systex | b5f9409b851bab6452c2b1d724c5fe89cdd37fca804662376d104342947c7b75

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 11:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_77732a363a77c39f7d79fcf674e47761_amadey_darkgate_elex_smoke-loader_stop.exe
Size 384KB
Sample260718-m56ceshs6k
SHA256 b5f9409b851bab6452c2b1d724c5fe89cdd37fca804662376d104342947c7b75
MD5 77732a363a77c39f7d79fcf674e47761
SHA1 31f26ee05242cc3c07eb3524341561b3bf76fa04
SHA512 beafcf2c578ba06ad9ae8564bcf7fceab5d07904e631533090b4c3e3b7d4ab1fc40752f90f8a01a66cf1b6cc8f4e26cff3228d274b69bc5e744bae1d7e5328d1
SSDEEP 3072:D9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:hctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T133847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
996	zurmkecwuomgezwr.exe
5972	zurmkecwuomgezwr.sys
1348	CreateProcess.exe
2732	bztrmjebzt.exe
2772	CreateProcess.exe
5644	CreateProcess.exe
1724	i_bztrmjebzt.exe
1792	hezwuomgey.sys
1228	CreateProcess.exe
2532	qojgbzwroj.exe
6056	CreateProcess.exe
5896	CreateProcess.exe
2580	i_qojgbzwroj.exe
5840	ljdbztrljg.sys
1580	CreateProcess.exe
5020	jdbvtolgey.exe
1328	CreateProcess.exe
4900	CreateProcess.exe
2712	i_jdbvtolgey.exe
5716	daywqoigdy.sys
3776	CreateProcess.exe
5900	yvqoigaysq.exe
1956	CreateProcess.exe
620	CreateProcess.exe
2116	i_yvqoigaysq.exe
2944	nlfdaysnli.sys
4180	CreateProcess.exe
916	fdavtnlfdx.exe
2600	CreateProcess.exe
2256	CreateProcess.exe
5108	i_fdavtnlfdx.exe
4728	ifdaysqnli.sys
3380	CreateProcess.exe
1084	xusnkidxvp.exe
1560	CreateProcess.exe
5540	CreateProcess.exe
1980	i_xusnkidxvp.exe
5636	kicausnkfc.sys
5760	CreateProcess.exe
4784	hcausnkfcx.exe
2588	CreateProcess.exe
4216	CreateProcess.exe
5352	i_hcausnkfcx.exe
1196	fcxurpjhfz.sys
2944	CreateProcess.exe
3376	czxrpmkecz.exe
4884	CreateProcess.exe
4056	CreateProcess.exe
3284	i_czxrpmkecz.exe
5212	ezwuomhbzw.sys
5300	CreateProcess.exe
2612	xrpjhezwrp.exe
1848	CreateProcess.exe
5072	CreateProcess.exe
2680	i_xrpjhezwrp.exe
4600	ztrpjhbztr.sys
4064	CreateProcess.exe
6040	qojgbztrlj.exe
3484	CreateProcess.exe
944	CreateProcess.exe
1588	i_qojgbztrlj.exe
1776	bywqomjebw.sys
1904	CreateProcess.exe
3936	dbwtomgeyw.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4684_1685173214\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4684_240074020\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4684_240074020\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4684_240074020\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4684_905903570\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4684_1358863174\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4684_1685173214\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4684_1685173214\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4684_240074020\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4684_557171766\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4684_905903570\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4684_1358863174\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4684_1685173214\llm_user_input_extractor_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxromhezxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecxupnhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrojhbzwro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrojhbzwro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwrojhbytr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrmjebzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qojgbzwroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdavtnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdavtnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xusnkidxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpjhezwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icavpnifax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ytrljdbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nifdbvtnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qojgbztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nifdbvtnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecxupnhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwrojhbytr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpjhezwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-18_77732a363a77c39f7d79fcf674e47761_amadey_darkgate_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrmjebzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qojgbzwroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbvtolgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfaxsqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xusnkidxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbwtomgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxromhezxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqoigaytql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvqoigaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvqoigaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hcausnkfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hcausnkfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czxrpmkecz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qojgbztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbwtomgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zurmkecwuomgezwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbvtolgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czxrpmkecz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqoigaytql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icavpnifax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfaxsqkic.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3620	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2680	ipconfig.exe
3632	ipconfig.exe
5712	ipconfig.exe
2632	ipconfig.exe
5076	ipconfig.exe
1688	ipconfig.exe
1488	ipconfig.exe
3632	ipconfig.exe
5320	ipconfig.exe
4580	ipconfig.exe
4244	ipconfig.exe
2584	ipconfig.exe
5604	ipconfig.exe
2016	ipconfig.exe
1324	ipconfig.exe
4388	ipconfig.exe
1068	ipconfig.exe
5616	ipconfig.exe
2912	ipconfig.exe
5280	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134288462450061421"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{E224E23B-7D6D-4992-A18D-505BBF32F3B5}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1784	2026-07-18_77732a363a77c39f7d79fcf674e47761_amadey_darkgate_elex_smoke-loader_stop.exe
1784	2026-07-18_77732a363a77c39f7d79fcf674e47761_amadey_darkgate_elex_smoke-loader_stop.exe
1784	2026-07-18_77732a363a77c39f7d79fcf674e47761_amadey_darkgate_elex_smoke-loader_stop.exe
1784	2026-07-18_77732a363a77c39f7d79fcf674e47761_amadey_darkgate_elex_smoke-loader_stop.exe
1784	2026-07-18_77732a363a77c39f7d79fcf674e47761_amadey_darkgate_elex_smoke-loader_stop.exe
1784	2026-07-18_77732a363a77c39f7d79fcf674e47761_amadey_darkgate_elex_smoke-loader_stop.exe
1784	2026-07-18_77732a363a77c39f7d79fcf674e47761_amadey_darkgate_elex_smoke-loader_stop.exe
1784	2026-07-18_77732a363a77c39f7d79fcf674e47761_amadey_darkgate_elex_smoke-loader_stop.exe
1784	2026-07-18_77732a363a77c39f7d79fcf674e47761_amadey_darkgate_elex_smoke-loader_stop.exe
1784	2026-07-18_77732a363a77c39f7d79fcf674e47761_amadey_darkgate_elex_smoke-loader_stop.exe
1784	2026-07-18_77732a363a77c39f7d79fcf674e47761_amadey_darkgate_elex_smoke-loader_stop.exe
1784	2026-07-18_77732a363a77c39f7d79fcf674e47761_amadey_darkgate_elex_smoke-loader_stop.exe
1784	2026-07-18_77732a363a77c39f7d79fcf674e47761_amadey_darkgate_elex_smoke-loader_stop.exe
1784	2026-07-18_77732a363a77c39f7d79fcf674e47761_amadey_darkgate_elex_smoke-loader_stop.exe
1784	2026-07-18_77732a363a77c39f7d79fcf674e47761_amadey_darkgate_elex_smoke-loader_stop.exe
1784	2026-07-18_77732a363a77c39f7d79fcf674e47761_amadey_darkgate_elex_smoke-loader_stop.exe
1784	2026-07-18_77732a363a77c39f7d79fcf674e47761_amadey_darkgate_elex_smoke-loader_stop.exe
1784	2026-07-18_77732a363a77c39f7d79fcf674e47761_amadey_darkgate_elex_smoke-loader_stop.exe
1784	2026-07-18_77732a363a77c39f7d79fcf674e47761_amadey_darkgate_elex_smoke-loader_stop.exe
1784	2026-07-18_77732a363a77c39f7d79fcf674e47761_amadey_darkgate_elex_smoke-loader_stop.exe
1784	2026-07-18_77732a363a77c39f7d79fcf674e47761_amadey_darkgate_elex_smoke-loader_stop.exe
1784	2026-07-18_77732a363a77c39f7d79fcf674e47761_amadey_darkgate_elex_smoke-loader_stop.exe
1784	2026-07-18_77732a363a77c39f7d79fcf674e47761_amadey_darkgate_elex_smoke-loader_stop.exe
1784	2026-07-18_77732a363a77c39f7d79fcf674e47761_amadey_darkgate_elex_smoke-loader_stop.exe
1784	2026-07-18_77732a363a77c39f7d79fcf674e47761_amadey_darkgate_elex_smoke-loader_stop.exe
1784	2026-07-18_77732a363a77c39f7d79fcf674e47761_amadey_darkgate_elex_smoke-loader_stop.exe
1784	2026-07-18_77732a363a77c39f7d79fcf674e47761_amadey_darkgate_elex_smoke-loader_stop.exe
1784	2026-07-18_77732a363a77c39f7d79fcf674e47761_amadey_darkgate_elex_smoke-loader_stop.exe
1784	2026-07-18_77732a363a77c39f7d79fcf674e47761_amadey_darkgate_elex_smoke-loader_stop.exe
1784	2026-07-18_77732a363a77c39f7d79fcf674e47761_amadey_darkgate_elex_smoke-loader_stop.exe
1784	2026-07-18_77732a363a77c39f7d79fcf674e47761_amadey_darkgate_elex_smoke-loader_stop.exe
1784	2026-07-18_77732a363a77c39f7d79fcf674e47761_amadey_darkgate_elex_smoke-loader_stop.exe
1784	2026-07-18_77732a363a77c39f7d79fcf674e47761_amadey_darkgate_elex_smoke-loader_stop.exe
1784	2026-07-18_77732a363a77c39f7d79fcf674e47761_amadey_darkgate_elex_smoke-loader_stop.exe
1784	2026-07-18_77732a363a77c39f7d79fcf674e47761_amadey_darkgate_elex_smoke-loader_stop.exe
1784	2026-07-18_77732a363a77c39f7d79fcf674e47761_amadey_darkgate_elex_smoke-loader_stop.exe
1784	2026-07-18_77732a363a77c39f7d79fcf674e47761_amadey_darkgate_elex_smoke-loader_stop.exe
1784	2026-07-18_77732a363a77c39f7d79fcf674e47761_amadey_darkgate_elex_smoke-loader_stop.exe
1784	2026-07-18_77732a363a77c39f7d79fcf674e47761_amadey_darkgate_elex_smoke-loader_stop.exe
1784	2026-07-18_77732a363a77c39f7d79fcf674e47761_amadey_darkgate_elex_smoke-loader_stop.exe
1784	2026-07-18_77732a363a77c39f7d79fcf674e47761_amadey_darkgate_elex_smoke-loader_stop.exe
1784	2026-07-18_77732a363a77c39f7d79fcf674e47761_amadey_darkgate_elex_smoke-loader_stop.exe
1784	2026-07-18_77732a363a77c39f7d79fcf674e47761_amadey_darkgate_elex_smoke-loader_stop.exe
1784	2026-07-18_77732a363a77c39f7d79fcf674e47761_amadey_darkgate_elex_smoke-loader_stop.exe
1784	2026-07-18_77732a363a77c39f7d79fcf674e47761_amadey_darkgate_elex_smoke-loader_stop.exe
1784	2026-07-18_77732a363a77c39f7d79fcf674e47761_amadey_darkgate_elex_smoke-loader_stop.exe
1784	2026-07-18_77732a363a77c39f7d79fcf674e47761_amadey_darkgate_elex_smoke-loader_stop.exe
1784	2026-07-18_77732a363a77c39f7d79fcf674e47761_amadey_darkgate_elex_smoke-loader_stop.exe
1784	2026-07-18_77732a363a77c39f7d79fcf674e47761_amadey_darkgate_elex_smoke-loader_stop.exe
1784	2026-07-18_77732a363a77c39f7d79fcf674e47761_amadey_darkgate_elex_smoke-loader_stop.exe
1784	2026-07-18_77732a363a77c39f7d79fcf674e47761_amadey_darkgate_elex_smoke-loader_stop.exe
1784	2026-07-18_77732a363a77c39f7d79fcf674e47761_amadey_darkgate_elex_smoke-loader_stop.exe
1784	2026-07-18_77732a363a77c39f7d79fcf674e47761_amadey_darkgate_elex_smoke-loader_stop.exe
1784	2026-07-18_77732a363a77c39f7d79fcf674e47761_amadey_darkgate_elex_smoke-loader_stop.exe
1784	2026-07-18_77732a363a77c39f7d79fcf674e47761_amadey_darkgate_elex_smoke-loader_stop.exe
1784	2026-07-18_77732a363a77c39f7d79fcf674e47761_amadey_darkgate_elex_smoke-loader_stop.exe
996	zurmkecwuomgezwr.exe
996	zurmkecwuomgezwr.exe
996	zurmkecwuomgezwr.exe
996	zurmkecwuomgezwr.exe
996	zurmkecwuomgezwr.exe
996	zurmkecwuomgezwr.exe
996	zurmkecwuomgezwr.exe
996	zurmkecwuomgezwr.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	1724	i_bztrmjebzt.exe
Token: SeDebugPrivilege	2580	i_qojgbzwroj.exe
Token: SeDebugPrivilege	2712	i_jdbvtolgey.exe
Token: SeDebugPrivilege	2116	i_yvqoigaysq.exe
Token: SeDebugPrivilege	5108	i_fdavtnlfdx.exe
Token: SeDebugPrivilege	1980	i_xusnkidxvp.exe
Token: SeDebugPrivilege	5352	i_hcausnkfcx.exe
Token: SeDebugPrivilege	3284	i_czxrpmkecz.exe
Token: SeDebugPrivilege	2680	i_xrpjhezwrp.exe
Token: SeDebugPrivilege	1588	i_qojgbztrlj.exe
Token: SeDebugPrivilege	5792	i_dbwtomgeyw.exe
Token: SeDebugPrivilege	2812	i_wqoigaytql.exe
Token: SeDebugPrivilege	2328	i_nifdbvtnlf.exe
Token: SeDebugPrivilege	2740	i_icavpnifax.exe
Token: SeDebugPrivilege	4280	i_nhfaxsqkic.exe
Token: SeDebugPrivilege	1908	i_ecxupnhfzx.exe
Token: SeDebugPrivilege	5780	i_zxromhezxr.exe
Token: SeDebugPrivilege	4604	i_wrojhbzwro.exe
Token: SeDebugPrivilege	4920	i_zwrojhbytr.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4684	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1784 wrote to memory of 996	1784	2026-07-18_77732a363a77c39f7d79fcf674e47761_amadey_darkgate_elex_smoke-loader_stop.exe	89
PID 1784 wrote to memory of 4832	1784	2026-07-18_77732a363a77c39f7d79fcf674e47761_amadey_darkgate_elex_smoke-loader_stop.exe	90
PID 4832 wrote to memory of 4684	4832	iexplore.exe	91
PID 4684 wrote to memory of 1376	4684	msedge.exe	92
PID 4684 wrote to memory of 2872	4684	msedge.exe	93
PID 4684 wrote to memory of 3620	4684	msedge.exe	94
PID 4684 wrote to memory of 2872	4684	msedge.exe	93
PID 4684 wrote to memory of 2872	4684	msedge.exe	93
PID 4684 wrote to memory of 2040	4684	msedge.exe	95
PID 4684 wrote to memory of 2040	4684	msedge.exe	95
PID 4684 wrote to memory of 5820	4684	msedge.exe	97
PID 4684 wrote to memory of 5820	4684	msedge.exe	97
PID 4684 wrote to memory of 5820	4684	msedge.exe	97
PID 4684 wrote to memory of 1924	4684	msedge.exe	98
PID 4684 wrote to memory of 1924	4684	msedge.exe	98
PID 4684 wrote to memory of 1924	4684	msedge.exe	98
PID 4684 wrote to memory of 5764	4684	msedge.exe	99
PID 4684 wrote to memory of 5764	4684	msedge.exe	99
PID 4684 wrote to memory of 5764	4684	msedge.exe	99
PID 4684 wrote to memory of 5488	4684	msedge.exe	100
PID 4684 wrote to memory of 5488	4684	msedge.exe	100
PID 4684 wrote to memory of 5488	4684	msedge.exe	100
PID 4684 wrote to memory of 5992	4684	msedge.exe	101
PID 4684 wrote to memory of 5992	4684	msedge.exe	101
PID 4684 wrote to memory of 5132	4684	msedge.exe	106
PID 4684 wrote to memory of 4800	4684	msedge.exe	105
PID 4684 wrote to memory of 5132	4684	msedge.exe	106
PID 4684 wrote to memory of 4800	4684	msedge.exe	105
PID 4684 wrote to memory of 4132	4684	msedge.exe	108
PID 996 wrote to memory of 1348	996	zurmkecwuomgezwr.exe	110
PID 4684 wrote to memory of 1688	4684	msedge.exe	114
PID 4684 wrote to memory of 1688	4684	msedge.exe	114
PID 2732 wrote to memory of 2772	2732	bztrmjebzt.exe	115
PID 4684 wrote to memory of 124	4684	msedge.exe	118
PID 4684 wrote to memory of 124	4684	msedge.exe	118
PID 996 wrote to memory of 5644	996	zurmkecwuomgezwr.exe	119
PID 996 wrote to memory of 1228	996	zurmkecwuomgezwr.exe	123
PID 2532 wrote to memory of 6056	2532	qojgbzwroj.exe	125
PID 996 wrote to memory of 5896	996	zurmkecwuomgezwr.exe	128
PID 996 wrote to memory of 1580	996	zurmkecwuomgezwr.exe	132
PID 5020 wrote to memory of 1328	5020	jdbvtolgey.exe	134
PID 996 wrote to memory of 4900	996	zurmkecwuomgezwr.exe	137
PID 996 wrote to memory of 3776	996	zurmkecwuomgezwr.exe	142
PID 5900 wrote to memory of 1956	5900	yvqoigaysq.exe	144
PID 996 wrote to memory of 620	996	zurmkecwuomgezwr.exe	147
PID 4684 wrote to memory of 5772	4684	msedge.exe	149
PID 4684 wrote to memory of 1656	4684	msedge.exe	150
PID 4684 wrote to memory of 1652	4684	msedge.exe	151
PID 996 wrote to memory of 4180	996	zurmkecwuomgezwr.exe	154
PID 916 wrote to memory of 2600	916	fdavtnlfdx.exe	156
PID 996 wrote to memory of 2256	996	zurmkecwuomgezwr.exe	159
PID 996 wrote to memory of 3380	996	zurmkecwuomgezwr.exe	163
PID 1084 wrote to memory of 1560	1084	xusnkidxvp.exe	165
PID 996 wrote to memory of 5540	996	zurmkecwuomgezwr.exe	168
PID 996 wrote to memory of 5760	996	zurmkecwuomgezwr.exe	172
PID 4784 wrote to memory of 2588	4784	hcausnkfcx.exe	174
PID 996 wrote to memory of 4216	996	zurmkecwuomgezwr.exe	177
PID 996 wrote to memory of 2944	996	zurmkecwuomgezwr.exe	181
PID 3376 wrote to memory of 4884	3376	czxrpmkecz.exe	183
PID 996 wrote to memory of 4056	996	zurmkecwuomgezwr.exe	186
PID 4684 wrote to memory of 4768	4684	msedge.exe	188
PID 4684 wrote to memory of 4768	4684	msedge.exe	188
PID 996 wrote to memory of 5300	996	zurmkecwuomgezwr.exe	194
PID 2612 wrote to memory of 1848	2612	xrpjhezwrp.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-07-18_77732a363a77c39f7d79fcf674e47761_amadey_darkgate_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_77732a363a77c39f7d79fcf674e47761_amadey_darkgate_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1784
- C:\Temp\zurmkecwuomgezwr.exe
  C:\Temp\zurmkecwuomgezwr.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:996
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bztrmjebzt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1348
  - - C:\Temp\bztrmjebzt.exe
      C:\Temp\bztrmjebzt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2732
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2772
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1068
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bztrmjebzt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5644
  - - C:\Temp\i_bztrmjebzt.exe
      C:\Temp\i_bztrmjebzt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1724
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qojgbzwroj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1228
  - - C:\Temp\qojgbzwroj.exe
      C:\Temp\qojgbzwroj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2532
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6056
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5712
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qojgbzwroj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5896
  - - C:\Temp\i_qojgbzwroj.exe
      C:\Temp\i_qojgbzwroj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2580
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jdbvtolgey.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1580
  - - C:\Temp\jdbvtolgey.exe
      C:\Temp\jdbvtolgey.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5020
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1328
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2632
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jdbvtolgey.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4900
  - - C:\Temp\i_jdbvtolgey.exe
      C:\Temp\i_jdbvtolgey.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2712
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\yvqoigaysq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3776
  - - C:\Temp\yvqoigaysq.exe
      C:\Temp\yvqoigaysq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5900
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1956
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5076
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_yvqoigaysq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:620
  - - C:\Temp\i_yvqoigaysq.exe
      C:\Temp\i_yvqoigaysq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2116
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fdavtnlfdx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4180
  - - C:\Temp\fdavtnlfdx.exe
      C:\Temp\fdavtnlfdx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:916
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2600
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5616
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fdavtnlfdx.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2256
  - - C:\Temp\i_fdavtnlfdx.exe
      C:\Temp\i_fdavtnlfdx.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5108
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xusnkidxvp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3380
  - - C:\Temp\xusnkidxvp.exe
      C:\Temp\xusnkidxvp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1084
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1560
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1688
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xusnkidxvp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5540
  - - C:\Temp\i_xusnkidxvp.exe
      C:\Temp\i_xusnkidxvp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1980
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hcausnkfcx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5760
  - - C:\Temp\hcausnkfcx.exe
      C:\Temp\hcausnkfcx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4784
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2588
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4244
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hcausnkfcx.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4216
  - - C:\Temp\i_hcausnkfcx.exe
      C:\Temp\i_hcausnkfcx.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5352
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\czxrpmkecz.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2944
  - - C:\Temp\czxrpmkecz.exe
      C:\Temp\czxrpmkecz.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3376
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4884
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2584
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_czxrpmkecz.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4056
  - - C:\Temp\i_czxrpmkecz.exe
      C:\Temp\i_czxrpmkecz.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3284
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xrpjhezwrp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5300
  - - C:\Temp\xrpjhezwrp.exe
      C:\Temp\xrpjhezwrp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2612
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1848
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2912
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xrpjhezwrp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5072
  - - C:\Temp\i_xrpjhezwrp.exe
      C:\Temp\i_xrpjhezwrp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2680
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qojgbztrlj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4064
  - - C:\Temp\qojgbztrlj.exe
      C:\Temp\qojgbztrlj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:6040
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3484
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5604
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qojgbztrlj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:944
  - - C:\Temp\i_qojgbztrlj.exe
      C:\Temp\i_qojgbztrlj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1588
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbwtomgeyw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1904
  - - C:\Temp\dbwtomgeyw.exe
      C:\Temp\dbwtomgeyw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3936
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5424
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1488
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbwtomgeyw.exe ups_ins
    3⤵
    PID:1980
  - - C:\Temp\i_dbwtomgeyw.exe
      C:\Temp\i_dbwtomgeyw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5792
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wqoigaytql.exe ups_run
    3⤵
    PID:2028
  - - C:\Temp\wqoigaytql.exe
      C:\Temp\wqoigaytql.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5056
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2116
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3632
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wqoigaytql.exe ups_ins
    3⤵
    PID:3624
  - - C:\Temp\i_wqoigaytql.exe
      C:\Temp\i_wqoigaytql.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2812
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nifdbvtnlf.exe ups_run
    3⤵
    PID:5744
  - - C:\Temp\nifdbvtnlf.exe
      C:\Temp\nifdbvtnlf.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:940
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2928
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2016
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nifdbvtnlf.exe ups_ins
    3⤵
    PID:4596
  - - C:\Temp\i_nifdbvtnlf.exe
      C:\Temp\i_nifdbvtnlf.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2328
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\icavpnifax.exe ups_run
    3⤵
    PID:5880
  - - C:\Temp\icavpnifax.exe
      C:\Temp\icavpnifax.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3412
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5792
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5280
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_icavpnifax.exe ups_ins
    3⤵
    PID:3192
  - - C:\Temp\i_icavpnifax.exe
      C:\Temp\i_icavpnifax.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2740
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nhfaxsqkic.exe ups_run
    3⤵
    PID:2104
  - - C:\Temp\nhfaxsqkic.exe
      C:\Temp\nhfaxsqkic.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4132
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4332
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5320
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nhfaxsqkic.exe ups_ins
    3⤵
    PID:5860
  - - C:\Temp\i_nhfaxsqkic.exe
      C:\Temp\i_nhfaxsqkic.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4280
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ecxupnhfzx.exe ups_run
    3⤵
    PID:4092
  - - C:\Temp\ecxupnhfzx.exe
      C:\Temp\ecxupnhfzx.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3340
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4592
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4580
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ecxupnhfzx.exe ups_ins
    3⤵
    PID:4524
  - - C:\Temp\i_ecxupnhfzx.exe
      C:\Temp\i_ecxupnhfzx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1908
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zxromhezxr.exe ups_run
    3⤵
    PID:2252
  - - C:\Temp\zxromhezxr.exe
      C:\Temp\zxromhezxr.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3816
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4276
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2680
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zxromhezxr.exe ups_ins
    3⤵
    PID:5332
  - - C:\Temp\i_zxromhezxr.exe
      C:\Temp\i_zxromhezxr.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5780
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wrojhbzwro.exe ups_run
    3⤵
    PID:1196
  - - C:\Temp\wrojhbzwro.exe
      C:\Temp\wrojhbzwro.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2076
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1652
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3632
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wrojhbzwro.exe ups_ins
    3⤵
    PID:264
  - - C:\Temp\i_wrojhbzwro.exe
      C:\Temp\i_wrojhbzwro.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4604
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zwrojhbytr.exe ups_run
    3⤵
    PID:1592
  - - C:\Temp\zwrojhbytr.exe
      C:\Temp\zwrojhbytr.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1544
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4156
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1324
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zwrojhbytr.exe ups_ins
    3⤵
    PID:1444
  - - C:\Temp\i_zwrojhbytr.exe
      C:\Temp\i_zwrojhbytr.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4920
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ytrljdbztr.exe ups_run
    3⤵
    PID:1468
  - - C:\Temp\ytrljdbztr.exe
      C:\Temp\ytrljdbztr.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4296
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4560
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4388
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x384,0x7ffab109c188,0x7ffab109c194,0x7ffab109c1a0
      4⤵
      PID:1376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1604,i,15823409529615230549,6309416861192494837,262144 --field-trial-handle=2336,i,18062494427490077482,9540058149160473872,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:2
      4⤵
      PID:2872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,9871002115771566687,4472970292975912463,524288 --field-trial-handle=2336,i,18062494427490077482,9540058149160473872,262144 --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:11
      4⤵
      System Time Discovery
      PID:3620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2484,i,9233936941496028179,13198509471901837988,524288 --field-trial-handle=2336,i,18062494427490077482,9540058149160473872,262144 --variations-seed-version --mojo-platform-channel-handle=3092 /prefetch:13
      4⤵
      PID:2040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3552,i,16897868821933596271,9167352693021678619,2097152 --field-trial-handle=2336,i,18062494427490077482,9540058149160473872,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
      4⤵
      PID:5820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3556,i,4639566489150751366,10396609927191281378,2097152 --field-trial-handle=2336,i,18062494427490077482,9540058149160473872,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
      4⤵
      PID:1924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=2536,i,18053437197876543739,10002031128360117586,2097152 --field-trial-handle=2336,i,18062494427490077482,9540058149160473872,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:9
      4⤵
      PID:5764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,3871345145787977328,3423742220935810770,2097152 --field-trial-handle=2336,i,18062494427490077482,9540058149160473872,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
      4⤵
      PID:5488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,17693803162613805856,9623180079593684316,524288 --field-trial-handle=2336,i,18062494427490077482,9540058149160473872,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:14
      4⤵
      PID:5992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,12504284542121156473,17848949452766595013,524288 --field-trial-handle=2336,i,18062494427490077482,9540058149160473872,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
      4⤵
      PID:4800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,11115325331994194710,3622348721627858401,524288 --field-trial-handle=2336,i,18062494427490077482,9540058149160473872,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:14
      4⤵
      PID:5132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,2732843412547577814,18385951510079121591,524288 --field-trial-handle=2336,i,18062494427490077482,9540058149160473872,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:14
      4⤵
      PID:1400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,2732843412547577814,18385951510079121591,524288 --field-trial-handle=2336,i,18062494427490077482,9540058149160473872,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:14
      4⤵
      PID:4132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,16303017877967975141,9177797197365520907,524288 --field-trial-handle=2336,i,18062494427490077482,9540058149160473872,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
      4⤵
      PID:1688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6680,i,1986645890065278615,10183382462455217727,524288 --field-trial-handle=2336,i,18062494427490077482,9540058149160473872,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:14
      4⤵
      PID:124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3784,i,11294259120418825873,15890784316005005561,524288 --field-trial-handle=2336,i,18062494427490077482,9540058149160473872,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:14
      4⤵
      PID:5772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,9658311737006512579,8457807221626408985,524288 --field-trial-handle=2336,i,18062494427490077482,9540058149160473872,262144 --variations-seed-version --mojo-platform-channel-handle=6836 /prefetch:14
      4⤵
      PID:1656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,16904329679029809272,14503884645992326701,524288 --field-trial-handle=2336,i,18062494427490077482,9540058149160473872,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
      4⤵
      PID:1652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2116,i,5000162070700384668,11785274973478270035,524288 --field-trial-handle=2336,i,18062494427490077482,9540058149160473872,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:14
      4⤵
      PID:4768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5580,i,11918041057688155037,2284669200589297324,524288 --field-trial-handle=2336,i,18062494427490077482,9540058149160473872,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:14
      4⤵
      PID:4312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5576,i,18359168751853996480,12034406228464972098,524288 --field-trial-handle=2336,i,18062494427490077482,9540058149160473872,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
      4⤵
      PID:5832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,2093666976981473610,17266588452517142734,524288 --field-trial-handle=2336,i,18062494427490077482,9540058149160473872,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:14
      4⤵
      PID:5808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6108,i,1243741940874520824,6077896320069343318,262144 --field-trial-handle=2336,i,18062494427490077482,9540058149160473872,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:10
      4⤵
      PID:4284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6824,i,13541339907665555857,12824086417079520573,524288 --field-trial-handle=2336,i,18062494427490077482,9540058149160473872,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:14
      4⤵
      PID:4572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,5420901907753215833,8538778246285687832,524288 --field-trial-handle=2336,i,18062494427490077482,9540058149160473872,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
      4⤵
      PID:5344

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2360

C:\Temp\zurmkecwuomgezwr.sys
C:\Temp\zurmkecwuomgezwr.sys
1⤵
- Executes dropped EXE
PID:5972

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:756

C:\Temp\hezwuomgey.sys
C:\Temp\hezwuomgey.sys
1⤵
- Executes dropped EXE
PID:1792

C:\Temp\ljdbztrljg.sys
C:\Temp\ljdbztrljg.sys
1⤵
- Executes dropped EXE
PID:5840

C:\Temp\daywqoigdy.sys
C:\Temp\daywqoigdy.sys
1⤵
- Executes dropped EXE
PID:5716

C:\Temp\nlfdaysnli.sys
C:\Temp\nlfdaysnli.sys
1⤵
- Executes dropped EXE
PID:2944

C:\Temp\ifdaysqnli.sys
C:\Temp\ifdaysqnli.sys
1⤵
- Executes dropped EXE
PID:4728

C:\Temp\kicausnkfc.sys
C:\Temp\kicausnkfc.sys
1⤵
- Executes dropped EXE
PID:5636

C:\Temp\fcxurpjhfz.sys
C:\Temp\fcxurpjhfz.sys
1⤵
- Executes dropped EXE
PID:1196

C:\Temp\ezwuomhbzw.sys
C:\Temp\ezwuomhbzw.sys
1⤵
- Executes dropped EXE
PID:5212

C:\Temp\ztrpjhbztr.sys
C:\Temp\ztrpjhbztr.sys
1⤵
- Executes dropped EXE
PID:4600

C:\Temp\bywqomjebw.sys
C:\Temp\bywqomjebw.sys
1⤵
- Executes dropped EXE
PID:1776

C:\Temp\eywqoigayw.sys
C:\Temp\eywqoigayw.sys
1⤵
PID:5908

C:\Temp\qnlfdbytql.sys
C:\Temp\qnlfdbytql.sys
1⤵
PID:5840

C:\Temp\tnlfdxvqnl.sys
C:\Temp\tnlfdxvqnl.sys
1⤵
PID:4244

C:\Temp\hfdavsqkhf.sys
C:\Temp\hfdavsqkhf.sys
1⤵
PID:5352

C:\Temp\kiczxspkic.sys
C:\Temp\kiczxspkic.sys
1⤵
PID:4740

C:\Temp\fzxrpjhecw.sys
C:\Temp\fzxrpjhecw.sys
1⤵
PID:3480

C:\Temp\ezwurpjhbz.sys
C:\Temp\ezwurpjhbz.sys
1⤵
PID:5940

C:\Temp\bztrmjhbzt.sys
C:\Temp\bztrmjhbzt.sys
1⤵
PID:5340

C:\Temp\vtoljdbztr.sys
C:\Temp\vtoljdbztr.sys
1⤵
PID:3712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bztrmjebzt.exe

Path C:\Temp\bztrmjebzt.exe
Size 384KB
SHA256 f773ffc28a3581f6ac92b9ae217092701db6783b29be92c0cbb340a3bd356ec4
MD5 45989b5c377c67c7f57c0567ecce5e27
SHA1 e2a97143ef6fe75523a6ace180e120c1336f8206
SHA512 f7113c31ce05ff816bb3183d7f7ae548eb1fa6591b19b4e3e3ecf99427ea08dcc68d6b4f75122818b9cef0de0cc2a7e5da395c2a22c7511ebe3eade89433cda6
SSDEEP 3072:k9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:+ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T170847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

daywqoigdy.sys

Path C:\Temp\daywqoigdy.sys
Size 293KB
SHA256 8e0a9ed84c0661d571a4340dde6f62999abf1363cb3b9fde74340a46fb35e878
MD5 b07ccc5ca686ef463a06c55b665f4e6e
SHA1 74aab411959eb9ea7b620d883772c4e308ee3b3b
SHA512 c9b62c62895e86412111147277c157f2ea5e6f2c778774b53bc3f5d0dddf6ed3b0755f64bae648a0b2cead4e0de34a7ec4d3aef18f30e0511a53b0deaf87d445
SSDEEP 3072:MtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:MIJjiJcbI03GBc3ucY5DCSj
TLSH
T14C545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdavtnlfdx.exe

Path C:\Temp\fdavtnlfdx.exe
Size 384KB
SHA256 76afc81a969cee095ccb60e8c03bdc81991989684b5594b547a6f35d7d916449
MD5 6768866aab2cccfc7df96ae025670814
SHA1 9cc46175a952698063761f3eebe86a163f67213d
SHA512 dc8647e2231db15b2fc8f4d98d4e8f48126383ef2c9e47329791bb0dcacceab7b492c6571a5dbf3b33c642e8d0e5819864f7c04e155200db3aa1c8a249276f7c
SSDEEP 3072:v9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:1ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T11B847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hezwuomgey.sys

Path C:\Temp\hezwuomgey.sys
Size 293KB
SHA256 e43e1ccd6f271c4c8e95c328b9d2c8f9e04277f3bd05ffe908c79ba106325582
MD5 ec0f09522cb5937dffaa0749e6ab0481
SHA1 d70931459a9ddd50189c599781fd602db69dd593
SHA512 84052a019269b298f6162697af0fc6efd37923a77ffe240073bf4a7250f4dfa32efaa003ee7dd49b1aecb7460abeed47ca65e41a82a797b269f25d302a690193
SSDEEP 3072:ztKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:zIJjiJcbI03GBc3ucY5DCSj
TLSH
T115545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bztrmjebzt.exe

Path C:\Temp\i_bztrmjebzt.exe
Size 384KB
SHA256 2e135194919ef5837c2cc08eba86c92c4c8f4aaea07ec8be9607c017354d2789
MD5 7d1563aac885a8904ff08e2527024390
SHA1 cc99b3bc4769de600f69012076c07553c8008613
SHA512 831e312d5cd3e7d2c5bd506f6225889b7f3e93986f98969682a3f0d46d873e6272d49fbbe61bc0046ef6159f224e983de963b4c7dc62f8237b4f1dc21d079db9
SSDEEP 3072:a9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:ActFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1DC847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fdavtnlfdx.exe

Path C:\Temp\i_fdavtnlfdx.exe
Size 384KB
SHA256 ba5fc13a1e382efba35e8d6955fc4acc86e03eb19f566d71131c3c0b9ce920e4
MD5 a12dbb1096efa3feb9a06cdc69ee0be7
SHA1 479e4a58f08c988964842fe76d1a2ef2235c2fcd
SHA512 85011f0e36179d17990ddc1eb37a36665a01b91583b5ca76808d1cbb8381acbd97f5ff1ecf433d074025b46f1a5a6f46172ecf95d0020684bb575ebe39a973a5
SSDEEP 3072:ct9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9r:gctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T10A846A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jdbvtolgey.exe

Path C:\Temp\i_jdbvtolgey.exe
Size 384KB
SHA256 f735ce8676bb850b36841c868072434a58983c4d7ebc9c4d4b1e7b3b5c498477
MD5 083c7592635133ae533d53f28a649f80
SHA1 af9fbb8fd3e745466e7f6b3cbd94d23f6fb1494e
SHA512 85c0ce5d747214c61453c818ac845da1fb8d2490489761d8692d21a658f0e0ccfae9402a60d18b7e8a9ddbbde143a0dad4f39d580958ae7b1aca604b890810c5
SSDEEP 3072:V9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:3ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T108847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qojgbzwroj.exe

Path C:\Temp\i_qojgbzwroj.exe
Size 384KB
SHA256 75543528af5481d4fec7b739e42140f6dc0405ed0bda00ba9852fa1e4e877ff9
MD5 69a5c6af622aaa556a5f5ad326e64505
SHA1 1f560a04578f3c080a5ba0de09770a67fcbd7681
SHA512 ae458499d64a6b2b43377162fffdddc954fd923bf4640f7f56d8c689f843c8f954a41be6fd75bdd5eec140985885d4a29fe405bccfd367e69cf8a2c531982bb1
SSDEEP 3072:C9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:YctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B0847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_yvqoigaysq.exe

Path C:\Temp\i_yvqoigaysq.exe
Size 384KB
SHA256 52b35583db5ce1436f486195bd607977f06aaa98f62e4895121a29be1b0eea79
MD5 5dd29b269791483399cf90b461ceb26b
SHA1 0e5527b5306f021fd9a874c975928171952dcae0
SHA512 9bc2cc6abf29b330306913c01246e699a472c0106195ed578e65158e776865a8eede92440868c86828f3c2d41991704e365c706c62987ab76a32250961e01ccc
SSDEEP 3072:m9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:UctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E8847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ifdaysqnli.sys

Path C:\Temp\ifdaysqnli.sys
Size 293KB
SHA256 303146cec79aceb0b361d08597b6521e93709b8e0ab2b00ffbb45d18369ded30
MD5 1723eb34940b85ea58dea5c08453de77
SHA1 d37c0bdb2f51cb7ed0da072f72fc99de38f8cfee
SHA512 6c21499041783af41a96e169245dc81e720c3c08451abbdf2174cf25d724b8e5f53b62343c37423ff635bfa27b0c2257beefa6e87fd1c2e1fedbc7c8834aee15
SSDEEP 3072:KtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:KIJjiJcbI03GBc3ucY5DCSj
TLSH
T1C5545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdbvtolgey.exe

Path C:\Temp\jdbvtolgey.exe
Size 384KB
SHA256 2239d31c4093eb1eda75686daa9e3243dd45d63b79c28bb3a6e5d13870a36ff6
MD5 5b2b02955395475b6ce72c4b2f59d00a
SHA1 ae4fe7b602351d886a535d4ae38b53f30c739185
SHA512 5e688dc53080b160367ea61a83321ede980e7f69da0832cd589d11f44f0f1ec7c82ab4a25a9925e4bdc34db54f04afd9b6b136be125d89df73494d175bd9117c
SSDEEP 3072:19ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:XctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A8847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljdbztrljg.sys

Path C:\Temp\ljdbztrljg.sys
Size 293KB
SHA256 a7bb258cd8cd7c9a6a3f15458c05f1605b192426d95df3d30fd64d6cd637f11d
MD5 d2cccffddd79dd14c1062be39b5b7340
SHA1 655dcba6d73bf62f6b2591fa175da121438c45d4
SHA512 5518f156813f4115b5d004529d6e1896e3548dc1a7837ca0d71b700137f0b24f8bbf742738309564bde3734ab1ab57508b21652bddf2a242c697f627a025fd43
SSDEEP 3072:7tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:7IJjiJcbI03GBc3ucY5DCSj
TLSH
T107545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlfdaysnli.sys

Path C:\Temp\nlfdaysnli.sys
Size 293KB
SHA256 55377cf2ffd3edb317ba6d7572f415658194515ec79150eed862ad1a08e4b4ae
MD5 7b6cf8c2179c1a136b085d051a7121ef
SHA1 602998446de32f5278e3d6d4d5f008f5b6aac612
SHA512 09158e1848005bac8f3e7e4b88c54e29420791b2f143484422a87a54dc3e7b62bf7b80adb5ef41df1df4a574483502a2def6efac713b4d75de7015b6e9e95f9e
SSDEEP 3072:MtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:MIJjiJcbI03GBc3ucY5DCSj
TLSH
T15A545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qojgbzwroj.exe

Path C:\Temp\qojgbzwroj.exe
Size 384KB
SHA256 8c93a20d788ac33edd96f703a021cece7b7914fc25925e1e7ef0191bfffca9e2
MD5 ce474b86db172eac20d33d260d673220
SHA1 51b2ca94c019acaade7472b69223d48744fe05cb
SHA512 139ecec949176fa210ff0d8e9a55b0620f792e1273ebf4bb12c750caba6506be60fc712c850ec9c90be5133b66308cc5654bf6a77c49dc56e5178300256230a5
SSDEEP 3072:u9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:MctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T153847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xusnkidxvp.exe

Path C:\Temp\xusnkidxvp.exe
Size 384KB
SHA256 ddcb8b433ecb4b5f79afeacbcaa5a9db2280256b32b139acf34815ef23fc6daa
MD5 ac2da7482cea3349fdbd27885dc035d8
SHA1 a96bcf20d568bc00214ed04bdab1c19e81a51adc
SHA512 c04042e9393a4bd298dc0d9e2a08c8c528f9571865d80e0984ec48a2edb990b85da8d0e12ae2d374a7883b5bfd8a6d6aac5ab6dd37a7f1920f02f5078d7df434
SSDEEP 3072:U9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:uctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T179847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yvqoigaysq.exe

Path C:\Temp\yvqoigaysq.exe
Size 384KB
SHA256 aa530e110b4f2f0b44e2224537369db90a06f6ad6c2e2f481fa2f1dae3e78fc0
MD5 71b3e5d02db5d91d4c1142463c3f0e96
SHA1 35fdd46781da9713cbf18cb2d19940da3c919141
SHA512 303b0d47280d6cac4c48b5af1c5b9d888c9ce260ffde783a209b7f295abc79bf2f55b216bc86f834f47737e875e4135874d55637d7303a6fa035313f995bc269
SSDEEP 3072:gm9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9J:tctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T158847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zurmkecwuomgezwr.exe

Path C:\Temp\zurmkecwuomgezwr.exe
Size 384KB
SHA256 1c3ba73bcdb8c0cf0770a2db31cfc046de96f914d8c263ee5217389fc369b704
MD5 b6436f342cbf5b2918d75ad2eb860d87
SHA1 d17c4226a0611bc238cce359bbfcd36a94affa6e
SHA512 33cf3099a0b01987f2050f54a5f192fcf453c07e55ea0e4c41f4b6c592ae5dde68949130ce050726a1a96400faea530505ca5997563d3c89c7f094ef07cacff6
SSDEEP 3072:B9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:LctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C5847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zurmkecwuomgezwr.sys

Path C:\Temp\zurmkecwuomgezwr.sys
Size 293KB
SHA256 27192bad895978f4eb378867cbe83244ddff8988410472fa71b69d1e6b5526bb
MD5 a9608363e7d2601d9ac28642f181083d
SHA1 adec333bbd53f3898f775b22b428616a80f68b4f
SHA512 046d4cf874b16e1d3bed9be2fdad84713f71308f9d7fb649e1fc7240f3f712c62843e382e5cbf74d9df4256846482a903e506af6234eb73bbfe65427ec7fab88
SSDEEP 3072:ytKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdZ:yIJjiJcbI03GBc3ucY5DCSj
TLSH
T10B545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86491571-a2ac-4ed9-b1b3-96a32583eb50.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\86491571-a2ac-4ed9-b1b3-96a32583eb50.tmp
Size 38KB
SHA256 b5f8c6cd3a6d1b10f1dc6152e7771ab69d154b3b3ad1f4417c2f48b1a848f148
MD5 d8ed35c5617809bddece83ff9243c3f7
SHA1 8d2835a648d318e517d71405e82fc9484c26a12b
SHA512 c43c2357bbae621f0f62ea01b9de7cff42f9c4d27985fa5948ec71bb19253f7c13c2065ecce05479a349df88ee29b43705e44736e0598022d8f889298a2848b3
SSDEEP 768:rrv+4UNbdS3rmi0nLrEnjN3Gac1ZMeVH1SCz:rbsbg3wLQnjMa/EH1V
TLSH
T13C03DF3269A89E739CEBE38571837A037FF4525385940BA4C6CD6B0D02DB9DC130B967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecdd5c8034c45eff453cbaf31d8886e2bd9609a73853367a6d096a69cc81f1be
MD5 a774534a956a5c8affebe08e87c80683
SHA1 b3e4e20a91e4087d3b9247b5ef6815f51858a041
SHA512 27769aee2cac148a0154fe42b51da2a9a1088e9e990873915b4c7ab9bd5442a3facf82b2bd1cbaef75328bd5937813698b96ac06aa76d934d07ab5ebb194a824
TLSH
T103D09B6673449A1CC9C439712461565161115820E41443581C96715CCDE56C707571DE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dfacefa73d018d54e3feba3eef28ec722a8422fee8768a2c3d8d6253f863b375
MD5 cb5000b6fab1115bfff50bedcc3eb9fd
SHA1 afbfe0ec03df59e7a1eba1da4227111508419c03
SHA512 aab9a1afd5de2f983466724b6ecf0dbc2e176c5a1eb2f059b9507511cc53643fcf9ed990bd565f22f8d53fb82db71cba238962a75c68db02d5f10b526661bd08
TLSH
T15AD09B667354991CC9C439712462565161015820941443581D96B16CCDE56C707561DA
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 2aba8b6c653cc3993e31b8af9ae1ead42e165805ef7d9db9722ba832b3741d29
MD5 fa5f5aa49de65564d9cb6b0de3f98e63
SHA1 46c80d07a0ad91f950e01bc3da0a5470aa40c19f
SHA512 0e08ab2337c54e49d972f3f9f875a0fdbcf50ff21fb263bfb677706e3c7f9f78386b6e3950c74ef7fa0729aac488a328f111b1f74e742db302817e96f54fe724
TLSH
T1BB41BA94C37168DBFBB0B9B123D2D69932F8A2584247EE51CC511D7AC907FB658C007B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e43ee3dbe4f108bff668dde570beed68a839729e30a8ce1d065f97c5b6d2a04f
MD5 727b30fb84570656efdb038989f998df
SHA1 96aa4c1485af544eb4da11d69fe5a186a8668052
SHA512 0522883e950e11b99553c5441b28a1b54338005d3493a7c869084c8ef2e440e19fba9e58a57b060a28a5f35b0a2f6d7f90786a6dceacf08a4c4236188b669003
TLSH
T12341AEF3C3E8866E890156F0AA187E2FDE1D0915432C3D5AC9E4EF5BA3E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 42e6695ea21282e98614fbe977d7f159b84dce9562bd76a8a4b93d2a5037a3f9
MD5 49a997ddd6b79ca1143ffa348bfd5977
SHA1 a3c8541b7d883246d783403db640184cb9b3aa10
SHA512 2daeecfd87c5488461f6e3f02e7a2f07e83b9b000702288a37fcbe9e9f3013b411727d89de9f9111b5abd035ca15ad8956e8138c4594ac71aead94dec0871c7e
SSDEEP 192:sxRqRJCg/fWsOtNKCA94/FzoA8p9P/g6+WNCli/YD9n6SvGC9IgtJ:sxRqCg/fWsOtNZ8Bl/59/rSF3
TLSH
T19532A7166928AD3B9CCBE21DBB55BF53D2F95033A1D01E58A7FC970C05E66DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 828b8e60a2be8e39f9dfe4e315b5d6fc6dea8f9be57bea9298782cb01842bb91
MD5 943475d63de5f01bcf499dddfa910e92
SHA1 fc406098c443edd4d57b32b17c6d117af4934258
SHA512 bffafc651068735e53f236e5b4271d527db4cdbcf600542b89aa462b2b9aef305174a8bd3092c131653f713f5e1d3f33b76c3ebf8fa53676517191de6672b4a7
SSDEEP 192:sxRhRJCg/fWsGttoZL0zoA8p9P/g6+WNCli/YD9M6SvGC9IgDPJ:sxRhCg/fWsGttWLVl/59/GSF9
TLSH
T1B642B7166928A93B9CC7D21DBB55BF53E6F95032A1901E48B7FC8B0C05E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 e96f0a3b74d7906f00801b592d152ab290b09ae8d3e8f0c090ca1ed44352d74c
MD5 0d64f062d3052fa3a5464fac2213a062
SHA1 338b74f022243ef992e77605eb155d4d8c58e15c
SHA512 648a323dab51b74c4f737f35977525002ef02b87c23d4511feb3efbbe34eb0712b77b10ec94bb4e26083d32c313aeb4c449b1c9d522bd037b8827d277d33a0d9
SSDEEP 192:sxRhRJCg/fWsGtNKCA94/FzoA8p9P/g6+WNCli/YD9n6SvGC9IgDtJ:sxRhCg/fWsGtNZ8Bl/59/rSFT
TLSH
T13142B8166928AD3B9CCBD21DBB55BF93D2F95033A1D01E58A7FC970C05E66DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 d5c37d27f097539d6dc19bd5f14ecc6d197a1e6351b7b1ba721af54c2efac2f1
MD5 4893ca673cbe430772dd357390f6f108
SHA1 0bac3f112e4467394afbc82ee2c8a7787dcfac31
SHA512 b32a283f5dd09775bac24a9e9aeb054657cca9efd1883833e1eeb66f5b3430b1606f8c121631282d7b732eb5b11dadf4c8bdb96f6938cd6584f709c6f4c33d3e
SSDEEP 768:azfW/L7pLuL7J0Wg/XfHf8F1+UoAYDCx9Tuqh0VfUC9xbog/OVtbYc16TropiJAH:azfW/dE7J0Wg/XfHfu1ja+bYy6gpiw
TLSH
T17DD2DA7B240CCB7F4F800A9DAD1A7EDB6D6802CB9698CD5047FE951C02C6BEA52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 2f13b814bc754f1fa0d8cc009db2e0804aa5e2a2195a19b5af54398587814adc
MD5 4c87ad2091d548f35412eedd558ff011
SHA1 e8ee942805e20fdbe3703ced1c42bc3bcb71071f
SHA512 b16fc28693eecad429d5d9c0173436671c2bcc0e04a5434b21504889e53c016ef1d7a54c3d16092b10067d31948773b4947ae144b0f283b3f52fbe0df45d22d8
SSDEEP 96:KR+zC+4AwmWgFNg+mK4jg8mc2edse3HB+PrZ7/LWPM6gTLK4ygdLcBpk3zH6KYsW:C+zC+4AwRgFe+ujg8V2edse3HB+PrZ7c
TLSH
T1BC912801767A424038BD7A4890F48D1B93C1B4B73218A53B7BE8029B4F97E634DFE9D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

16a17f20-c0a9-437f-b5f9-0da8f412340e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\16a17f20-c0a9-437f-b5f9-0da8f412340e.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 e6ccfd12df17082817d0ff86a7981964d0c6e8923e0506de794653b397a2d096
MD5 400374643f23586d7e47ba84c79a57f8
SHA1 c90f3607b3857d692c2742a4d0c0596039d318c2
SHA512 4646fe754390c749c642f5f3b850c7442b59da765c3c2a5c2c525a1d33e1a04059dd272fa1b8445470c1d7e79cc235b85ea5675f4639bd252d083906444150ee
SSDEEP 384:nMsrv+89zHqlDNP9oidk38NZogvSDI+EWZlf8hyEG7OMFHy2rEoajo4cdR8eHhVO:3rv+4UNbdk3qKdi0nVrEnjN3Gac1Fs5
TLSH
T18B03B0317978DDB39CEAE345B1477A437EF412A389C40BA4DADD6B0C06875E9270B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 50KB
SHA256 a63f2709d01b9f7a68b512497cae1dca67734c45bf4c22b7891d5928f638d34d
MD5 1d76cb3452094a5b12d7e1821756ba65
SHA1 50b93f05896e2f28b53405bb037abd416cbc5a56
SHA512 f9ae82843d0d33fa5f6e94b7d44941c2cacba9db08825160a1d3587ff2c1bf93c894166c7cf408b01b5a764a6b8d8da13956ebaad7205ccdd490681e5c6e2320
SSDEEP 768:nF0rv+4UNbdY3owgYDXsnYrEnjN3Gac1Fsb9Me:mbsbW3UYQnjMabb+e
TLSH
T1233349F698E78A77D89E9383637E6E42ADBCC15375844994B7C45E0CCD864BFC30A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 2643d562670e22a83ba732bce279651353eb9957356b8d56287d48859517991a
MD5 845206a1f287657b5ece72267d53d56d
SHA1 efa7aa32a6a3db07f31ed00372d266b7bb85eca1
SHA512 b6311a44463014e606b5f08875a590fdc49f9a3cff975837bb51768d5e9b3403758200886c4d89680764a3b4ead580cbe150042c0f8cf3087b90031e8bb0a38e
SSDEEP 768:Jrv+4UNbdk3VDdi0nVrEnjN3Gac1Fsb9Me:JbsbW3pVQnjMabb+e
TLSH
T10713C0316878DEB39CEBE345B1877A43BEF416A385D40A94D6C9AB0C06879DC230B813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

45bee853-95d2-4f1f-b891-67e869681353.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\45bee853-95d2-4f1f-b891-67e869681353.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4684_2080963283\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 00c204e17346259a67a825dd049a06b5d8127b2708865dd0c0f25eca69235ed3
MD5 4fc1eaa13ca30420247cd4df4dda9214
SHA1 752412a06c2468277954967209d40ed344d1612f
SHA512 fa1340d84156801cf827138485e0120ae2288b231177638695cd7a57685ef20a5b8e9618d9a38b3f6e30ab5b21afaa9c098c09f4f4f08f9c71adebea85b3032c
TLSH
T1D171238357B9C9F3C5DB5BF102835604F5FB22380B2370340B555546AB30A7E28B8F08
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1196-314-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1776-362-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1792-185-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2944-271-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2944-307-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3480-464-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3712-492-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4244-414-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4600-333-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4728-293-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4740-446-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5212-329-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5340-488-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5352-426-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5636-310-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5716-273-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5716-258-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5840-402-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5840-423-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5840-259-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5840-233-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5908-389-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5940-468-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5972-218-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5972-62-0x0000000000010000-0x00000000000AB000-memory.dmp

Download