systex | 09591209c21980e03037dcb79d281098a4cd703efaab77a01a35324602bc6ba0

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/07/2026, 12:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-11_dd2bd3f379140151ad91f9faa7d5cf51_amadey_darkgate_elex_smoke-loader_stop.exe
Size 384KB
Sample260711-pgcfjsbz61
SHA256 09591209c21980e03037dcb79d281098a4cd703efaab77a01a35324602bc6ba0
MD5 dd2bd3f379140151ad91f9faa7d5cf51
SHA1 89c2cc888f80745e5432e8bd907cbb4157970e40
SHA512 7d95ba3b43408011b6606c267a99d0fe43788e67546ebdfe6d5ce191fe5172b4c2f2983a799d1a04ead42d7c9235f018521ca00f829fb9f5a5be59db87a5f85f
SSDEEP 3072:s9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:2ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T19F847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
3552	yvqnlidbvqnljdby.exe
5072	yvqnlidbvqnljdby.sys
5028	CreateProcess.exe
5460	fdyvtnigay.exe
2788	CreateProcess.exe
1912	CreateProcess.exe
5420	i_fdyvtnigay.exe
3600	kifaysqnif.sys
1204	CreateProcess.exe
5540	davtnlfdxv.exe
5176	CreateProcess.exe
1620	CreateProcess.exe
4920	i_davtnlfdxv.exe
5100	fausnkfcxv.sys
4672	CreateProcess.exe
3004	pmkicausnk.exe
1996	CreateProcess.exe
4324	CreateProcess.exe
2144	i_pmkicausnk.exe
2092	kecxupnkec.sys
2424	CreateProcess.exe
1816	nhfarpjhcz.exe
2440	CreateProcess.exe
3100	CreateProcess.exe
3212	i_nhfarpjhcz.exe
4668	zxrpjhecwu.sys
3356	CreateProcess.exe
5104	omkeczuomk.exe
1472	CreateProcess.exe
1448	CreateProcess.exe
2464	i_omkeczuomk.exe
5624	zwurmjezwr.sys
5936	CreateProcess.exe
5800	trpjhbzurm.exe
1188	CreateProcess.exe
556	CreateProcess.exe
4504	i_trpjhbzurm.exe
3464	jhbztroljd.sys
760	CreateProcess.exe
4264	mgebztqomg.exe
1136	CreateProcess.exe
1120	CreateProcess.exe
3820	i_mgebztqomg.exe
2828	qoigaytqlj.sys
3036	CreateProcess.exe
5832	trljdbytrl.exe
5424	CreateProcess.exe
1360	CreateProcess.exe
3048	i_trljdbytrl.exe
5444	aytqljdbvt.sys
860	CreateProcess.exe
1960	gaysqnigdb.exe
4660	CreateProcess.exe
5592	CreateProcess.exe
4160	i_gaysqnigdb.exe
772	ifdxvtnlfd.sys
4636	CreateProcess.exe
4752	faysqkicay.exe
4864	CreateProcess.exe
2344	CreateProcess.exe
2148	i_faysqkicay.exe
1972	vsnkfdxvpn.sys
3576	CreateProcess.exe
2348	qkicavsnki.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1556_1368085943\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1556_1368085943\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1556_1368085943\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1556_755647106\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1556_755647106\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1556_1246947874\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1556_102476163\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1556_1368085943\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1556_755647106\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1556_755647106\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1556_102476163\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1556_612922323\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1556_612922323\nav_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-11_dd2bd3f379140151ad91f9faa7d5cf51_amadey_darkgate_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvqnlidbvqnljdby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdyvtnigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkicausmkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbztrljecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqnifdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfarpjhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omkeczuomk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljdbytrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hczusmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtnlgaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvtnlgaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmkicausnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgebztqomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaysqnigdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkicausmkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hczusmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbztrljecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdyvtnigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	davtnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omkeczuomk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trpjhbzurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgebztqomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gaysqnigdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faysqkicay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_davtnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trpjhbzurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkicavsnki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkicavsnki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwurmjeczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bytroljdby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aytqlidbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aytqlidbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faysqkicay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqnifdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmkicausnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfarpjhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljdbytrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwurmjeczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bytroljdby.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5140	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3400	ipconfig.exe
696	ipconfig.exe
5368	ipconfig.exe
2428	ipconfig.exe
3668	ipconfig.exe
784	ipconfig.exe
3784	ipconfig.exe
4252	ipconfig.exe
4420	ipconfig.exe
4172	ipconfig.exe
3108	ipconfig.exe
4332	ipconfig.exe
2680	ipconfig.exe
1348	ipconfig.exe
2008	ipconfig.exe
1420	ipconfig.exe
4472	ipconfig.exe
3668	ipconfig.exe
5868	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134282458708665288"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{B464EF17-7735-4CBA-997F-573A607E1018}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1464	2026-07-11_dd2bd3f379140151ad91f9faa7d5cf51_amadey_darkgate_elex_smoke-loader_stop.exe
1464	2026-07-11_dd2bd3f379140151ad91f9faa7d5cf51_amadey_darkgate_elex_smoke-loader_stop.exe
1464	2026-07-11_dd2bd3f379140151ad91f9faa7d5cf51_amadey_darkgate_elex_smoke-loader_stop.exe
1464	2026-07-11_dd2bd3f379140151ad91f9faa7d5cf51_amadey_darkgate_elex_smoke-loader_stop.exe
1464	2026-07-11_dd2bd3f379140151ad91f9faa7d5cf51_amadey_darkgate_elex_smoke-loader_stop.exe
1464	2026-07-11_dd2bd3f379140151ad91f9faa7d5cf51_amadey_darkgate_elex_smoke-loader_stop.exe
1464	2026-07-11_dd2bd3f379140151ad91f9faa7d5cf51_amadey_darkgate_elex_smoke-loader_stop.exe
1464	2026-07-11_dd2bd3f379140151ad91f9faa7d5cf51_amadey_darkgate_elex_smoke-loader_stop.exe
1464	2026-07-11_dd2bd3f379140151ad91f9faa7d5cf51_amadey_darkgate_elex_smoke-loader_stop.exe
1464	2026-07-11_dd2bd3f379140151ad91f9faa7d5cf51_amadey_darkgate_elex_smoke-loader_stop.exe
1464	2026-07-11_dd2bd3f379140151ad91f9faa7d5cf51_amadey_darkgate_elex_smoke-loader_stop.exe
1464	2026-07-11_dd2bd3f379140151ad91f9faa7d5cf51_amadey_darkgate_elex_smoke-loader_stop.exe
1464	2026-07-11_dd2bd3f379140151ad91f9faa7d5cf51_amadey_darkgate_elex_smoke-loader_stop.exe
1464	2026-07-11_dd2bd3f379140151ad91f9faa7d5cf51_amadey_darkgate_elex_smoke-loader_stop.exe
1464	2026-07-11_dd2bd3f379140151ad91f9faa7d5cf51_amadey_darkgate_elex_smoke-loader_stop.exe
1464	2026-07-11_dd2bd3f379140151ad91f9faa7d5cf51_amadey_darkgate_elex_smoke-loader_stop.exe
1464	2026-07-11_dd2bd3f379140151ad91f9faa7d5cf51_amadey_darkgate_elex_smoke-loader_stop.exe
1464	2026-07-11_dd2bd3f379140151ad91f9faa7d5cf51_amadey_darkgate_elex_smoke-loader_stop.exe
1464	2026-07-11_dd2bd3f379140151ad91f9faa7d5cf51_amadey_darkgate_elex_smoke-loader_stop.exe
1464	2026-07-11_dd2bd3f379140151ad91f9faa7d5cf51_amadey_darkgate_elex_smoke-loader_stop.exe
1464	2026-07-11_dd2bd3f379140151ad91f9faa7d5cf51_amadey_darkgate_elex_smoke-loader_stop.exe
1464	2026-07-11_dd2bd3f379140151ad91f9faa7d5cf51_amadey_darkgate_elex_smoke-loader_stop.exe
1464	2026-07-11_dd2bd3f379140151ad91f9faa7d5cf51_amadey_darkgate_elex_smoke-loader_stop.exe
1464	2026-07-11_dd2bd3f379140151ad91f9faa7d5cf51_amadey_darkgate_elex_smoke-loader_stop.exe
1464	2026-07-11_dd2bd3f379140151ad91f9faa7d5cf51_amadey_darkgate_elex_smoke-loader_stop.exe
1464	2026-07-11_dd2bd3f379140151ad91f9faa7d5cf51_amadey_darkgate_elex_smoke-loader_stop.exe
1464	2026-07-11_dd2bd3f379140151ad91f9faa7d5cf51_amadey_darkgate_elex_smoke-loader_stop.exe
1464	2026-07-11_dd2bd3f379140151ad91f9faa7d5cf51_amadey_darkgate_elex_smoke-loader_stop.exe
1464	2026-07-11_dd2bd3f379140151ad91f9faa7d5cf51_amadey_darkgate_elex_smoke-loader_stop.exe
1464	2026-07-11_dd2bd3f379140151ad91f9faa7d5cf51_amadey_darkgate_elex_smoke-loader_stop.exe
1464	2026-07-11_dd2bd3f379140151ad91f9faa7d5cf51_amadey_darkgate_elex_smoke-loader_stop.exe
1464	2026-07-11_dd2bd3f379140151ad91f9faa7d5cf51_amadey_darkgate_elex_smoke-loader_stop.exe
1464	2026-07-11_dd2bd3f379140151ad91f9faa7d5cf51_amadey_darkgate_elex_smoke-loader_stop.exe
1464	2026-07-11_dd2bd3f379140151ad91f9faa7d5cf51_amadey_darkgate_elex_smoke-loader_stop.exe
1464	2026-07-11_dd2bd3f379140151ad91f9faa7d5cf51_amadey_darkgate_elex_smoke-loader_stop.exe
1464	2026-07-11_dd2bd3f379140151ad91f9faa7d5cf51_amadey_darkgate_elex_smoke-loader_stop.exe
1464	2026-07-11_dd2bd3f379140151ad91f9faa7d5cf51_amadey_darkgate_elex_smoke-loader_stop.exe
1464	2026-07-11_dd2bd3f379140151ad91f9faa7d5cf51_amadey_darkgate_elex_smoke-loader_stop.exe
1464	2026-07-11_dd2bd3f379140151ad91f9faa7d5cf51_amadey_darkgate_elex_smoke-loader_stop.exe
1464	2026-07-11_dd2bd3f379140151ad91f9faa7d5cf51_amadey_darkgate_elex_smoke-loader_stop.exe
1464	2026-07-11_dd2bd3f379140151ad91f9faa7d5cf51_amadey_darkgate_elex_smoke-loader_stop.exe
1464	2026-07-11_dd2bd3f379140151ad91f9faa7d5cf51_amadey_darkgate_elex_smoke-loader_stop.exe
1464	2026-07-11_dd2bd3f379140151ad91f9faa7d5cf51_amadey_darkgate_elex_smoke-loader_stop.exe
1464	2026-07-11_dd2bd3f379140151ad91f9faa7d5cf51_amadey_darkgate_elex_smoke-loader_stop.exe
1464	2026-07-11_dd2bd3f379140151ad91f9faa7d5cf51_amadey_darkgate_elex_smoke-loader_stop.exe
1464	2026-07-11_dd2bd3f379140151ad91f9faa7d5cf51_amadey_darkgate_elex_smoke-loader_stop.exe
1464	2026-07-11_dd2bd3f379140151ad91f9faa7d5cf51_amadey_darkgate_elex_smoke-loader_stop.exe
1464	2026-07-11_dd2bd3f379140151ad91f9faa7d5cf51_amadey_darkgate_elex_smoke-loader_stop.exe
1464	2026-07-11_dd2bd3f379140151ad91f9faa7d5cf51_amadey_darkgate_elex_smoke-loader_stop.exe
1464	2026-07-11_dd2bd3f379140151ad91f9faa7d5cf51_amadey_darkgate_elex_smoke-loader_stop.exe
1464	2026-07-11_dd2bd3f379140151ad91f9faa7d5cf51_amadey_darkgate_elex_smoke-loader_stop.exe
1464	2026-07-11_dd2bd3f379140151ad91f9faa7d5cf51_amadey_darkgate_elex_smoke-loader_stop.exe
1464	2026-07-11_dd2bd3f379140151ad91f9faa7d5cf51_amadey_darkgate_elex_smoke-loader_stop.exe
1464	2026-07-11_dd2bd3f379140151ad91f9faa7d5cf51_amadey_darkgate_elex_smoke-loader_stop.exe
1464	2026-07-11_dd2bd3f379140151ad91f9faa7d5cf51_amadey_darkgate_elex_smoke-loader_stop.exe
1464	2026-07-11_dd2bd3f379140151ad91f9faa7d5cf51_amadey_darkgate_elex_smoke-loader_stop.exe
3552	yvqnlidbvqnljdby.exe
3552	yvqnlidbvqnljdby.exe
3552	yvqnlidbvqnljdby.exe
3552	yvqnlidbvqnljdby.exe
3552	yvqnlidbvqnljdby.exe
3552	yvqnlidbvqnljdby.exe
3552	yvqnlidbvqnljdby.exe
3552	yvqnlidbvqnljdby.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	5420	i_fdyvtnigay.exe
Token: SeDebugPrivilege	4920	i_davtnlfdxv.exe
Token: SeDebugPrivilege	2144	i_pmkicausnk.exe
Token: SeDebugPrivilege	3212	i_nhfarpjhcz.exe
Token: SeDebugPrivilege	2464	i_omkeczuomk.exe
Token: SeDebugPrivilege	4504	i_trpjhbzurm.exe
Token: SeDebugPrivilege	3820	i_mgebztqomg.exe
Token: SeDebugPrivilege	3048	i_trljdbytrl.exe
Token: SeDebugPrivilege	4160	i_gaysqnigdb.exe
Token: SeDebugPrivilege	2148	i_faysqkicay.exe
Token: SeDebugPrivilege	2996	i_qkicavsnki.exe
Token: SeDebugPrivilege	1904	i_mkicausmkf.exe
Token: SeDebugPrivilege	4980	i_hczusmkecw.exe
Token: SeDebugPrivilege	5164	i_cwurmjeczu.exe
Token: SeDebugPrivilege	4200	i_gbztrljecw.exe
Token: SeDebugPrivilege	5864	i_bytroljdby.exe
Token: SeDebugPrivilege	3140	i_bvtnlgaysq.exe
Token: SeDebugPrivilege	2364	i_aytqlidbvt.exe
Token: SeDebugPrivilege	5364	i_aysqnifdxv.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1556	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1464 wrote to memory of 3552	1464	2026-07-11_dd2bd3f379140151ad91f9faa7d5cf51_amadey_darkgate_elex_smoke-loader_stop.exe	87
PID 1464 wrote to memory of 4868	1464	2026-07-11_dd2bd3f379140151ad91f9faa7d5cf51_amadey_darkgate_elex_smoke-loader_stop.exe	88
PID 4868 wrote to memory of 1556	4868	iexplore.exe	89
PID 1556 wrote to memory of 3268	1556	msedge.exe	90
PID 1556 wrote to memory of 4968	1556	msedge.exe	91
PID 1556 wrote to memory of 5140	1556	msedge.exe	93
PID 1556 wrote to memory of 4968	1556	msedge.exe	91
PID 1556 wrote to memory of 4968	1556	msedge.exe	91
PID 1556 wrote to memory of 2812	1556	msedge.exe	94
PID 1556 wrote to memory of 2812	1556	msedge.exe	94
PID 1556 wrote to memory of 5680	1556	msedge.exe	95
PID 1556 wrote to memory of 5680	1556	msedge.exe	95
PID 1556 wrote to memory of 5680	1556	msedge.exe	95
PID 1556 wrote to memory of 2968	1556	msedge.exe	96
PID 1556 wrote to memory of 2968	1556	msedge.exe	96
PID 1556 wrote to memory of 2968	1556	msedge.exe	96
PID 1556 wrote to memory of 4112	1556	msedge.exe	97
PID 1556 wrote to memory of 1412	1556	msedge.exe	98
PID 1556 wrote to memory of 4112	1556	msedge.exe	97
PID 1556 wrote to memory of 4112	1556	msedge.exe	97
PID 1556 wrote to memory of 1412	1556	msedge.exe	98
PID 1556 wrote to memory of 1412	1556	msedge.exe	98
PID 1556 wrote to memory of 3780	1556	msedge.exe	99
PID 1556 wrote to memory of 3780	1556	msedge.exe	99
PID 3552 wrote to memory of 5028	3552	yvqnlidbvqnljdby.exe	103
PID 1556 wrote to memory of 3804	1556	msedge.exe	106
PID 1556 wrote to memory of 1312	1556	msedge.exe	107
PID 1556 wrote to memory of 3804	1556	msedge.exe	106
PID 1556 wrote to memory of 1312	1556	msedge.exe	107
PID 5460 wrote to memory of 2788	5460	fdyvtnigay.exe	108
PID 1556 wrote to memory of 4740	1556	msedge.exe	112
PID 1556 wrote to memory of 4876	1556	msedge.exe	113
PID 1556 wrote to memory of 4876	1556	msedge.exe	113
PID 1556 wrote to memory of 5956	1556	msedge.exe	116
PID 1556 wrote to memory of 5956	1556	msedge.exe	116
PID 3552 wrote to memory of 1912	3552	yvqnlidbvqnljdby.exe	118
PID 3552 wrote to memory of 1204	3552	yvqnlidbvqnljdby.exe	122
PID 5540 wrote to memory of 5176	5540	davtnlfdxv.exe	124
PID 3552 wrote to memory of 1620	3552	yvqnlidbvqnljdby.exe	127
PID 3552 wrote to memory of 4672	3552	yvqnlidbvqnljdby.exe	131
PID 3004 wrote to memory of 1996	3004	pmkicausnk.exe	133
PID 3552 wrote to memory of 4324	3552	yvqnlidbvqnljdby.exe	136
PID 3552 wrote to memory of 2424	3552	yvqnlidbvqnljdby.exe	141
PID 1816 wrote to memory of 2440	1816	nhfarpjhcz.exe	143
PID 3552 wrote to memory of 3100	3552	yvqnlidbvqnljdby.exe	146
PID 1556 wrote to memory of 3048	1556	msedge.exe	148
PID 1556 wrote to memory of 1596	1556	msedge.exe	149
PID 1556 wrote to memory of 4712	1556	msedge.exe	150
PID 3552 wrote to memory of 3356	3552	yvqnlidbvqnljdby.exe	153
PID 5104 wrote to memory of 1472	5104	omkeczuomk.exe	155
PID 3552 wrote to memory of 1448	3552	yvqnlidbvqnljdby.exe	158
PID 3552 wrote to memory of 5936	3552	yvqnlidbvqnljdby.exe	162
PID 5800 wrote to memory of 1188	5800	trpjhbzurm.exe	164
PID 3552 wrote to memory of 556	3552	yvqnlidbvqnljdby.exe	167
PID 3552 wrote to memory of 760	3552	yvqnlidbvqnljdby.exe	171
PID 4264 wrote to memory of 1136	4264	mgebztqomg.exe	173
PID 3552 wrote to memory of 1120	3552	yvqnlidbvqnljdby.exe	176
PID 3552 wrote to memory of 3036	3552	yvqnlidbvqnljdby.exe	180
PID 5832 wrote to memory of 5424	5832	trljdbytrl.exe	182
PID 3552 wrote to memory of 1360	3552	yvqnlidbvqnljdby.exe	185
PID 1556 wrote to memory of 4576	1556	msedge.exe	187
PID 1556 wrote to memory of 4576	1556	msedge.exe	187
PID 3552 wrote to memory of 860	3552	yvqnlidbvqnljdby.exe	193
PID 1960 wrote to memory of 4660	1960	gaysqnigdb.exe	195

C:\Users\Admin\AppData\Local\Temp\2026-07-11_dd2bd3f379140151ad91f9faa7d5cf51_amadey_darkgate_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-11_dd2bd3f379140151ad91f9faa7d5cf51_amadey_darkgate_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Temp\yvqnlidbvqnljdby.exe
  C:\Temp\yvqnlidbvqnljdby.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3552
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fdyvtnigay.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5028
  - - C:\Temp\fdyvtnigay.exe
      C:\Temp\fdyvtnigay.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5460
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2788
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4252
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fdyvtnigay.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1912
  - - C:\Temp\i_fdyvtnigay.exe
      C:\Temp\i_fdyvtnigay.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5420
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\davtnlfdxv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1204
  - - C:\Temp\davtnlfdxv.exe
      C:\Temp\davtnlfdxv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5540
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5176
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3400
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_davtnlfdxv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1620
  - - C:\Temp\i_davtnlfdxv.exe
      C:\Temp\i_davtnlfdxv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4920
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pmkicausnk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4672
  - - C:\Temp\pmkicausnk.exe
      C:\Temp\pmkicausnk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3004
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1996
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4420
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pmkicausnk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4324
  - - C:\Temp\i_pmkicausnk.exe
      C:\Temp\i_pmkicausnk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2144
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nhfarpjhcz.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2424
  - - C:\Temp\nhfarpjhcz.exe
      C:\Temp\nhfarpjhcz.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1816
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2440
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:696
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nhfarpjhcz.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3100
  - - C:\Temp\i_nhfarpjhcz.exe
      C:\Temp\i_nhfarpjhcz.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3212
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\omkeczuomk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3356
  - - C:\Temp\omkeczuomk.exe
      C:\Temp\omkeczuomk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5104
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1472
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4472
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_omkeczuomk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1448
  - - C:\Temp\i_omkeczuomk.exe
      C:\Temp\i_omkeczuomk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2464
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\trpjhbzurm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5936
  - - C:\Temp\trpjhbzurm.exe
      C:\Temp\trpjhbzurm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5800
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1188
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5368
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_trpjhbzurm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:556
  - - C:\Temp\i_trpjhbzurm.exe
      C:\Temp\i_trpjhbzurm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4504
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mgebztqomg.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:760
  - - C:\Temp\mgebztqomg.exe
      C:\Temp\mgebztqomg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4264
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1136
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3668
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mgebztqomg.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1120
  - - C:\Temp\i_mgebztqomg.exe
      C:\Temp\i_mgebztqomg.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3820
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\trljdbytrl.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3036
  - - C:\Temp\trljdbytrl.exe
      C:\Temp\trljdbytrl.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5832
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5424
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4172
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_trljdbytrl.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1360
  - - C:\Temp\i_trljdbytrl.exe
      C:\Temp\i_trljdbytrl.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3048
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gaysqnigdb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:860
  - - C:\Temp\gaysqnigdb.exe
      C:\Temp\gaysqnigdb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1960
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4660
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2428
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gaysqnigdb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5592
  - - C:\Temp\i_gaysqnigdb.exe
      C:\Temp\i_gaysqnigdb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4160
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\faysqkicay.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4636
  - - C:\Temp\faysqkicay.exe
      C:\Temp\faysqkicay.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4752
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4864
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3668
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_faysqkicay.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2344
  - - C:\Temp\i_faysqkicay.exe
      C:\Temp\i_faysqkicay.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2148
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qkicavsnki.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3576
  - - C:\Temp\qkicavsnki.exe
      C:\Temp\qkicavsnki.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2348
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:984
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1348
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qkicavsnki.exe ups_ins
    3⤵
    PID:5960
  - - C:\Temp\i_qkicavsnki.exe
      C:\Temp\i_qkicavsnki.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2996
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mkicausmkf.exe ups_run
    3⤵
    PID:1084
  - - C:\Temp\mkicausmkf.exe
      C:\Temp\mkicausmkf.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2464
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4688
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5868
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mkicausmkf.exe ups_ins
    3⤵
    PID:4796
  - - C:\Temp\i_mkicausmkf.exe
      C:\Temp\i_mkicausmkf.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1904
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hczusmkecw.exe ups_run
    3⤵
    PID:3028
  - - C:\Temp\hczusmkecw.exe
      C:\Temp\hczusmkecw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3464
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2652
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2008
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hczusmkecw.exe ups_ins
    3⤵
    PID:4612
  - - C:\Temp\i_hczusmkecw.exe
      C:\Temp\i_hczusmkecw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4980
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cwurmjeczu.exe ups_run
    3⤵
    PID:1044
  - - C:\Temp\cwurmjeczu.exe
      C:\Temp\cwurmjeczu.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4548
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2760
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3108
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cwurmjeczu.exe ups_ins
    3⤵
    PID:2148
  - - C:\Temp\i_cwurmjeczu.exe
      C:\Temp\i_cwurmjeczu.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5164
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gbztrljecw.exe ups_run
    3⤵
    PID:5840
  - - C:\Temp\gbztrljecw.exe
      C:\Temp\gbztrljecw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1396
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2336
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:784
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gbztrljecw.exe ups_ins
    3⤵
    PID:1992
  - - C:\Temp\i_gbztrljecw.exe
      C:\Temp\i_gbztrljecw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4200
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bytroljdby.exe ups_run
    3⤵
    PID:2852
  - - C:\Temp\bytroljdby.exe
      C:\Temp\bytroljdby.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2044
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5024
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4332
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bytroljdby.exe ups_ins
    3⤵
    PID:1748
  - - C:\Temp\i_bytroljdby.exe
      C:\Temp\i_bytroljdby.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5864
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bvtnlgaysq.exe ups_run
    3⤵
    PID:2528
  - - C:\Temp\bvtnlgaysq.exe
      C:\Temp\bvtnlgaysq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4504
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2700
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2680
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bvtnlgaysq.exe ups_ins
    3⤵
    PID:4260
  - - C:\Temp\i_bvtnlgaysq.exe
      C:\Temp\i_bvtnlgaysq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3140
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\aytqlidbvt.exe ups_run
    3⤵
    PID:248
  - - C:\Temp\aytqlidbvt.exe
      C:\Temp\aytqlidbvt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5640
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6052
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1420
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_aytqlidbvt.exe ups_ins
    3⤵
    PID:3896
  - - C:\Temp\i_aytqlidbvt.exe
      C:\Temp\i_aytqlidbvt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2364
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\aysqnifdxv.exe ups_run
    3⤵
    PID:612
  - - C:\Temp\aysqnifdxv.exe
      C:\Temp\aysqnifdxv.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4620
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5444
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3784
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_aysqnifdxv.exe ups_ins
    3⤵
    PID:5912
  - - C:\Temp\i_aysqnifdxv.exe
      C:\Temp\i_aysqnifdxv.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5364
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7fffd37dc188,0x7fffd37dc194,0x7fffd37dc1a0
      4⤵
      PID:3268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,761108631882246622,7807951801609766127,262144 --field-trial-handle=2380,i,3009065821098298615,6922850884484151524,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:2
      4⤵
      PID:4968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1768,i,300699253466447809,307657776299969931,524288 --field-trial-handle=2380,i,3009065821098298615,6922850884484151524,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:11
      4⤵
      System Time Discovery
      PID:5140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2448,i,6272640192954276494,9594778955684357693,524288 --field-trial-handle=2380,i,3009065821098298615,6922850884484151524,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:13
      4⤵
      PID:2812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3592,i,936071024828278045,7418751738311800187,2097152 --field-trial-handle=2380,i,3009065821098298615,6922850884484151524,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
      4⤵
      PID:5680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3596,i,2351432023540246409,6476361728039180440,2097152 --field-trial-handle=2380,i,3009065821098298615,6922850884484151524,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
      4⤵
      PID:2968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4304,i,18392728261541328497,12288039648520865000,2097152 --field-trial-handle=2380,i,3009065821098298615,6922850884484151524,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:1
      4⤵
      PID:4112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4336,i,9858068052193012863,2658776777317587066,2097152 --field-trial-handle=2380,i,3009065821098298615,6922850884484151524,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:9
      4⤵
      PID:1412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,9437956328093913078,10743449488625967315,524288 --field-trial-handle=2380,i,3009065821098298615,6922850884484151524,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:14
      4⤵
      PID:3780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,14233607507237573317,6862693702453466105,524288 --field-trial-handle=2380,i,3009065821098298615,6922850884484151524,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:14
      4⤵
      PID:3804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,2360154918638214913,3409852836943655626,524288 --field-trial-handle=2380,i,3009065821098298615,6922850884484151524,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:14
      4⤵
      PID:1312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,4006132128698848734,2593620772014925238,524288 --field-trial-handle=2380,i,3009065821098298615,6922850884484151524,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
      4⤵
      PID:2008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,4006132128698848734,2593620772014925238,524288 --field-trial-handle=2380,i,3009065821098298615,6922850884484151524,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
      4⤵
      PID:4740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,8159711757583918854,9083338946366534217,524288 --field-trial-handle=2380,i,3009065821098298615,6922850884484151524,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:14
      4⤵
      PID:4876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,1992045571065476624,2193401845741874210,524288 --field-trial-handle=2380,i,3009065821098298615,6922850884484151524,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:14
      4⤵
      PID:5956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=744,i,9002268761692494286,11529377381429617299,524288 --field-trial-handle=2380,i,3009065821098298615,6922850884484151524,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:14
      4⤵
      PID:3048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4788,i,9274595501050883031,7443855565898903011,524288 --field-trial-handle=2380,i,3009065821098298615,6922850884484151524,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:14
      4⤵
      PID:1596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4784,i,16473670575411981614,10798121174329571232,524288 --field-trial-handle=2380,i,3009065821098298615,6922850884484151524,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:14
      4⤵
      PID:4712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4336,i,6825082164319349831,12990848276940073013,524288 --field-trial-handle=2380,i,3009065821098298615,6922850884484151524,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:14
      4⤵
      PID:4576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5700,i,13903190948687852532,9679532025296754309,524288 --field-trial-handle=2380,i,3009065821098298615,6922850884484151524,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:14
      4⤵
      PID:5504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,6933493216503715223,6766680839230515305,524288 --field-trial-handle=2380,i,3009065821098298615,6922850884484151524,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:14
      4⤵
      PID:5136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,5405883669214068162,10295115111003150150,524288 --field-trial-handle=2380,i,3009065821098298615,6922850884484151524,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:14
      4⤵
      PID:1964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2868,i,3209771445164211908,4520592248497487204,262144 --field-trial-handle=2380,i,3009065821098298615,6922850884484151524,262144 --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:10
      4⤵
      PID:2608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,1511076114553877367,14516698907375177612,524288 --field-trial-handle=2380,i,3009065821098298615,6922850884484151524,262144 --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:14
      4⤵
      PID:5404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6568,i,10919213826843018919,14165432292475304514,524288 --field-trial-handle=2380,i,3009065821098298615,6922850884484151524,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:14
      4⤵
      PID:5672

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2944

C:\Temp\yvqnlidbvqnljdby.sys
C:\Temp\yvqnlidbvqnljdby.sys
1⤵
- Executes dropped EXE
PID:5072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3404

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5296

C:\Temp\kifaysqnif.sys
C:\Temp\kifaysqnif.sys
1⤵
- Executes dropped EXE
PID:3600

C:\Temp\fausnkfcxv.sys
C:\Temp\fausnkfcxv.sys
1⤵
- Executes dropped EXE
PID:5100

C:\Temp\kecxupnkec.sys
C:\Temp\kecxupnkec.sys
1⤵
- Executes dropped EXE
PID:2092

C:\Temp\zxrpjhecwu.sys
C:\Temp\zxrpjhecwu.sys
1⤵
- Executes dropped EXE
PID:4668

C:\Temp\zwurmjezwr.sys
C:\Temp\zwurmjezwr.sys
1⤵
- Executes dropped EXE
PID:5624

C:\Temp\jhbztroljd.sys
C:\Temp\jhbztroljd.sys
1⤵
- Executes dropped EXE
PID:3464

C:\Temp\qoigaytqlj.sys
C:\Temp\qoigaytqlj.sys
1⤵
- Executes dropped EXE
PID:2828

C:\Temp\aytqljdbvt.sys
C:\Temp\aytqljdbvt.sys
1⤵
- Executes dropped EXE
PID:5444

C:\Temp\ifdxvtnlfd.sys
C:\Temp\ifdxvtnlfd.sys
1⤵
- Executes dropped EXE
PID:772

C:\Temp\vsnkfdxvpn.sys
C:\Temp\vsnkfdxvpn.sys
1⤵
- Executes dropped EXE
PID:1972

C:\Temp\spkicaxvpn.sys
C:\Temp\spkicaxvpn.sys
1⤵
PID:5024

C:\Temp\usmkecxupn.sys
C:\Temp\usmkecxupn.sys
1⤵
PID:2012

C:\Temp\bzurmjhezx.sys
C:\Temp\bzurmjhezx.sys
1⤵
PID:5856

C:\Temp\jebwuomjec.sys
C:\Temp\jebwuomjec.sys
1⤵
PID:248

C:\Temp\bywqomjdbw.sys
C:\Temp\bywqomjdbw.sys
1⤵
PID:4772

C:\Temp\rljdbvtolg.sys
C:\Temp\rljdbvtolg.sys
1⤵
PID:2448

C:\Temp\aysqolfdyv.sys
C:\Temp\aysqolfdyv.sys
1⤵
PID:5004

C:\Temp\aysqkifaxv.sys
C:\Temp\aysqkifaxv.sys
1⤵
PID:3240

C:\Temp\xspniczxsp.sys
C:\Temp\xspniczxsp.sys
1⤵
PID:3516

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

davtnlfdxv.exe

Path C:\Temp\davtnlfdxv.exe
Size 384KB
SHA256 7962dc38ff0ba4ebcb1f6608baccb12b1fbb973343d8029bc0e670a4a1cc04da
MD5 fd281167000e74cccf3e421902550d54
SHA1 9626c93f5ee83f0348f39909f8426f88b42edee3
SHA512 317ad64570fef0bb11611eb5f99d336aa7dd8a2fb6b807e0c91d3acce3251cc45241253d2ae14ad069f12d85b76444816896ba0f4853e024ab56b920cc9b1dc8
SSDEEP 3072:m9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:UctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T175846A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fausnkfcxv.sys

Path C:\Temp\fausnkfcxv.sys
Size 293KB
SHA256 e963158204eea83a2e905578802f67f76c29a72af6ad2e5af35216a30fb77c74
MD5 8a4f986a4255ab489f1f083a6fbcc15c
SHA1 688cf94a0169a854158d2d53951051d4fb4f8cc9
SHA512 633bd5a11c595358d614138d2485e84b34c5d5a9445e84f901468b453817493cff58a6e46409bbb427bbf829698c4723d3bc953e1fcd235ab10679b0635e1a3b
SSDEEP 3072:wtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:wIJjiJcbI03GBc3ucY5DCSj
TLSH
T150545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdyvtnigay.exe

Path C:\Temp\fdyvtnigay.exe
Size 384KB
SHA256 fed972b16ebedbbfbfab1aa1ecbdd8138e1ffcf6e62d862c11bfbeefdef1b9ae
MD5 065fa61daa27b0dce04018a010809f1f
SHA1 3822dba490d0859169051751f5ee453bd390bc3e
SHA512 39cb9f1dbe903973c01ad8465b81fc519d359aaad26623e634eea6feddded7060f64e6b363de6f0594d999faadd48c7ca25afee676d4efba439e049c39de752b
SSDEEP 3072:A9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:SctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T140847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_davtnlfdxv.exe

Path C:\Temp\i_davtnlfdxv.exe
Size 384KB
SHA256 70248df823edd58036ce4800323914b22a623a6c674e7a5330c5fa69407a081e
MD5 65ea356533e50eb86295a73e111bb88c
SHA1 d75d1e84da2c7aeed0c4ecb7a884d932446f116e
SHA512 2b23ca0fd660def0fcfdc96821b36ae1681501531d03c3d49f8ef71dc5a89bff27e7f766de9addd7634351ad25a7fe5c4cfed7e0545caeb8aabe2002d406096b
SSDEEP 3072:w9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:CctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T15C847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fdyvtnigay.exe

Path C:\Temp\i_fdyvtnigay.exe
Size 384KB
SHA256 1ef180a10d8fc9bb5b92609ae7b67ced06e563c08f9a1eaf595874bd36ff03f8
MD5 a33506bfd231a4ef228bedf3bcbe6120
SHA1 c60e69995d617a41ec52a68b001d27b70bfb717a
SHA512 16361af1ca11fdaaf8ae1e670ba33f631087402dbf17b3622fff6435f33805c53df231d03e64e35769683f2c26483ad9924e8f837308eafde77e579ed7df24ac
SSDEEP 3072:e9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:8ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B1846A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nhfarpjhcz.exe

Path C:\Temp\i_nhfarpjhcz.exe
Size 384KB
SHA256 588300cd9a92d7ac8be9df356ce6d7855f0e0d26540920847ea3152e1ef323d4
MD5 714a6a450041c4d53115fab8894b39e7
SHA1 769855b7bffd1a6c34a02e0a11ba72993b4dcab3
SHA512 46c1d11ae70632f35d33108438fc08c8cb282022bcae9b610fcfe6fec9bcdde6be59c03db74a5d65b91749773bf67b8a54b66efce2f45483c5627e2b5e2a5b06
SSDEEP 3072:K9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:wctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E9847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_omkeczuomk.exe

Path C:\Temp\i_omkeczuomk.exe
Size 384KB
SHA256 8448e07dcaab866bc34040b1e5e0728249c636daf2d789d4f4d03d8b01286acf
MD5 b974df06d31a041de8abaf1daf7cd263
SHA1 a570035b03a0edf53c0be4c66b906167ef321ebb
SHA512 d1d96d9e9201bd18483eaf7bca27fac7d5bb39b761657dce20a6688e511063f285121fa404a2daf23a54d87b7f5f3551567d114ffac47fc17a6b644f09172054
SSDEEP 3072:49ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:6ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T13C847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pmkicausnk.exe

Path C:\Temp\i_pmkicausnk.exe
Size 384KB
SHA256 b80658d6fb18c1c9f02b4e31c30acdba3a6af1a9a0739a6cb74b3298e3079a43
MD5 a19ddc34927d52db18cb79e3d235c3ad
SHA1 9962e23636fc5902085b2c3b152484e21a8a9263
SHA512 716776fe88e2649799a65a96bfeb07451f67614bc468c4aaa6a112366954200b94b1384f1625455be1a1ab75f11c15ee8273e8988aeedbd64e9427bf0a51c222
SSDEEP 3072:99ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:PctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C7847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_trpjhbzurm.exe

Path C:\Temp\i_trpjhbzurm.exe
Size 384KB
SHA256 7ed8e5d9a5b146df9a56ec4e42c78630a390a6860ad87bbd9c8ebb2a2560b38d
MD5 b8c0e341fe1dcf6c0be52c6fecc4f0d6
SHA1 4df19999ff68cfdbc96201b581479ee3a47e4bee
SHA512 1e614db88c520eb752cedf30b11a375421e4ba3fdeff8da723000b1b4e46bb2359782f1ebfe693e79d091cec2c018eec20dc96ff6c7b93b7e9f994a6a1d83ace
SSDEEP 3072:D9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:hctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T136846A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kecxupnkec.sys

Path C:\Temp\kecxupnkec.sys
Size 293KB
SHA256 da345c6ed149f6c5c02142d3c0d0256555987f808d5114901b95a20a511f6648
MD5 76c08586be907a7048952604e87bdf5b
SHA1 9b260211611679eb113720789611dae02ebe6e34
SHA512 34a65f95587100efe9654367c51d1e45b22dbc676e257fe07070102ee389b0281544d1aae377f2e0924bd20c3eb8e6c3c4b8f9d0513ac3a0905c95e6f16e182c
SSDEEP 3072:UtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:UIJjiJcbI03GBc3ucY5DCSj
TLSH
T15C545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kifaysqnif.sys

Path C:\Temp\kifaysqnif.sys
Size 293KB
SHA256 be344dd7e9c2ec1afada2b232901c7a2981d16a92a376b7de5e1331367ee9870
MD5 7d460fc06b8954c6110a2f1907163083
SHA1 58c4c159e74c1956d2278681807357fc67e70406
SHA512 6e9d2d4db4b41243fcc575f3d83af1c1adbdb9a9c9f2575c52a3eb3d71934d7bb2c0d5b5670ad6a2f029734005a3a9e70add6982a849d0e64f514bc34d7b5047
SSDEEP 3072:utKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:uIJjiJcbI03GBc3ucY5DCSj
TLSH
T12C545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nhfarpjhcz.exe

Path C:\Temp\nhfarpjhcz.exe
Size 384KB
SHA256 7b4ed128e175fc9cadbb07a98ebbecaff61b3faecb020735f38d5b7719b2cdc9
MD5 f0dfcf535c9087f6cfccf09f60b013ad
SHA1 09fd49cab3aa5418a3901acd1c943914bb4b24b4
SHA512 0bb4549e6b2c7d8a8efcf91d5c2bb61684d53b960cf5459beda94d69d893df445bc8e6521b0944c13b74b669db7b9eda48bd3a1798c875c922b2ed3eb01a0c77
SSDEEP 3072:N9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:fctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T11A847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omkeczuomk.exe

Path C:\Temp\omkeczuomk.exe
Size 384KB
SHA256 693bd682c6a52c5c89fe1c758ca757133ee9624706ebb022c8295fe27543d50b
MD5 b197bba6a3c277710423e26b372ceb5e
SHA1 cc982d52d4df460e16f422dc7ff189e2d93bae18
SHA512 05c66993c912601f3c0e2e2bae322eb128b005c37ffb4ae8708d6c83dd5dfeacb9abe90e5153ffbc615738d9aa6f3ef8f93f35355e4f3a22bd7ce4d851c2b08c
SSDEEP 3072:g9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:yctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E3847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmkicausnk.exe

Path C:\Temp\pmkicausnk.exe
Size 384KB
SHA256 b08f3a52d5473cb5c332a5a276c87f043eb036079b181916c0b81eeaf872551c
MD5 c02624aa6e9ba4740639b1facb9e4607
SHA1 428818159b930ba403e318522062779086146f2d
SHA512 d0999ab6eae5729cd4fcda516148d32c06d278bab023706fbb107b1c2e932917075e6947ca917b5056b46cbf065db35bb1259e58b7998ef87b2908067f772f07
SSDEEP 3072:m9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:UctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1BF847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trpjhbzurm.exe

Path C:\Temp\trpjhbzurm.exe
Size 384KB
SHA256 067e267310ed51382c020b56679952a382ee8c3531fb615dc58370d025092521
MD5 30f9a771790135efd144814a83547e95
SHA1 89ca3693dc7f8c535d5c7f27acd5ed252c38e9cf
SHA512 9b381322c8dad140fadc56af7454053988489ff99482f7461d73e66a389f819849cd763638b4ca906042b2f68da49cd15511bbbf8614763f50924202d5bee250
SSDEEP 3072:K9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:wctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T183847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yvqnlidbvqnljdby.exe

Path C:\Temp\yvqnlidbvqnljdby.exe
Size 384KB
SHA256 80bc30421606c0a68b583a55417443286e3ee0036871fb2729dc09679d438a43
MD5 7445985a1a8a1e5cef2a7d228a7d8f7b
SHA1 b6b162e7d131f0845d476bdfe98ea02ece8f1d1a
SHA512 f821f409545918892f549771db6a62ec9bc09819b29ee4f42dd27ebd10046245d2a96ee4a0cfb06d2f30a04e848b7a971ad0b9c8b2743c51fbe720fa016dc7bd
SSDEEP 3072:69ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:gctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T12F847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yvqnlidbvqnljdby.sys

Path C:\Temp\yvqnlidbvqnljdby.sys
Size 293KB
SHA256 295a78679abc1c348bdfe34e21ab87e50e8e453b9cc94dd6740b5a6b32311cda
MD5 cde9631e00ec16b33521253e2f139268
SHA1 5578b6b3e8004b8214957f29dc81a7e29e009bab
SHA512 d031c12422ae58af7abdb94237d1767f27b17a75baf67e1bcea0820a28e41fa2b81d0bb80eb044c3dfb3b4c2172a26c320be547a6d58c610d30f4d51bd9d6467
SSDEEP 3072:gtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:gIJjiJcbI03GBc3ucY5DCSj
TLSH
T12C545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zwurmjezwr.sys

Path C:\Temp\zwurmjezwr.sys
Size 293KB
SHA256 a10237b0171e7d7484c88342cfbe8b3fc7b9bd4d201ca5f77b01820ae7a6357a
MD5 e13567cfe0b73c48cc6c6b441a7d633c
SHA1 4397b4e767d34bf4032470cdd44db029f89231e6
SHA512 2810924e5531b0f7ac78a684832f30ce2faf6717697f800bc264ed05c6f911b6edf643ec3e6b922b01c2edf771a63fbfb14ecf08af7d7747d225b29ea814a445
SSDEEP 3072:ctKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:cIJjiJcbI03GBc3ucY5DCSj
TLSH
T105545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxrpjhecwu.sys

Path C:\Temp\zxrpjhecwu.sys
Size 293KB
SHA256 40f971aab9a09c4d485bc21b2828295c435b8e4410da063c1699a865bb5427ff
MD5 85af2252ed25748cae332d8111a3688a
SHA1 c7a12cd6fb96a24a684ae970c8807d26b88b7ca9
SHA512 97b7051920b0c6c1b794ab599f91ee26d1095195a0bbaf122cab06cd8024db466b8da3c93249142f2e86a124c2b7e8bdbc5213d22d174cb303f65e2da687c828
SSDEEP 3072:/tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:/IJjiJcbI03GBc3ucY5DCSj
TLSH
T147545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 673a6f431a8d1253a64f85e9395388dc8573ff2fe52d41287bdeaac84266015b
MD5 908bef2e8b1ca2fff47a0069e7c074b8
SHA1 7e06f5561e65c6e365c29d2758e153990460f905
SHA512 244e952337500572044027715ffebe884a744b30711b9cf39c2dab86451d2e81ae9bf91066135ee4a3bffa7021b0932b530f5e999c152acff561e0b1989b30fc
TLSH
T13F512D512BAB1BD2C72687F19DEA046A76F1C84861CF6E30404E6C33AB02F2F5BD1023
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59eeac.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59eeac.TMP
Size 2KB
SHA256 e8df3c356c15d9b4f49ab2b2e262f651d8bc16b32bc9be8316f44789b55e7d10
MD5 1ae912abf5f988668cfb750fa50c6569
SHA1 e46e3932e8d6e4f6ce4dcb4f3ad4dcbcc3f7d8b6
SHA512 244c193efb7b3175881fc17492cbe50ab190d2494160dd38b5b05d1806f6dc4080a68374363c08043005ff418087fa8da96596ffaa456c77f47d5c0e14fc2a52
TLSH
T154513E512BAB5BD2C72687F1DDEA046A76F0C84861CF5E30404E6C336B02F2E5BD1023
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 bf34e477be36928adfcb651d0f4fe244c7673aebb75900043e6c652f899b5d43
MD5 75dd66e5936f1bcd840e7635d42e16cb
SHA1 97f88d7d8548fe16787dbe883d2f706718cedd83
SHA512 a3c4e26a67ece9e81f38aa3be096c413da382077d7ed06cd0bc224bbfd48ba7b1590e0cbc17e302675872eeb14458407b170d97e1ee4f5df3e463620c6eb6700
TLSH
T1EF41EEF3C3E4856D8A0195F0AA187E2FCE1C0914832C3D5AC9E4EF1B93E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 2baf5d651d134c78040883ff45e58977d7b7af20e60297e7f183932a744f9d5f
MD5 ef6a3e979c3f6eb980b74b8897574d23
SHA1 a4b4e882e1ed5b32aa053be6f7fc94046bdfbef0
SHA512 60cfa85111d9f230ba48f1c66b3582149b3dab8f637ee22f65d2c191e37d4b77c8f2ebd784ac6b10262cb1dca6b36e7883b21ad414e7cbb8373c7abada72ee5d
SSDEEP 192:sxRYRdyM/jK1Ml8wCZ/fls6UheZftzoA8pi/g6+WNIYoECYOGWIgtJ:sxRYN8Z/flsfhYfgi/5Ij73
TLSH
T1FE52DA156A28997BCCDBD20DFA557F93D6F81563A1901E44AAFCCB0C00E6AED121782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 ac0722b4833af885ce427f4d6d9e8bc911aa65fe954132425fa44c6559f003de
MD5 22b836c2b6b83b1c6a8c579a11123d86
SHA1 4258b489b952d15fdcf9160adeda5068d6c1393a
SHA512 712e83704be121a1caabf6ee1f34b89ffab80806c420b01931f91dbbf815be781b42031343ebe07b1f4d9c7edb5031c4347900b745faafc3e3d387494955e9ea
SSDEEP 192:sxRLRdyM/jK1Ml8wCZ/flswUheZf1zoA8p9X/g6+WNCBF/YoXCYOGWIgDQJ:sxRLv8Z/flslhYfY9/5+/y7g
TLSH
T12262DA15AA345D7B8CDBD209FA557F93D6F81563A2901E44AAFC8B0C00E6ADD221783F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 9970dd208606d885d89ac97e5587806ba282573ec755a0bec467fc577879e79f
MD5 0f14d87dcfbecde27f74481a4a4b3261
SHA1 70c20d5b98a27afd3d812f260b6b5f2cfc788507
SHA512 0074d101e7a2d20b8e5c38cffb87ed55371fd2e84d6b22061a3d5bf036ec0428be566e67f0601b111f4e52f366439ab1b3ce8c099455677cbe04f905510bd0c9
SSDEEP 192:sxRLRdyM/jK1Ml8UQWCZ/flswU0eZf1zoA8prX/g6+WNCBF/YoNCYOGWIgDGJ:sxRLvqRZ/flsl0YfYj/5+/o7O
TLSH
T13F62D915AA289D7BDCD7D209FA557F93D6F81463A1901E44AAFCCB0C00E6ADD221783F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 4dc22273e4f1e412952e4f15cb5acdc5dcf2a1213e3efa4bf835793b16ca2935
MD5 7a763ed4609eb6ec089c102541d509f7
SHA1 6e101342ff4c56924d435e7065f6e94c27ec46b1
SHA512 528cf4b5406d727a534c6416f3f3d86640e36992eeef77380c6ae0eed48da0dc4d1e6bbc8c32b163effa5e094c8bad9ea35b1ba9c5287f98324a31b1b62edd0f
SSDEEP 768:jXwHno7pLuL7gRWgs2fJ28F1+UoAYDCx9Tuqh0VfUC9xbog/OVr6pVuGIrockOeI:jXwHnUE7gRWgs2fJ2u1jaQ6p4Gzdvq
TLSH
T1D8E2EC3B680CCBBE4F40499DEC29BD9E6DA801CB96D88D5447FA840C03C6AEB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a8a01.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a8a01.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 507100f17117f99bbf1d552c72423f5209483153b0a32ff4925c721dee3f5521
MD5 e4415ef865c1ea4337d05af6358465d9
SHA1 2e1b1aeb8fe184a065fff5363773fbbe803a2921
SHA512 484672f0e9d812ab0163b7155fab7ba85dc623c6656ee6f888ad89122f88c93d6757952e27b37788da075bc1e63f12a2481d1b96547ff59ebef2675b273ed91f
SSDEEP 768:6j+9P3dNqX/TBOWGatDtjONXyer1IRCzni9nb9Mx:59P3dU/SIqnwb+x
TLSH
T17EF2BF31A4569E234CE2A3D6B3472797BFF8206BC5C40E44EEEE5F4E058765D170B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 1393169e08f8ccfd5f7d6f31234ebee3b12302591b0a696e21f10ab8b0ba53ca
MD5 fa4365400a39b73197eca987efe5a94a
SHA1 be3068d5b13a5d3823f865f371572466b3189e58
SHA512 9c81f4b274fe5c1415729096a906668595dcb0a873a434cb70cadc5d79f80d5e1835e427fdc0198e38b73d58a1ae8dbff7de57d188c07c6fe7c848184aaaf699
SSDEEP 768:hrv+4UNbdz36u/TBOWGa9ONXyer1IRCzniBveVH1SK7:hbsbV3jNSIqnAEH1l
TLSH
T1E503BF36A0A89E338DE2A386B14776037FF86057D6840B90EDDE2F4E069B59D130F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 f4e2bb1c39afd9f31dee25706295d754c9e7a7a0d0702b828a8dccc270af22a0
MD5 fbb58781ef785497bb6adde91f928230
SHA1 c140cd55333c4a786995bfadb8898cabf99d4a43
SHA512 e58c7aab1f55a1e118f3291c3799d6dff05592bae5622f1167f3960530247dbf52e3d7818a3cf4c7302ee52ec1a84a91817395f056ea5450cf9ae89e415b330d
SSDEEP 768:5j+9P3JNqX/TBOWGatDt6ONXyer1IRCzni9nb9Mx:k9P3JUGSIqnwb+x
TLSH
T1C9F2BF31A4569E234CD2A3D6B2472797FFF8206BC6C40E44EEEE5F4E058765D170B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 93e6c16fe04e398ac6849ff6115a0e94af81a85081a9eb9233047ba12a72e363
MD5 2e08f1f50f035a204e9aa57a79b6d6dc
SHA1 865a8cf93e7d9b34307df6498404b02eb1f877b9
SHA512 0723aecefb7e0a85c00ad1ba836289c891e240768e399faeed3c04574f21c63446da209938ea63686ef90aeff5fc1ed8d6c01feac436bc4e05caee838b582097
SSDEEP 768:pj+9P3MNpX/TBOWGatDt1ONXyer1IRCzni9nb9Mx:09P3MvJSIqnwb+x
TLSH
T1D9F2BF31A4569E234CD2A3D6B2473797BFF8206BC5C50E44EEEE5F4E058365D170B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 11f4cb579c01c650dc567822f05ee4f4333a2d7682c8380435c725ca5cdff305
MD5 d00a2c14c17082888b1bbaa08bf0c9e3
SHA1 13624ee153a6396431b14276e44b47fdc985d8a4
SHA512 fbe88338c523336ba21d5cfd1f601486987402fda1f105c657ef4f7f30dc127e9d97a0b547ee8ad7fb114682cd2bb04a65ed0af60f5d4381ac29afb5167318f7
SSDEEP 768:gFKj+9E3JwgmN7I0sOWGatDtKONXyer1IRCzni9nb9Mx:g9E3OOcSIqnwb+x
TLSH
T1631316F694D78A37D89E5783A33D2E469EFCD067B5884980BBD91E4DCC8217FC20A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

19016ec1-80c4-474e-a154-15076903b42c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\19016ec1-80c4-474e-a154-15076903b42c.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1556_1339794101\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 fb87c62ea0fbe2581847d602e10e4dd0300c7001482d4b3f14cdda35dbe7b75b
MD5 e0a544d4e3e66215be4e0dfbb1583cba
SHA1 3c871cdbcce13f2078b368d097a168a52e0ded86
SHA512 2dc2e5cd002f2ef67c0afe48e4deae79c3e101952ede0336a5de24fc4b7fbf26d1a7aab7ea9c782cfde19df65d82cee3211d3ecc0ad246ffbf83cb5277d4d474
TLSH
T1DA71048356A8C5B2C1DA5BF102835544F1BB22380763303007915586AA30A3558B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/248-444-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/772-354-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1972-380-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2012-441-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2012-420-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2092-273-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2092-294-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2448-482-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2828-346-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2828-329-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3240-514-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3464-325-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3516-518-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3600-197-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4668-285-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4772-464-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5004-486-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5024-407-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5072-230-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5072-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5100-245-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5444-377-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5444-344-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5624-306-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5856-439-0x0000000000010000-0x00000000000AB000-memory.dmp

Download