c6f69c0d0330
MD5 2a1edcbc64144a305ba677f8ae20d12e
SHA1 cdf64cb886784ffbcd06085d36e44f2dc8f32ec3
SHA512 14d7b85ccf52d82b45b32769b9cd2b2d22a7ec28134328b26b86def648ff24eeb26c29f7a183b2b2b397bd52ed3db12d12529ac067cca160bda398dc64399793
SSDEEP 3072:q9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:QctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T123847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

smkicxusnk.exe

Path C:\Temp\smkicxusnk.exe
Size 384KB
SHA256 44861ac70d10c0288b7796be25f92a7f7c0429030fdc9ef0c442809a15bc9360
MD5 75d8cb840b4847cd8e8be7bb5e03bfc9
SHA1 42b6f75ac8549f9a14ae2d4eea0027d3ee7844b5
SHA512 1acf086abbe8b726ca66c59ae22270d4b6247eb4dcb2deba94d0b3aed7b37f57fd9f1980d4395219caf03988410598a800a340dbca5b3b6919e5d249ce646ce1
SSDEEP 3072:I9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:KctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T18B847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqkicausnk.exe

Path C:\Temp\sqkicausnk.exe
Size 384KB
SHA256 66c90f8dbaefe9557f62f0ffa6e5e6ecfaed06b9543de5305a570b93f77d72ea
MD5 e46d611f336487fa02e9651903c3fe4b
SHA1 bde4c061c7e9620c9ba088e684b5ea08b140e08c
SHA512 c0a70fc39f2a4e0e7597720028e5d4c70c6803ba21abad988b01426cc4d639bb34f8060bafef9d33738b6d285513504922d4cf1a615b0e625cabf605968e86d6
SSDEEP 3072:59ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:TctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T173847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vsnlfdxvqn.exe

Path C:\Temp\vsnlfdxvqn.exe
Size 384KB
SHA256 c698b1c1899a4d860a55c7a8422448f5b95ff1b3255fa0aecc5f0426102ffc4d
MD5 183e197df4e9e10f9f0189fc57e779c8
SHA1 8dde410120ba23a76dc8ec8fefb7a84a560b08af
SHA512 1bb0c9eea4247c1088b44ffadfcf0ef835bd5d0fd54e85aaf259f7aa51c2b50b6454a09dbaa4f3c211a7b7e5dc09dd244f9b02eca600e738ef4dd42c46991ebc
SSDEEP 3072:39ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:NctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T10D847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtnlfdyvqo.exe

Path C:\Temp\vtnlfdyvqo.exe
Size 384KB
SHA256 e6375da44a87e5958570517b876918fac2e35dc2ba39497c011dc623dbcac5b6
MD5 0b228f88a875b7d95a5e5eb0966989bc
SHA1 4e915b0e413612d8384f4fb4829da2b4bb45d9e7
SHA512 92fd67d5fcade7f618f69624272eff2de88513b06c401cf7f5efd2f8aca91aa2488b8ccfdfe73545ba107716d7345cf4245c320d47cd11481657b078dade4da5
SSDEEP 3072:I9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:KctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T13D847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywrojgbytq.sys

Path C:\Temp\ywrojgbytq.sys
Size 293KB
SHA256 49553bf7f421e3d4993c1ae0ed245b73feeaf88c65fb5c0073fae7cce5716482
MD5 01c0ece540facb96ec99f1161212be58
SHA1 849288c55827ae49a2e665a05bc9aba90ad569e1
SHA512 b88124d357c05d331937a3d5ca1a6e098a249acc5b2951625f4638af4c0129ac1be580d6910702089f531c950bb3c27c591a8ff5d5c46ebee026f7ce5f0ee88b
SSDEEP 3072:+tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:+IJjiJcbI03GBc3ucY5DCSj
TLSH
T1F7545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 6852db240148f1f7b18c0d3a6954c762d0b0f455c89f632a83c208d4563dde4a
MD5 a237dc7ee2a8395872c69b83c8b06b4e
SHA1 df731d30a3dbe1788ebc1b22f0dce4f305e9df6a
SHA512 cc459b33c239af84af69d1ede64ae71b48ffb176ba8c0cbf75efd218872a1ea94cbdb350e954f76d34e949cae6a03153fe5284ea501298f7d7d67092cfd4ffed
TLSH
T1115142140322AAC8F7A14FBBF0D09266F2FD864B05476E9A80725F355E0EF4C1ADB423
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599bc9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe599bc9.TMP
Size 2KB
SHA256 5f40deaed0a01d39349550040f97dab870626f92aac70cd3638b3c2f56192e71
MD5 f2a57aa5ad894dbfbd99ca78d0da8139
SHA1 41d40a5b8751ff4dffa69f00dfb023b1ff5bff8f
SHA512 4d3b83f0bfa0e9bae31112ca96f9bb106c30584ded0dc9e2efa55771bcc0e36225cca3510cc919031cb3771d535bef9443036ac8e4e9cf00c4616d80eb8f26ef
TLSH
T1E65121150322AAC8F7A14FBBF0D09266F2FD964B15476E9A80725F355E0EF4C5ADB023
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 30dfdf10f6b45277552c425780f1ac7b1df5b6780fd44fad6a592d19d62f4364
MD5 91a36153fa5fc24a9822ba9065b8e833
SHA1 4f3887abb04a5f213b360b1f993da6e2cb0ed57b
SHA512 52fe83df72d1317e5e095f944355313c45856e3459ee5b76ef356a28dc56de22807ad4e364e80d36917f988f1ae73cec17b817e615a8850d66be9c901a8082b1
TLSH
T10B51EFF3C7E8866EC91156F0EB187E2BCE1D0914832C3D5A89E4EF5BA3E2471D141A5E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 4bb8075dfb944407f24725ff9ec6e16feb10d63b784bd91e3230afdb98cf0d8a
MD5 2ceb4b8b23e9e01e3d3355ed09a30c63
SHA1 d12f45082f223dafb552e862fa931c04be8be02e
SHA512 0993e31e81c7c0d23f6fc13ba534545422eab02789703ead274bf372cb003821ee1ff0545e39be9e5b18cd9b2a73b8c1b4a6f9aeeb79c9a9280d7b1dd76e2d21
SSDEEP 192:sxRfRfyM/jK1Ml8wC7/ffsoUzEDde5lSSzoD8pi/g6+WNIYCsuOe+GWIgtJ:sxRfj87/ffstzEc5lji/5Iee43
TLSH
T1B052EA156A24597BCCDBD20CFA517F93D6F85573A2901E48ABFCCA0C44E6ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 397f64cf4ad4c138ff1a2df60c1c4c602d3e8530bbb591d8f560d71eb7bb1fdf
MD5 b5e6f161b6b95933266af751da212d5d
SHA1 d05ea80f9bee70722e2c77872309d49b2ed4627c
SHA512 82a077361a7560984bc30e7a7ee79856491060190fb8a58e1a42e7f88801bcb387a2015663cbdc30982d1581d7cae94325875b26bf3bd2d98ff46b8683edc3b3
SSDEEP 192:sxRsRfyM/jK1Ml8wC7/ffsXUzhOZDpzoD8prIf/g6+WNCHX/YCSuOe+GWIgDDJ:sxRsN87/ffsEzhoDd8f/52/Ee4R
TLSH
T15662EA1669245D7BDCDBD208FA51BF93D6F85473A2945E489AFC8B0C00E76DC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 48e67769418623f08d12af22256d7401ab63f8a3fe8c8707a150d60778f28f8f
MD5 4384de5c7b3278e4ea58c038d6378d52
SHA1 ef5a7fd9a76fad8b1442005f8b2992a016efce1b
SHA512 a04264c90a89c19a4e475f19bed28deef5b0ea499e8aa7c6027a5aa9992cda60a423b5cd451e46a3e5792eb1060ee1ed521a967b7f36a0f8f3990c2cecf879ee
SSDEEP 192:sxRsRfyM/jK1Ml8wC7/ffsXUzEDde5lSSzoD8pi/g6+WNIYCsuOe+GWIgDRJ:sxRsj87/ffsEzEc5lji/5Iee43
TLSH
T13052EA156A34597BCCDBD20CFA417F93D6F85573A2901E48ABFC8A0C44E6ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 43ceff10e75ed43e9a49a282248a28a8505686117a25108348c31b9ca6f7e244
MD5 261f077e09b2e00b6c4ef8619a0d83a9
SHA1 0b31e336653527a25c69107665b57687d65659e4
SHA512 9e5ac2d235af838a1d3b665cbfad18d75f7e2ba91a4912ca6872d8b23b258ad2549174fcec2555ff1b68cdb3bced7de67a035567b3f32f52c5d0975668c72fff
SSDEEP 192:sxRsRfyM/jK1Ml8UQtC7/ffsXUzhOZDpzoD8prIf/g6+WNCHX/YCSuOe+GWIgDDJ:sxRsNqM7/ffsEzhoDd8f/52/Ee4R
TLSH
T1CD62D91669245D7BDCDBD208FA51BF93D6F4547392945E48AAFC8B0C00E76DD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 80e59b65c16ed77bb95d895021b64705283df4731e10c076981bb65d6ae77167
MD5 146b06cce5a0869b95516caa73c4d768
SHA1 f55e82978eff7aacef27ce911aee84d6d5afc79e
SHA512 b3aced78c4779c4b8beecee841831507ddc5cd3cebc06467cc6ecd20993dd12f0d45c36c4890c919dd918b05ba00f2b75256df5ff78fd63d1b60d1b4213d0bb3
SSDEEP 768:j/8vNN7pLuL7tQWgQ+fB+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhVMQqqvrovf:j/8vN7E7tQWgQ+fB+u1jaKVMVq8H
TLSH
T111E2FC7B680CCB7E4F404E9DEC29BE9AADE801CF5698CD5447EA840C03C57EB561A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 c4533f45a75bbad941b619761259f866242e15c12b43b9f0a9a9c369301f726c
MD5 3836d0faed0c879cc7d69e6bce4540fb
SHA1 406e276e702fdae497bbdebe163c35c77ba0d41c
SHA512 6fc491534cebe80e7ad9801eba2d19652b6577d498ce2011b79d63cdfd01f614014a653dbc49272a8ab8b1014263284b3754af809f0a0fb650f6772df9224ec7
SSDEEP 96:KRbEBVj5J1WdSIg91K4EgT1c7j6dJOHN6zn9Xr/WzoWgv/K4uDiAKTSKevOK2:CbEBVj5JAdSp9/EgTK7j6dJOHN6zn9XZ
TLSH
T178913150313B4381387E65488278C92BC6C274B33469E67B3BE845B65F2AE465DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 a5596166c47a92b439457ea365f60652ed2124ec7dc1299b58bea5d53d1f4e75
MD5 451f30d6451df59f7a09e4437a767ddc
SHA1 301388b8ecdca65bd4489281514bcc12f119ad2d
SHA512 38539dc3e06ba9a13c939daeb8991183e4b89e47537a1e1e5366c305f7cf3900e109ab07184306f539476314c6446938cc6f516e515cae038f12de2dcde4f526
SSDEEP 768:Irv+4UNbdD3zc/Np8+p3bd66j+4BRv86aLIik2bwCl1:Ibsbp3WL8+p3Z6n4yO0ww
TLSH
T1BB03CE73F8A899739CE6C64472467B433FF851A396C10AC4E5DD2B4E419B29E230B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 c0767259439ef0df52cc1803a964cd4f856c1faf369e4db4152e39bd666095e3
MD5 3386d2755118b0a0f05f4fe68139ee8b
SHA1 d2833c98c1f1ce72b357b4f8f8c60035aa80a1ea
SHA512 0fef501c66a85e0ebf802a3f8a7b26924b2afdfd5c8005bfd15266b1cac0518b1770432dc30db6c8c1864bc4af8e7c1d1af61402d72889961355b4bbaf476e5b
SSDEEP 768:orv+4UNbd33Pmahe9Dp8+p3bd66j+4BRv86aLIWoa:obsbN3PeV8+p3Z6n4yKa
TLSH
T1D103AE72F868DD739CF6C648B18737837FB411A395C00E98D8D86B4D409B19E2B0B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 4c89161b38bbe51de601328294c54f765370bbf4b929a89cc36072d237d5f217
MD5 0e129425bfd49fe2330585ceb3a7323d
SHA1 0ea877ca84423dacc530b404426a9c6465b6aadf
SHA512 b982f8466644382995518dc97bc969dcf29f1ca4cb8877604e9f2e12f1f32dfd7be0cf6652cc551025cbf1808de6e157b7390d2680986e209bc66f9c0a3c116e
SSDEEP 768:zrv+4UNbd73AmAO/yp8+p3bd66j+4BRv86aLIWof:zbsbZ3AF8+p3Z6n4yKf
TLSH
T1FF039E72F868DE779CF2C78572467B83BEE4119346C40DD8D8D86F8D009719E2B0B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir412_1848575227\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 eeadf77b1649bb59794fbdb2f8cf5bd731f0a1691c165272311c46c3206cf4cb
MD5 9c51290c83429d3234a78b25a5cf972c
SHA1 fa29977dfed1f378f84040c63db5b45465b7dc76
SHA512 85ad5a0241ec23f95d9d2664b4738b330e3930e2b07bce545b54e9c20d21af9b5ad257af7d684d63a407eb60e80d9ab3fdc97694f670fa49581988d4e921641e
TLSH
T19C71008396B8C6F2C1DA5FF102835608F5BB22380B7370300B615586AA30A7A24B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/468-424-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/608-468-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1852-269-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1868-275-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1868-241-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2144-323-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3000-360-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3188-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3392-290-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3392-311-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3716-320-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3740-400-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4052-448-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4340-347-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4508-327-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4844-380-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5212-480-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5352-443-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5420-193-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6084-318-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6116-404-0x0000000000010000-0x00000000000AB000-memory.dmp

Download