systex | f6aa177a3770bc1758b12abf58238d9dfe5fc6ec17f73585c7708defe2a46e92

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 12:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_e60c9e93073fa869188a5fbc1554241b_amadey_darkgate_elex_smoke-loader_stop.exe
Size 384KB
Sample260714-pm82psfs5v
SHA256 f6aa177a3770bc1758b12abf58238d9dfe5fc6ec17f73585c7708defe2a46e92
MD5 e60c9e93073fa869188a5fbc1554241b
SHA1 fc0092f3241684136e6359bfb5d0cedbb07060e1
SHA512 b1a85ba7440f209dad150a9aacb3cc48e06887c9669339d356856d3ab0cde8b75cc110928fd991fddebff3dcd27794567416c984892d40c6e149b853b7f698f5
SSDEEP 3072:u9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:MctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C0847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
4996	causmkecxupnhczx.exe
5356	causmkecxupnhczx.sys
2976	CreateProcess.exe
3764	xrpmkecxus.exe
1840	CreateProcess.exe
2308	CreateProcess.exe
3808	i_xrpmkecxus.exe
4724	pjhfrpjhcz.sys
1984	CreateProcess.exe
1272	zxojhbztrm.exe
2244	CreateProcess.exe
6068	CreateProcess.exe
1380	i_zxojhbztrm.exe
4924	gecwrpjhez.sys
1152	CreateProcess.exe
3212	wromhbwroj.exe
1120	CreateProcess.exe
3272	CreateProcess.exe
4788	i_wromhbwroj.exe
5720	gbztromgey.sys
928	CreateProcess.exe
5660	gbzwuolgdy.exe
5296	CreateProcess.exe
6088	CreateProcess.exe
4328	i_gbzwuolgdy.exe
5772	ljdaytqljg.sys
5356	CreateProcess.exe
4824	lgdywqoige.exe
1748	CreateProcess.exe
3920	CreateProcess.exe
1772	i_lgdywqoige.exe
592	avsqligays.sys
4708	CreateProcess.exe
4456	vsqkidavtn.exe
4480	CreateProcess.exe
4664	CreateProcess.exe
1232	i_vsqkidavtn.exe
4396	nlfdayvqni.sys
5968	CreateProcess.exe
2800	fcavspnhfd.exe
2824	CreateProcess.exe
1716	CreateProcess.exe
3644	i_fcavspnhfd.exe
5916	fdxvpnkfdx.sys
1768	CreateProcess.exe
420	faxsqkicau.exe
3184	CreateProcess.exe
3348	CreateProcess.exe
4028	i_faxsqkicau.exe
2324	pnhfzxspkh.sys
2392	CreateProcess.exe
2096	mkhczxspkh.exe
4876	CreateProcess.exe
5592	CreateProcess.exe
52	i_mkhczxspkh.exe
592	smkecwupmk.sys
892	CreateProcess.exe
3076	mhezxrpjhb.exe
1940	CreateProcess.exe
932	CreateProcess.exe
1856	i_mhezxrpjhb.exe
4684	ecwurmjwuo.sys
4000	CreateProcess.exe
5080	wtrljebwtr.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5148_1933823026\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5148_90383467\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5148_1994837718\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5148_1994837718\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5148_884188812\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5148_884188812\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5148_884188812\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5148_90383467\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5148_884188812\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbzwuolgdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtrljebwtr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwtnlgdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgdywqoige.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faxsqkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhezxrpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rojgbzljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igayvtnlig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	davsnlfays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ausmkfcxus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-14_e60c9e93073fa869188a5fbc1554241b_amadey_darkgate_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbzwuolgdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkhczxspkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkhczxspkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rojgbzljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwtnlgdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igayvtnlig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvhfcaxspn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpmkecxus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wromhbwroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvhfcaxspn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ausmkfcxus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsqkidavtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fcavspnhfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhezxrpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtrljebwtr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_davsnlfays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpmkecxus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxojhbztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wromhbwroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faxsqkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xupmhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomjebzwro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causmkecxupnhczx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxojhbztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgdywqoige.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsqkidavtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcavspnhfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xupmhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomjebzwro.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3084	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3800	ipconfig.exe
2204	ipconfig.exe
4216	ipconfig.exe
1232	ipconfig.exe
2416	ipconfig.exe
2236	ipconfig.exe
4396	ipconfig.exe
3996	ipconfig.exe
4940	ipconfig.exe
1704	ipconfig.exe
2504	ipconfig.exe
3404	ipconfig.exe
3936	ipconfig.exe
4512	ipconfig.exe
3320	ipconfig.exe
3320	ipconfig.exe
1380	ipconfig.exe
5704	ipconfig.exe
2016	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134285056902795041"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{3B021C90-0981-4156-AB15-25C09AA1093C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2712	2026-07-14_e60c9e93073fa869188a5fbc1554241b_amadey_darkgate_elex_smoke-loader_stop.exe
2712	2026-07-14_e60c9e93073fa869188a5fbc1554241b_amadey_darkgate_elex_smoke-loader_stop.exe
2712	2026-07-14_e60c9e93073fa869188a5fbc1554241b_amadey_darkgate_elex_smoke-loader_stop.exe
2712	2026-07-14_e60c9e93073fa869188a5fbc1554241b_amadey_darkgate_elex_smoke-loader_stop.exe
2712	2026-07-14_e60c9e93073fa869188a5fbc1554241b_amadey_darkgate_elex_smoke-loader_stop.exe
2712	2026-07-14_e60c9e93073fa869188a5fbc1554241b_amadey_darkgate_elex_smoke-loader_stop.exe
2712	2026-07-14_e60c9e93073fa869188a5fbc1554241b_amadey_darkgate_elex_smoke-loader_stop.exe
2712	2026-07-14_e60c9e93073fa869188a5fbc1554241b_amadey_darkgate_elex_smoke-loader_stop.exe
2712	2026-07-14_e60c9e93073fa869188a5fbc1554241b_amadey_darkgate_elex_smoke-loader_stop.exe
2712	2026-07-14_e60c9e93073fa869188a5fbc1554241b_amadey_darkgate_elex_smoke-loader_stop.exe
2712	2026-07-14_e60c9e93073fa869188a5fbc1554241b_amadey_darkgate_elex_smoke-loader_stop.exe
2712	2026-07-14_e60c9e93073fa869188a5fbc1554241b_amadey_darkgate_elex_smoke-loader_stop.exe
2712	2026-07-14_e60c9e93073fa869188a5fbc1554241b_amadey_darkgate_elex_smoke-loader_stop.exe
2712	2026-07-14_e60c9e93073fa869188a5fbc1554241b_amadey_darkgate_elex_smoke-loader_stop.exe
2712	2026-07-14_e60c9e93073fa869188a5fbc1554241b_amadey_darkgate_elex_smoke-loader_stop.exe
2712	2026-07-14_e60c9e93073fa869188a5fbc1554241b_amadey_darkgate_elex_smoke-loader_stop.exe
2712	2026-07-14_e60c9e93073fa869188a5fbc1554241b_amadey_darkgate_elex_smoke-loader_stop.exe
2712	2026-07-14_e60c9e93073fa869188a5fbc1554241b_amadey_darkgate_elex_smoke-loader_stop.exe
2712	2026-07-14_e60c9e93073fa869188a5fbc1554241b_amadey_darkgate_elex_smoke-loader_stop.exe
2712	2026-07-14_e60c9e93073fa869188a5fbc1554241b_amadey_darkgate_elex_smoke-loader_stop.exe
2712	2026-07-14_e60c9e93073fa869188a5fbc1554241b_amadey_darkgate_elex_smoke-loader_stop.exe
2712	2026-07-14_e60c9e93073fa869188a5fbc1554241b_amadey_darkgate_elex_smoke-loader_stop.exe
2712	2026-07-14_e60c9e93073fa869188a5fbc1554241b_amadey_darkgate_elex_smoke-loader_stop.exe
2712	2026-07-14_e60c9e93073fa869188a5fbc1554241b_amadey_darkgate_elex_smoke-loader_stop.exe
2712	2026-07-14_e60c9e93073fa869188a5fbc1554241b_amadey_darkgate_elex_smoke-loader_stop.exe
2712	2026-07-14_e60c9e93073fa869188a5fbc1554241b_amadey_darkgate_elex_smoke-loader_stop.exe
2712	2026-07-14_e60c9e93073fa869188a5fbc1554241b_amadey_darkgate_elex_smoke-loader_stop.exe
2712	2026-07-14_e60c9e93073fa869188a5fbc1554241b_amadey_darkgate_elex_smoke-loader_stop.exe
2712	2026-07-14_e60c9e93073fa869188a5fbc1554241b_amadey_darkgate_elex_smoke-loader_stop.exe
2712	2026-07-14_e60c9e93073fa869188a5fbc1554241b_amadey_darkgate_elex_smoke-loader_stop.exe
2712	2026-07-14_e60c9e93073fa869188a5fbc1554241b_amadey_darkgate_elex_smoke-loader_stop.exe
2712	2026-07-14_e60c9e93073fa869188a5fbc1554241b_amadey_darkgate_elex_smoke-loader_stop.exe
2712	2026-07-14_e60c9e93073fa869188a5fbc1554241b_amadey_darkgate_elex_smoke-loader_stop.exe
2712	2026-07-14_e60c9e93073fa869188a5fbc1554241b_amadey_darkgate_elex_smoke-loader_stop.exe
2712	2026-07-14_e60c9e93073fa869188a5fbc1554241b_amadey_darkgate_elex_smoke-loader_stop.exe
2712	2026-07-14_e60c9e93073fa869188a5fbc1554241b_amadey_darkgate_elex_smoke-loader_stop.exe
2712	2026-07-14_e60c9e93073fa869188a5fbc1554241b_amadey_darkgate_elex_smoke-loader_stop.exe
2712	2026-07-14_e60c9e93073fa869188a5fbc1554241b_amadey_darkgate_elex_smoke-loader_stop.exe
2712	2026-07-14_e60c9e93073fa869188a5fbc1554241b_amadey_darkgate_elex_smoke-loader_stop.exe
2712	2026-07-14_e60c9e93073fa869188a5fbc1554241b_amadey_darkgate_elex_smoke-loader_stop.exe
2712	2026-07-14_e60c9e93073fa869188a5fbc1554241b_amadey_darkgate_elex_smoke-loader_stop.exe
2712	2026-07-14_e60c9e93073fa869188a5fbc1554241b_amadey_darkgate_elex_smoke-loader_stop.exe
2712	2026-07-14_e60c9e93073fa869188a5fbc1554241b_amadey_darkgate_elex_smoke-loader_stop.exe
2712	2026-07-14_e60c9e93073fa869188a5fbc1554241b_amadey_darkgate_elex_smoke-loader_stop.exe
2712	2026-07-14_e60c9e93073fa869188a5fbc1554241b_amadey_darkgate_elex_smoke-loader_stop.exe
2712	2026-07-14_e60c9e93073fa869188a5fbc1554241b_amadey_darkgate_elex_smoke-loader_stop.exe
2712	2026-07-14_e60c9e93073fa869188a5fbc1554241b_amadey_darkgate_elex_smoke-loader_stop.exe
2712	2026-07-14_e60c9e93073fa869188a5fbc1554241b_amadey_darkgate_elex_smoke-loader_stop.exe
2712	2026-07-14_e60c9e93073fa869188a5fbc1554241b_amadey_darkgate_elex_smoke-loader_stop.exe
2712	2026-07-14_e60c9e93073fa869188a5fbc1554241b_amadey_darkgate_elex_smoke-loader_stop.exe
2712	2026-07-14_e60c9e93073fa869188a5fbc1554241b_amadey_darkgate_elex_smoke-loader_stop.exe
2712	2026-07-14_e60c9e93073fa869188a5fbc1554241b_amadey_darkgate_elex_smoke-loader_stop.exe
2712	2026-07-14_e60c9e93073fa869188a5fbc1554241b_amadey_darkgate_elex_smoke-loader_stop.exe
2712	2026-07-14_e60c9e93073fa869188a5fbc1554241b_amadey_darkgate_elex_smoke-loader_stop.exe
2712	2026-07-14_e60c9e93073fa869188a5fbc1554241b_amadey_darkgate_elex_smoke-loader_stop.exe
2712	2026-07-14_e60c9e93073fa869188a5fbc1554241b_amadey_darkgate_elex_smoke-loader_stop.exe
4996	causmkecxupnhczx.exe
4996	causmkecxupnhczx.exe
4996	causmkecxupnhczx.exe
4996	causmkecxupnhczx.exe
4996	causmkecxupnhczx.exe
4996	causmkecxupnhczx.exe
4996	causmkecxupnhczx.exe
4996	causmkecxupnhczx.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe
5148	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	3808	i_xrpmkecxus.exe
Token: SeDebugPrivilege	1380	i_zxojhbztrm.exe
Token: SeDebugPrivilege	4788	i_wromhbwroj.exe
Token: SeDebugPrivilege	4328	i_gbzwuolgdy.exe
Token: SeDebugPrivilege	1772	i_lgdywqoige.exe
Token: SeDebugPrivilege	1232	i_vsqkidavtn.exe
Token: SeDebugPrivilege	3644	i_fcavspnhfd.exe
Token: SeDebugPrivilege	4028	i_faxsqkicau.exe
Token: SeDebugPrivilege	52	i_mkhczxspkh.exe
Token: SeDebugPrivilege	1856	i_mhezxrpjhb.exe
Token: SeDebugPrivilege	4192	i_wtrljebwtr.exe
Token: SeDebugPrivilege	5768	i_rojgbzljdb.exe
Token: SeDebugPrivilege	1772	i_bwtnlgdbvt.exe
Token: SeDebugPrivilege	5928	i_igayvtnlig.exe
Token: SeDebugPrivilege	1304	i_davsnlfays.exe
Token: SeDebugPrivilege	3712	i_yvhfcaxspn.exe
Token: SeDebugPrivilege	472	i_ausmkfcxus.exe
Token: SeDebugPrivilege	4248	i_xupmhfzxrp.exe
Token: SeDebugPrivilege	1736	i_uomjebzwro.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5148	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2712 wrote to memory of 4996	2712	2026-07-14_e60c9e93073fa869188a5fbc1554241b_amadey_darkgate_elex_smoke-loader_stop.exe	87
PID 2712 wrote to memory of 2476	2712	2026-07-14_e60c9e93073fa869188a5fbc1554241b_amadey_darkgate_elex_smoke-loader_stop.exe	88
PID 2476 wrote to memory of 5148	2476	iexplore.exe	89
PID 5148 wrote to memory of 1464	5148	msedge.exe	90
PID 5148 wrote to memory of 4624	5148	msedge.exe	92
PID 5148 wrote to memory of 3084	5148	msedge.exe	93
PID 5148 wrote to memory of 4624	5148	msedge.exe	92
PID 5148 wrote to memory of 4624	5148	msedge.exe	92
PID 5148 wrote to memory of 5076	5148	msedge.exe	94
PID 5148 wrote to memory of 5076	5148	msedge.exe	94
PID 5148 wrote to memory of 2312	5148	msedge.exe	95
PID 5148 wrote to memory of 2312	5148	msedge.exe	95
PID 5148 wrote to memory of 2312	5148	msedge.exe	95
PID 5148 wrote to memory of 4548	5148	msedge.exe	96
PID 5148 wrote to memory of 4548	5148	msedge.exe	96
PID 5148 wrote to memory of 4548	5148	msedge.exe	96
PID 5148 wrote to memory of 1180	5148	msedge.exe	97
PID 5148 wrote to memory of 1180	5148	msedge.exe	97
PID 5148 wrote to memory of 1180	5148	msedge.exe	97
PID 5148 wrote to memory of 2904	5148	msedge.exe	98
PID 5148 wrote to memory of 2904	5148	msedge.exe	98
PID 5148 wrote to memory of 2904	5148	msedge.exe	98
PID 5148 wrote to memory of 5772	5148	msedge.exe	99
PID 5148 wrote to memory of 5772	5148	msedge.exe	99
PID 5148 wrote to memory of 4304	5148	msedge.exe	103
PID 5148 wrote to memory of 992	5148	msedge.exe	104
PID 5148 wrote to memory of 4304	5148	msedge.exe	103
PID 5148 wrote to memory of 992	5148	msedge.exe	104
PID 4996 wrote to memory of 2976	4996	causmkecxupnhczx.exe	105
PID 5148 wrote to memory of 1264	5148	msedge.exe	108
PID 3764 wrote to memory of 1840	3764	xrpmkecxus.exe	110
PID 5148 wrote to memory of 2396	5148	msedge.exe	115
PID 5148 wrote to memory of 2396	5148	msedge.exe	115
PID 5148 wrote to memory of 1904	5148	msedge.exe	116
PID 5148 wrote to memory of 1904	5148	msedge.exe	116
PID 4996 wrote to memory of 2308	4996	causmkecxupnhczx.exe	118
PID 4996 wrote to memory of 1984	4996	causmkecxupnhczx.exe	122
PID 1272 wrote to memory of 2244	1272	zxojhbztrm.exe	124
PID 4996 wrote to memory of 6068	4996	causmkecxupnhczx.exe	127
PID 4996 wrote to memory of 1152	4996	causmkecxupnhczx.exe	131
PID 3212 wrote to memory of 1120	3212	wromhbwroj.exe	133
PID 4996 wrote to memory of 3272	4996	causmkecxupnhczx.exe	136
PID 4996 wrote to memory of 928	4996	causmkecxupnhczx.exe	141
PID 5660 wrote to memory of 5296	5660	gbzwuolgdy.exe	143
PID 5148 wrote to memory of 4532	5148	msedge.exe	146
PID 5148 wrote to memory of 5552	5148	msedge.exe	147
PID 5148 wrote to memory of 1044	5148	msedge.exe	148
PID 4996 wrote to memory of 6088	4996	causmkecxupnhczx.exe	149
PID 4996 wrote to memory of 5356	4996	causmkecxupnhczx.exe	153
PID 4824 wrote to memory of 1748	4824	lgdywqoige.exe	155
PID 4996 wrote to memory of 3920	4996	causmkecxupnhczx.exe	158
PID 4996 wrote to memory of 4708	4996	causmkecxupnhczx.exe	162
PID 4456 wrote to memory of 4480	4456	vsqkidavtn.exe	164
PID 4996 wrote to memory of 4664	4996	causmkecxupnhczx.exe	167
PID 4996 wrote to memory of 5968	4996	causmkecxupnhczx.exe	171
PID 2800 wrote to memory of 2824	2800	fcavspnhfd.exe	173
PID 4996 wrote to memory of 1716	4996	causmkecxupnhczx.exe	176
PID 4996 wrote to memory of 1768	4996	causmkecxupnhczx.exe	180
PID 420 wrote to memory of 3184	420	faxsqkicau.exe	182
PID 5148 wrote to memory of 5884	5148	msedge.exe	185
PID 5148 wrote to memory of 5884	5148	msedge.exe	185
PID 4996 wrote to memory of 3348	4996	causmkecxupnhczx.exe	189
PID 4996 wrote to memory of 2392	4996	causmkecxupnhczx.exe	193
PID 2096 wrote to memory of 4876	2096	mkhczxspkh.exe	195

C:\Users\Admin\AppData\Local\Temp\2026-07-14_e60c9e93073fa869188a5fbc1554241b_amadey_darkgate_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_e60c9e93073fa869188a5fbc1554241b_amadey_darkgate_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2712
- C:\Temp\causmkecxupnhczx.exe
  C:\Temp\causmkecxupnhczx.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4996
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xrpmkecxus.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2976
  - - C:\Temp\xrpmkecxus.exe
      C:\Temp\xrpmkecxus.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3764
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1840
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1232
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xrpmkecxus.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2308
  - - C:\Temp\i_xrpmkecxus.exe
      C:\Temp\i_xrpmkecxus.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3808
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zxojhbztrm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1984
  - - C:\Temp\zxojhbztrm.exe
      C:\Temp\zxojhbztrm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1272
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2244
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4940
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zxojhbztrm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6068
  - - C:\Temp\i_zxojhbztrm.exe
      C:\Temp\i_zxojhbztrm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1380
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wromhbwroj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1152
  - - C:\Temp\wromhbwroj.exe
      C:\Temp\wromhbwroj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3212
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1120
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2416
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wromhbwroj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3272
  - - C:\Temp\i_wromhbwroj.exe
      C:\Temp\i_wromhbwroj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4788
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gbzwuolgdy.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:928
  - - C:\Temp\gbzwuolgdy.exe
      C:\Temp\gbzwuolgdy.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5660
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5296
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1704
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gbzwuolgdy.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6088
  - - C:\Temp\i_gbzwuolgdy.exe
      C:\Temp\i_gbzwuolgdy.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4328
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lgdywqoige.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5356
  - - C:\Temp\lgdywqoige.exe
      C:\Temp\lgdywqoige.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4824
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1748
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3800
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lgdywqoige.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3920
  - - C:\Temp\i_lgdywqoige.exe
      C:\Temp\i_lgdywqoige.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1772
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vsqkidavtn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4708
  - - C:\Temp\vsqkidavtn.exe
      C:\Temp\vsqkidavtn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4456
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4480
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2504
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vsqkidavtn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4664
  - - C:\Temp\i_vsqkidavtn.exe
      C:\Temp\i_vsqkidavtn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1232
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fcavspnhfd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5968
  - - C:\Temp\fcavspnhfd.exe
      C:\Temp\fcavspnhfd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2800
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2824
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2236
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fcavspnhfd.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1716
  - - C:\Temp\i_fcavspnhfd.exe
      C:\Temp\i_fcavspnhfd.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3644
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\faxsqkicau.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1768
  - - C:\Temp\faxsqkicau.exe
      C:\Temp\faxsqkicau.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:420
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3184
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3320
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_faxsqkicau.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3348
  - - C:\Temp\i_faxsqkicau.exe
      C:\Temp\i_faxsqkicau.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4028
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mkhczxspkh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2392
  - - C:\Temp\mkhczxspkh.exe
      C:\Temp\mkhczxspkh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2096
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4876
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3404
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mkhczxspkh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5592
  - - C:\Temp\i_mkhczxspkh.exe
      C:\Temp\i_mkhczxspkh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:52
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mhezxrpjhb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:892
  - - C:\Temp\mhezxrpjhb.exe
      C:\Temp\mhezxrpjhb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3076
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1940
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1380
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mhezxrpjhb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:932
  - - C:\Temp\i_mhezxrpjhb.exe
      C:\Temp\i_mhezxrpjhb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1856
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wtrljebwtr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4000
  - - C:\Temp\wtrljebwtr.exe
      C:\Temp\wtrljebwtr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5080
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2576
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4396
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wtrljebwtr.exe ups_ins
    3⤵
    PID:984
  - - C:\Temp\i_wtrljebwtr.exe
      C:\Temp\i_wtrljebwtr.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4192
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rojgbzljdb.exe ups_run
    3⤵
    PID:4828
  - - C:\Temp\rojgbzljdb.exe
      C:\Temp\rojgbzljdb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5588
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4384
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3936
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rojgbzljdb.exe ups_ins
    3⤵
    PID:5636
  - - C:\Temp\i_rojgbzljdb.exe
      C:\Temp\i_rojgbzljdb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5768
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bwtnlgdbvt.exe ups_run
    3⤵
    PID:3932
  - - C:\Temp\bwtnlgdbvt.exe
      C:\Temp\bwtnlgdbvt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3176
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5596
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2204
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bwtnlgdbvt.exe ups_ins
    3⤵
    PID:4164
  - - C:\Temp\i_bwtnlgdbvt.exe
      C:\Temp\i_bwtnlgdbvt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1772
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\igayvtnlig.exe ups_run
    3⤵
    PID:3056
  - - C:\Temp\igayvtnlig.exe
      C:\Temp\igayvtnlig.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3152
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1380
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3996
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_igayvtnlig.exe ups_ins
    3⤵
    PID:1856
  - - C:\Temp\i_igayvtnlig.exe
      C:\Temp\i_igayvtnlig.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5928
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\davsnlfays.exe ups_run
    3⤵
    PID:3804
  - - C:\Temp\davsnlfays.exe
      C:\Temp\davsnlfays.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2304
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5952
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4512
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_davsnlfays.exe ups_ins
    3⤵
    PID:5432
  - - C:\Temp\i_davsnlfays.exe
      C:\Temp\i_davsnlfays.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1304
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\yvhfcaxspn.exe ups_run
    3⤵
    PID:2188
  - - C:\Temp\yvhfcaxspn.exe
      C:\Temp\yvhfcaxspn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1100
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1848
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3320
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_yvhfcaxspn.exe ups_ins
    3⤵
    PID:5768
  - - C:\Temp\i_yvhfcaxspn.exe
      C:\Temp\i_yvhfcaxspn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3712
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ausmkfcxus.exe ups_run
    3⤵
    PID:244
  - - C:\Temp\ausmkfcxus.exe
      C:\Temp\ausmkfcxus.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5412
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2280
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5704
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ausmkfcxus.exe ups_ins
    3⤵
    PID:5812
  - - C:\Temp\i_ausmkfcxus.exe
      C:\Temp\i_ausmkfcxus.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:472
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xupmhfzxrp.exe ups_run
    3⤵
    PID:3860
  - - C:\Temp\xupmhfzxrp.exe
      C:\Temp\xupmhfzxrp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:936
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3156
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4216
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xupmhfzxrp.exe ups_ins
    3⤵
    PID:5520
  - - C:\Temp\i_xupmhfzxrp.exe
      C:\Temp\i_xupmhfzxrp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4248
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\uomjebzwro.exe ups_run
    3⤵
    PID:4340
  - - C:\Temp\uomjebzwro.exe
      C:\Temp\uomjebzwro.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4792
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1332
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2016
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_uomjebzwro.exe ups_ins
    3⤵
    PID:4192
  - - C:\Temp\i_uomjebzwro.exe
      C:\Temp\i_uomjebzwro.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1736
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffd075cc188,0x7ffd075cc194,0x7ffd075cc1a0
      4⤵
      PID:1464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2008,i,1143009545925281297,4682526856258064111,262144 --field-trial-handle=2540,i,10668468252151711743,9088580686268251560,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:2
      4⤵
      PID:4624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2112,i,6307445590422439336,11388888238106561864,524288 --field-trial-handle=2540,i,10668468252151711743,9088580686268251560,262144 --variations-seed-version --mojo-platform-channel-handle=3216 /prefetch:11
      4⤵
      System Time Discovery
      PID:3084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2672,i,4638055545555205772,12347646363658268520,524288 --field-trial-handle=2540,i,10668468252151711743,9088580686268251560,262144 --variations-seed-version --mojo-platform-channel-handle=3312 /prefetch:13
      4⤵
      PID:5076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3576,i,6211775426541692298,15377201753578528268,2097152 --field-trial-handle=2540,i,10668468252151711743,9088580686268251560,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
      4⤵
      PID:2312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3580,i,16560509452332278580,15027289917550499974,2097152 --field-trial-handle=2540,i,10668468252151711743,9088580686268251560,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
      4⤵
      PID:4548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4304,i,7145917884200489894,11443724492617155756,2097152 --field-trial-handle=2540,i,10668468252151711743,9088580686268251560,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:1
      4⤵
      PID:1180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4288,i,8920964626239874691,8391615736320887801,2097152 --field-trial-handle=2540,i,10668468252151711743,9088580686268251560,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:9
      4⤵
      PID:2904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3784,i,3518773058713572191,16591529702907467875,524288 --field-trial-handle=2540,i,10668468252151711743,9088580686268251560,262144 --variations-seed-version --mojo-platform-channel-handle=3808 /prefetch:14
      4⤵
      PID:5772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4600,i,3008958442149031505,18327007989176115412,524288 --field-trial-handle=2540,i,10668468252151711743,9088580686268251560,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:14
      4⤵
      PID:4304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3772,i,2184825686049977326,13427467839377979388,524288 --field-trial-handle=2540,i,10668468252151711743,9088580686268251560,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:14
      4⤵
      PID:992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,2640135803385274602,6738829944996545324,524288 --field-trial-handle=2540,i,10668468252151711743,9088580686268251560,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
      4⤵
      PID:4708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,2640135803385274602,6738829944996545324,524288 --field-trial-handle=2540,i,10668468252151711743,9088580686268251560,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
      4⤵
      PID:1264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,9970615080935396860,4629629824536299841,524288 --field-trial-handle=2540,i,10668468252151711743,9088580686268251560,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:14
      4⤵
      PID:2396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6680,i,17218992775781895120,4332931807720923139,524288 --field-trial-handle=2540,i,10668468252151711743,9088580686268251560,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:14
      4⤵
      PID:1904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=744,i,18136951072463449574,13672062149650076987,524288 --field-trial-handle=2540,i,10668468252151711743,9088580686268251560,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:14
      4⤵
      PID:4532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6200,i,13717187108253454483,510879319547298356,524288 --field-trial-handle=2540,i,10668468252151711743,9088580686268251560,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:14
      4⤵
      PID:5552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,14204738148035885152,14279546215328329820,524288 --field-trial-handle=2540,i,10668468252151711743,9088580686268251560,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:14
      4⤵
      PID:1044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6692,i,6948276263673202728,2644116843808556363,524288 --field-trial-handle=2540,i,10668468252151711743,9088580686268251560,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:14
      4⤵
      PID:5884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,6415475415689170513,6973771353434162395,524288 --field-trial-handle=2540,i,10668468252151711743,9088580686268251560,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:14
      4⤵
      PID:1196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6872,i,7772323010338535451,17091324336467223815,524288 --field-trial-handle=2540,i,10668468252151711743,9088580686268251560,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:14
      4⤵
      PID:3436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6748,i,11140235794006958485,3330107407340034985,524288 --field-trial-handle=2540,i,10668468252151711743,9088580686268251560,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:14
      4⤵
      PID:4024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6928,i,5195696747754664753,10028266486802667507,262144 --field-trial-handle=2540,i,10668468252151711743,9088580686268251560,262144 --variations-seed-version --mojo-platform-channel-handle=6856 /prefetch:10
      4⤵
      PID:5416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,13896801657064845640,1402524274674116861,524288 --field-trial-handle=2540,i,10668468252151711743,9088580686268251560,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:14
      4⤵
      PID:4684

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3612

C:\Temp\causmkecxupnhczx.sys
C:\Temp\causmkecxupnhczx.sys
1⤵
- Executes dropped EXE
PID:5356

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4984

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4120

C:\Temp\pjhfrpjhcz.sys
C:\Temp\pjhfrpjhcz.sys
1⤵
- Executes dropped EXE
PID:4724

C:\Temp\gecwrpjhez.sys
C:\Temp\gecwrpjhez.sys
1⤵
- Executes dropped EXE
PID:4924

C:\Temp\gbztromgey.sys
C:\Temp\gbztromgey.sys
1⤵
- Executes dropped EXE
PID:5720

C:\Temp\ljdaytqljg.sys
C:\Temp\ljdaytqljg.sys
1⤵
- Executes dropped EXE
PID:5772

C:\Temp\avsqligays.sys
C:\Temp\avsqligays.sys
1⤵
- Executes dropped EXE
PID:592

C:\Temp\nlfdayvqni.sys
C:\Temp\nlfdayvqni.sys
1⤵
- Executes dropped EXE
PID:4396

C:\Temp\fdxvpnkfdx.sys
C:\Temp\fdxvpnkfdx.sys
1⤵
- Executes dropped EXE
PID:5916

C:\Temp\pnhfzxspkh.sys
C:\Temp\pnhfzxspkh.sys
1⤵
- Executes dropped EXE
PID:2324

C:\Temp\smkecwupmk.sys
C:\Temp\smkecwupmk.sys
1⤵
- Executes dropped EXE
PID:592

C:\Temp\ecwurmjwuo.sys
C:\Temp\ecwurmjwuo.sys
1⤵
- Executes dropped EXE
PID:4684

C:\Temp\trmjebwtrl.sys
C:\Temp\trmjebwtrl.sys
1⤵
PID:4908

C:\Temp\dbvtolgdyw.sys
C:\Temp\dbvtolgdyw.sys
1⤵
PID:3724

C:\Temp\lfdyvtnlfd.sys
C:\Temp\lfdyvtnlfd.sys
1⤵
PID:1196

C:\Temp\qolfvqniga.sys
C:\Temp\qolfvqniga.sys
1⤵
PID:1124

C:\Temp\xvqnifdavs.sys
C:\Temp\xvqnifdavs.sys
1⤵
PID:4052

C:\Temp\xusmkifaxs.sys
C:\Temp\xusmkifaxs.sys
1⤵
PID:1352

C:\Temp\xupmhecwup.sys
C:\Temp\xupmhecwup.sys
1⤵
PID:1324

C:\Temp\ecwupmkecz.sys
C:\Temp\ecwupmkecz.sys
1⤵
PID:1228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

avsqligays.sys

Path C:\Temp\avsqligays.sys
Size 293KB
SHA256 ed526694ead9cf9e08b839131faad8e5189d34bad2b19db171b9eb7e86c2af2c
MD5 d67d750035c9000cdaa3c335106a041c
SHA1 86e9c0d760d8aad631b73bcae5f2962e8f0d8f5f
SHA512 6cf0a465c6df16079cb2ae93d5dc2112ea312bcb80bb0a26edeff445760ff04aaed1d9a41d4b71967a973a1cf6cb9dfe7bbecd23a7850d5174c88db257dc30e2
SSDEEP 3072:utKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:uIJjiJcbI03GBc3ucY5DCSj
TLSH
T128545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

causmkecxupnhczx.exe

Path C:\Temp\causmkecxupnhczx.exe
Size 384KB
SHA256 564c681de9d2952760032ecda91751dea2e17de4f946895c227d6a47f467d330
MD5 162615e82280c4425929bcf03fa59907
SHA1 739fd1922beaaf36aacfd448f096a159afbde887
SHA512 aa8e5d53fccb5dc8aae54bb65c28567a4e83c8921bce2754c1a725830bf78b4beaf32731c95e89fb9f8f7146668c7e32f9b395da67e68d9d0ccfc66fe0af51e4
SSDEEP 3072:u9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:MctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T168847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

causmkecxupnhczx.sys

Path C:\Temp\causmkecxupnhczx.sys
Size 293KB
SHA256 5db7a3d5a123ff5b85ad1a2167727b1f0d353de4a023f84d9e1df8c24e239e1f
MD5 6fe90da65ba3366996701bc4558f754c
SHA1 f8cfe29e2a99b17fb479b4d08e4eb341e18a60d5
SHA512 2822eecea7fb4442da2f9e2f39255855ddbb02b4a97a6304ae33cd656be82f09dbee28a37762418348d8ba8dd81847e2dce8ac40e5788cc7ddf77577c566fa2e
SSDEEP 3072:4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:4IJjiJcbI03GBc3ucY5DCSj
TLSH
T106545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbztromgey.sys

Path C:\Temp\gbztromgey.sys
Size 293KB
SHA256 1fc1e6dee5a33d65d14e922684b0c17cad2dbfbfde3d1aff9377cc159ea3b5f7
MD5 69466a24ee2dd29cb2324722b4f3bfc6
SHA1 cae1256575fc85454adb66fe2539699229fbecad
SHA512 2fa2ca740a5ff7a60939aa35a22f6845d9e5b3c2ef372f80df4f5febb9533c1f05cf08eeccb904847d3de59b1eabc386d59a37a7975c1e1215f70476ba85d876
SSDEEP 3072:ttKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:tIJjiJcbI03GBc3ucY5DCSj
TLSH
T1F1545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbzwuolgdy.exe

Path C:\Temp\gbzwuolgdy.exe
Size 384KB
SHA256 4dca8355228c5aea7e469c374b5f56cd4f85a74098e1869430d18b9cec8daae0
MD5 328df4a81073543f540bde3ed54fa96a
SHA1 3c825cd70d402675e7c7b8b1500eebe2fb2d2149
SHA512 6f98e5c067f7450ddfb2f6fd511da951c5a19a2baeff1912a3515293d40b45fc2e960fa30a253733eaaa5e2fa47ba7d176a54b937a6405f460fa05d3c4e8bbbb
SSDEEP 3072:N9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:fctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T17D847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gecwrpjhez.sys

Path C:\Temp\gecwrpjhez.sys
Size 293KB
SHA256 996ff0013afa37fc3be0596e72dc6cc5149b3e3e60b7ff8df8ff819f85b214b8
MD5 39ed5eea76962c3ff2306c0294ee31ee
SHA1 5b42e7dbd3ca5b72a8d46705c4a462252ddde20d
SHA512 7a4e4ca2767bfc9ff606ded3dd56200634ab0b656023ed38ae44379bd47eefb72192fcaf0ccaa95bc62b2de7d66e406252909fdfb7ee723f58744626a45d0e6f
SSDEEP 3072:StKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:SIJjiJcbI03GBc3ucY5DCSj
TLSH
T171545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gbzwuolgdy.exe

Path C:\Temp\i_gbzwuolgdy.exe
Size 384KB
SHA256 58249ebb9e233feb1645778d3b3faa9baa2e39339b742f4e76bbd573a9888927
MD5 7616d85b175f552f7d43348cc439c4bf
SHA1 a372c5c10db2aab288a3ee1981ee08eed7dfce10
SHA512 e230f627ec7d13e6006b879cbbfb5503bc6e1b85c3d445b4196a741a025ddb9d0ddbcdf331d72dd29f16fc103c9720034a99c94a14f9b0ddc3edab0764ff0889
SSDEEP 3072:k9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:+ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T185847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lgdywqoige.exe

Path C:\Temp\i_lgdywqoige.exe
Size 384KB
SHA256 7fce155f6bc65f7c35121ee7e73e7575c6e670a8d0ac10da51163a3b31e5f622
MD5 80b34485c6001f67c54e81be52332db4
SHA1 093777a597dd4f5a3caa7100bcd69b4d54e57066
SHA512 ad5f529d6c4c1c1945f8900c1549805e45e59a393d284ba6538ea505c1fc9e4b2a91572e343006cfff3481bc4ee6a13351b516db51b461ba95f5fda024cee17d
SSDEEP 3072:t9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:/ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C1847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wromhbwroj.exe

Path C:\Temp\i_wromhbwroj.exe
Size 384KB
SHA256 2701f26501c46709da5fc154eee3c1ff16a98195ad401c3c0bfdf9a3887801f9
MD5 f5637165abc491f1af629fe282876dcc
SHA1 9868973b43922de240d2428d56b53c3ece40770b
SHA512 624c1fb5608177205564d7204f8e0eae52e969e2d46ff5452a192ca780ba38e2df30ea6bb721afe1bdf6a58c72110be6c6917b6b0fae8c95c6cc995a257e0fcd
SSDEEP 3072:S9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:octFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T17A847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xrpmkecxus.exe

Path C:\Temp\i_xrpmkecxus.exe
Size 384KB
SHA256 0ee6ef2a8faf5b4adf325f3392f94333edeb7b3f752992ebdad99a4d6fa1673a
MD5 a70e8f194e672c7582308034f2b0d2d6
SHA1 087988ab2223fc96a7f048c5d39b756620856cba
SHA512 108d86fe48c84926876db5e54a811405611c285f6a20bbcc01aa1e6384966749ca6d66f6a62f479a1c14151a3ae23f242a27ca034fb5929ee61426587ba37924
SSDEEP 3072:Q9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:ictFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T13C847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zxojhbztrm.exe

Path C:\Temp\i_zxojhbztrm.exe
Size 384KB
SHA256 62f82750cbbe9050f1ffd7727b49d05f88f8aac9c6ae2b3f7f20b4d48bec42c7
MD5 636d1306b96ec208f652a3a1fccdcbfa
SHA1 57c7251d1ea66290fb2aceefc20050270b761852
SHA512 d75f6e5559ade1c34f3ad6bfedfaefa73f3956e60e939840ad8bcd4bce3aebba572535d8942ae766607d366f8be76e753cf35703bee8e3495bb6a9fba449941d
SSDEEP 3072:R9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:bctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A7847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgdywqoige.exe

Path C:\Temp\lgdywqoige.exe
Size 384KB
SHA256 624bf5c99d8891f076e3d398698dbcdb79b2fbbbfe99959ffff2214f41907562
MD5 44ca007c207688755e384519d603e27c
SHA1 e6058a66f8d13304f90a719e3162252d2f15fe8b
SHA512 52ebcdb4443196f3e17a7d00aba0e12dc9d52d575999807aa8fccb4f367c795ea9a529dca4d39a982744ad7fe5b9c1dcd6f911ff954496a1bd30a009feb773bc
SSDEEP 3072:D9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:hctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T12B847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljdaytqljg.sys

Path C:\Temp\ljdaytqljg.sys
Size 293KB
SHA256 d3dcc87617d0f22e6d2f17e723904225481d151411c95920817421d1488330b7
MD5 8352ca176a8b99605671ee10b7e12bea
SHA1 9149c0f6e6f80ee0473e2bfd4cf9a4552c3e28a5
SHA512 eebc7ac554b6c6c9af6a88927032677374896a1da4fb1e1c452bdba5daab5969cfe2d27f2bc7ff6e824ee5f2f7806e779612a75a80ac2ea83cbc164f253ec08f
SSDEEP 3072:8tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:8IJjiJcbI03GBc3ucY5DCSj
TLSH
T1DD545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pjhfrpjhcz.sys

Path C:\Temp\pjhfrpjhcz.sys
Size 293KB
SHA256 bb75a2a723bc41f0bd883ca9072064a50d554438e23dd27e72ea05710c6c443e
MD5 f9cffa0939c67fa3772ce9520d23e8d2
SHA1 7fd3b32e893ccf62d30ae5423becaf9b7741b42e
SHA512 329cd780091589688784f338779afa6e7a27baea3b2a33b8a8300a2e2b58af7308b91c315926d44144c03bbe600af7c536b3b45e9749b54938923c3c0aea1328
SSDEEP 3072:ktKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:kIJjiJcbI03GBc3ucY5DCSj
TLSH
T122545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vsqkidavtn.exe

Path C:\Temp\vsqkidavtn.exe
Size 384KB
SHA256 11e7158afa10e2bd0787879af3600ffb34e11d6122918e2ab9b78f2f73f5806e
MD5 a650c19ae49e1a902bf6f1ef38b5445c
SHA1 c6648a1772bfb5f1c2bde790ca602a1def35a06f
SHA512 d1ff92b518e7a49eef67545b4edb39458856382ca9492d3fe929a0e6d737401c74355cf702e69cd5cf5ef2252a8fd871c516cbd3503128de8ce24fc7df6a825c
SSDEEP 3072:69ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:gctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E8846B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wromhbwroj.exe

Path C:\Temp\wromhbwroj.exe
Size 384KB
SHA256 7724160f6562a26ddda5dec0a78a4a51e49fb99390153da4ecbf08c08b0b7993
MD5 3d24750f25078a91e2fef195cf0426b7
SHA1 1d823488417396b58f1d9b0079391e2ee600fefe
SHA512 c04a6e856dd5997a980f60e29e4425e990ceaf92b6555fe90e369061df89cd1ca176424e5ecb8a7bb2b9f15f6ebabf144f96ebae1b5263342a27da8c8240a27a
SSDEEP 3072:n9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:9ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1DF847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xrpmkecxus.exe

Path C:\Temp\xrpmkecxus.exe
Size 384KB
SHA256 19c9474df0903247cd55a37b5e0735708c1c3964d11bb6ad0d95956ced316dd5
MD5 d668f940fb67a6c558e8963ab660eb0e
SHA1 29675f733203c675f5375faef6e5a21a169fc401
SHA512 acb6698f872bb79be80c0c7ceae0f19c3a43988bb010060e5c19b31d77d7f2a6aca32087f04cf7b9f2bd18004a6e974af92fedf209d5e5d03aa9cc4c976a1da8
SSDEEP 3072:w9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:CctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B5847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxojhbztrm.exe

Path C:\Temp\zxojhbztrm.exe
Size 384KB
SHA256 26a0a4a449ca577d5e0fba258f72338f4da4e4208c5eaeaa3aba601ebca6024a
MD5 388e8421fc76d33e276cb4fe9204ea55
SHA1 3484863474589abbf29a410a0819497d15deb3e8
SHA512 bd284b6571c55e32fbd4e3b0c3996935383bf492d2a408e462c8e7695f13f051907b8b044d3c8722961135eac81e86f317ebaf8db646f2587aac1c34fb643c98
SSDEEP 3072:Q9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:ictFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1FC847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 8da49cfdb249a85c29974128791cc8257b6fcb495af9692ca504879d10d35f54
MD5 c5c2546ba30581064bf9e4528d50b621
SHA1 22d056af2cb626adb2973f2fafe76f10f35c8f61
SHA512 77a15fdcc094b87341ad56848e746c41c7ca7dd52be7b09f2947df10568981a97fced9ea625e05be1215caf50966b02958d373400735d5ad7694e767d561056f
TLSH
T144316E708F342AFFDBAF45B657E24A9C3375885B37072F502364AEB48A89377201001E
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 44d041513900a70235f89d69aa138b879a9827ee76d3d767e56d82240a4abeed
MD5 a2b4ba4d5646cb5345d0dafbb3f4067b
SHA1 62612ab491c33cc64dd8317a78e2b8e80e75195e
SHA512 19a19bc0104e01b85d855274504766f831c4b35df036d5ee179fbacceee3a9687ed67eea4e9bfb118ee7ee397547f23066fc638b30399a8a9f171a0a48bf4a27
TLSH
T14141ACF7C3E8856E990156F0AB187E2BCE1D0915832C3D5AC9E4AF1B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 7af6d199a278de9c3ca346c81238115a256cacf2a3fd3716312fca7cb9e22962
MD5 93bcd52338f0f057c76d8b101383d3db
SHA1 363a197a34cc16161eb5e24891e7634605e300b0
SHA512 342c38b00ebf627adea48f929e4a7a929ba0d5e8bb382a3dc8640935fded88365b0dfe53f930dfa663f28d23ca360c35853daf641b50393b5f1a0fd536f353d9
SSDEEP 192:sxRGRcyM/jK1Ml8wCD/fdslA4dZ2HE2wzoA8p9R/g6+WNCGN/YorCYhGcIgtJ:sxRGS8D/fdsm4T2ke//5p/+I3
TLSH
T19A62DA15AA34597B8CDBD20DFA557F93D6F81573A2941E44AAFCCB0C00E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 f67bba5b6b4b23259f1d5a3f9673f4be082dd17192b87449af6f1ddd3fc49266
MD5 374e0c5eb606f346bc6a38675bc7b9c5
SHA1 a58b20841ec999fba5b3c4fcaf7104ebaef9a32d
SHA512 ac83ec94086bad8964b109190463767f14fc7cfba406d3bc5195154dcf9428ca625a9287c3f1d803facd9bb2956d17cd5560ca3ce87a440ded41c14c1c515870
SSDEEP 192:sxRRRcyM/jK1Ml8wCD/fds7A4dZ2HE2wzoA8p9R/g6+WNCGN/YorCYhGcIgDqJ:sxRRS8D/fdss4T2ke//5p/+IS
TLSH
T14762DB15AA34597B8CDBD20DFA557F93D6F81573A2941E44AAFCCB0C00E6ADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 3f28fa03e7843fd3f788c6c8b791d1e2848bf40a406d94434f38ecf6edaa5363
MD5 2e3032925ebdf5fa526c2578a0c56070
SHA1 304beb84f8b90b5ccb5cb76c7a0f0a5063ab61f8
SHA512 8e3625a2154d6b6df13fa02e2fe6ed5e5fb6637de3a878cc76d60cdd1d6639a4cfd3ba8f2b411cea93d4b8118607ae5b8f5bfb55e0b86a6613ddcb18c8105bed
SSDEEP 192:sxRRRcyM/jK1Ml8UQbCD/fds7ALdZ2HE2wzoA8prR/g6+WNCGN/YodCYhGcIgDMJ:sxRRSquD/fdssLT2ked/5p/4Is
TLSH
T15162EA15AA34597B9CDBD20DFA557B93D2F815B392941E04AAFCCB0C00E6ADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 8588a6b5a9bd427a24c32e6c1ad20c44a5a28cb88d992a85fcf48a3dd776b98b
MD5 a0a6b12afd127696ba06f2f784a904ce
SHA1 3b2dc36e8de0c392342c5cc90dd4cc3ca50c65e1
SHA512 e75c446894ddb8394a9e851fd30d97e0d3ee4aa3d0b022b2d0f318a19eefbdfc8ea696a693d756d83893f117d8e5999e46bdb1fe1aa45e8ebc37acc59c3dabe8
SSDEEP 768:jXwHno7pLuL7gRWgs2fJ28F1+UoAYDCx9Tuqh0VfUC9xbog/OVqppVuGTrockpe4:jXwHnUE7gRWgs2fJ2u1jaRpp4GgdCK
TLSH
T109E2FC7B680CCBBE4F404ADCEC29BD9E6DA801CB96D88D5447FA840C03C6AEB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 dd9623b7b1648529e3f29038b4416b4b84dae0c60521072e6f76ac97cdf9e860
MD5 cbb11c162dbf8b12f1abda90b634358a
SHA1 9638a0950c49d9e0ce67fb8fc573197d82354c41
SHA512 4f2e3847ed1072f1c17ee3ab39f0a2540787ebfe5bf1a5be1d6c76a0f82b247e239e8cf239a9b378c730bd7bfd15ed6202311ba50cffaf641df6fcb324865d13
SSDEEP 96:KR2r6WwYY+Wo9lg2+K4Lgk+ce2VUGfHm7KmgIIOW4tVgGOK47g0OcOGlkWPHlyLx:C2r6WwYYZo9m22Lgkte2VUGfHm7KmgIn
TLSH
T1C1912561333713803C7EA54D8178A51BD2C1B1A23218752B37A803A69F27E178DFF9CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

413a663d-4c7f-4833-a7b8-64f6f08d9b71.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\413a663d-4c7f-4833-a7b8-64f6f08d9b71.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 618ae276a6db80383fc3acff7141549220b836969cc65d2c53cf6ceb528d080e
MD5 16e925164b8dc31291eeec05e6f53228
SHA1 a10d94780c29ef856d2dd44472c1fc10b72c0489
SHA512 83c1632aa693448b92bd6c3faec78baaa0790222e3d2f49e46a21032cea4b89fdd100b41545613b8e57ac48aa55ea87948ed53c4df5152f349e7e3844a897cf6
SSDEEP 768:yF1j+9z3TwgUKC/psOW773njteONXyer1IRCzni95b9Mh:H9z36HSIqnib+h
TLSH
T1D11328F594D78A37D89E5787B33D2E46AABCC0A3B5884990BBD51E4CCC8257FC70A805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 6db6d6ed1f74e81974486a2203066f8e74c92e23520bea5be470d763d0579e27
MD5 407f8b763ec950885b97f1dfd51d8a4d
SHA1 1ecc2c0892f461a5765db123372391bd89f4e304
SHA512 f1d6d8882e80fe5ca20535a3c5c981d6244d642a1a6c546167f1f91432c3fdc0552ea590a88f77d365a01f9486c8c8b172446490ce0cd45a4ba7ff1d724399ef
SSDEEP 768:/j+9I3omCM/TBOW773njtCONXyer1IRCzni95b9Mh:y9I3D+SIqnib+h
TLSH
T1F6F2BE35E5959E238CE2A3D6B2473792BFF410B7C5C40A54EEEA6F4E05C3A6D070B41A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 7cc4bcb082d22b78021ed0e11694a1dcd666a2e177025902bc3f267f9303161d
MD5 5a7ce79d6d37ff87c570de6a2a4ce032
SHA1 f46cb7c686d7121d3d12081bcee55394372e301b
SHA512 b9492afd535673fdc39a5ffe808b80a2866131cc77daebcb9e35e8aa0ea9a8d953834a030f478b6e5674779a15959386c0ebde4de03ca3e92bcba6497b242dd6
SSDEEP 768:+rv+4UNbdq3jnCM/TBOW773njtCONXyer1IRCzni952D:+bsb83r+SIqniQ
TLSH
T1BA03CF31E558DE338CE2A385B10773937FB810A788C54B60EEEA2B4D019799E170F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 17f79dd065b19302aa5a6ea01a08d15ab53c0db24f6a6020de3305c6bb3bf268
MD5 d3e70fa7e19aeb2cf615fbcb2a56e84f
SHA1 30e7e3e56b67d6ea158fb35982fccb2fbb87cdad
SHA512 a3f99c20e2d6555971c97b0dcaf3be8da408bcda419d0e9c1f6444cffac7cdb5579c7af067718ca49c7652d8bfa0faa41dc8520d183b98b6cf977fcd11a3f4aa
SSDEEP 768:jj+9I3jmCM/TBOW773njtCONXyer1IRCzni95b9Mh:m9I3m+SIqnib+h
TLSH
T17AF2BE35E5959E238CE2A3D6B2473793BFF410B785C40A54EEEA6F4E05C3A6D070B41A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 d83fdce99eb5bae16a48ef0ae9417f419fafb7969331b4f6a364d97802f4bd8d
MD5 5c1ed5c66fd22d8a68b906dfa93adc3d
SHA1 9e22fbec816decc0c7599c3568a22be930293bb3
SHA512 122be6ed02bc30bdaf8333e0102173390a5cac1a6d3943e0c555faa3e9c162e5275c9640aed78f9fd5f93ad0e86e75b809c2b3fda11b752f40ee84ed3de061eb
SSDEEP 768:hrv+4UNbdz3Ss+/TBOW7734ONXyer1IRCzniBCeVH1SK7:hbsbV3SmSIqn5EH1l
TLSH
T1D003BE36E4A89E338DE2A385B14777437FB86057C6840790E9EA2F4E069B49D130B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

bd5d1205-bebf-4c2d-b044-dea760189feb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\bd5d1205-bebf-4c2d-b044-dea760189feb.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5148_135057965\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 58de0b7973b418dc14572740c55fd01896b8ccde2d7f2a822e58f165b6f904ba
MD5 f9e33dae616bf799b032950e3c426755
SHA1 67b0c1e1d9fccc7f1bcd7120722206a0964b709d
SHA512 f0c6db46ef74c684c65230068eec35b6bcde02d8a5c65530fb3b5d1dd3f24e6f76231f5a75cd2b622b8b8d30a9c341ae33c315ba948701cb3a5096b5756c6af8
TLSH
T19671008356A9C9B3C1DA5FF402835248F1BB22780773202147515586AA30B3A54B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/592-361-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/592-307-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1124-434-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1196-430-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1228-495-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1324-470-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1352-466-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2324-335-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3724-410-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4052-445-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4396-316-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4684-391-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4684-369-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4724-195-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4908-389-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4924-242-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5356-64-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5720-267-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5772-279-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5916-320-0x0000000000010000-0x00000000000AB000-memory.dmp

Download