systex | 5be169591225ad08e8b6a8d241c1f29cbdc25ad3c65888c1e231823f46803750

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 21:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_43c2cc6dc7ed1a5ff9196c7dd7e4e721_amadey_darkgate_elex_smoke-loader_stop.exe
Size 384KB
Sample260814-1snthasdqa
SHA256 5be169591225ad08e8b6a8d241c1f29cbdc25ad3c65888c1e231823f46803750
MD5 43c2cc6dc7ed1a5ff9196c7dd7e4e721
SHA1 2f35adcb6f11d814b8200e389db8b39aad291e8a
SHA512 78b97570cfe22ed0f8f41beadf1169be61be7c4064933c2789d02c3b5670c133a48bc3d6f8c710be8b9371d2d583df19d49dece9ecbfd3ba10e845d6dc2af9b9
SSDEEP 3072:P9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:VctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T147847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
4296	jdbvtoljdbwtrljg.exe
4800	jdbvtoljdbwtrljg.sys
4796	CreateProcess.exe
764	trljdbwtom.exe
4804	CreateProcess.exe
6032	CreateProcess.exe
2516	i_trljdbwtom.exe
2280	ljdbwtnigd.sys
2716	CreateProcess.exe
4900	ayvtqlidbv.exe
3192	CreateProcess.exe
4420	CreateProcess.exe
1104	i_ayvtqlidbv.exe
4272	gayvqnlgdy.sys
4712	CreateProcess.exe
2672	ysqkicavsn.exe
3892	CreateProcess.exe
2456	CreateProcess.exe
1736	i_ysqkicavsn.exe
3496	vpnifaysqk.sys
4884	CreateProcess.exe
4880	nlidavsnlf.exe
3464	CreateProcess.exe
1692	CreateProcess.exe
1740	i_nlidavsnlf.exe
5672	nkfdxvpnhf.sys
5244	CreateProcess.exe
6108	icausmkfcx.exe
5092	CreateProcess.exe
3652	CreateProcess.exe
4128	i_icausmkfcx.exe
2056	czuspkhczx.sys
1000	CreateProcess.exe
1216	zurpnkeczu.exe
5688	CreateProcess.exe
1644	CreateProcess.exe
852	i_zurpnkeczu.exe
1776	jhecaurmke.sys
3248	CreateProcess.exe
2224	hezwrpjhbz.exe
2908	CreateProcess.exe
3444	CreateProcess.exe
4120	i_hezwrpjhbz.exe
4432	cwuomgezwr.sys
4476	CreateProcess.exe
4252	cwuomgezwr.exe
1116	CreateProcess.exe
1104	CreateProcess.exe
5464	i_cwuomgezwr.exe
4128	ebwtoljhbz.sys
4916	CreateProcess.exe
4604	dbztrojgbz.exe
2516	CreateProcess.exe
2252	CreateProcess.exe
4772	i_dbztrojgbz.exe
3024	trljdbytql.sys
3236	CreateProcess.exe
3016	vtrligaytq.exe
4692	CreateProcess.exe
5404	CreateProcess.exe
3696	i_vtrligaytq.exe
1212	wqoigaywtq.sys
824	CreateProcess.exe
6024	qnigaysqki.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3140_2131025616\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3140_745334797\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3140_311953844\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3140_311953844\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3140_311953844\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3140_1463952503\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3140_745334797\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3140_311953844\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3140_2131025616\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljdbvtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlgdywtnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnlfdyvqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwuomgezwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljdbvtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqkicavsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icausmkfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwuomgezwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igayvtnkig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lfdxvpnhfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmkecwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgezwrojh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_43c2cc6dc7ed1a5ff9196c7dd7e4e721_amadey_darkgate_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zurpnkeczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnigaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtrligaytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lfdxvpnhfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljdbwtom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ayvtqlidbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ayvtqlidbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlidavsnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zurpnkeczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hezwrpjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hezwrpjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnigaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbztrojgbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbztrojgbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtrligaytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxvpnkhczx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cxvpnkhczx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hczxuomkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgezwrojh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlgdywtnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqkicavsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icausmkfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igayvtnkig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmkecwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbvtoljdbwtrljg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljdbwtom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlidavsnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hczxuomkec.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2584	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
664	ipconfig.exe
5672	ipconfig.exe
5612	ipconfig.exe
5600	ipconfig.exe
4512	ipconfig.exe
4324	ipconfig.exe
5968	ipconfig.exe
5948	ipconfig.exe
2788	ipconfig.exe
5584	ipconfig.exe
1076	ipconfig.exe
4644	ipconfig.exe
5992	ipconfig.exe
3520	ipconfig.exe
3740	ipconfig.exe
5648	ipconfig.exe
5020	ipconfig.exe
2540	ipconfig.exe
2936	ipconfig.exe
4860	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134312181067736516"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3611646547-550105268-947503007-1000\{0E1209DB-E486-4555-8542-0DE92177C857}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2916	2026-08-14_43c2cc6dc7ed1a5ff9196c7dd7e4e721_amadey_darkgate_elex_smoke-loader_stop.exe
2916	2026-08-14_43c2cc6dc7ed1a5ff9196c7dd7e4e721_amadey_darkgate_elex_smoke-loader_stop.exe
2916	2026-08-14_43c2cc6dc7ed1a5ff9196c7dd7e4e721_amadey_darkgate_elex_smoke-loader_stop.exe
2916	2026-08-14_43c2cc6dc7ed1a5ff9196c7dd7e4e721_amadey_darkgate_elex_smoke-loader_stop.exe
2916	2026-08-14_43c2cc6dc7ed1a5ff9196c7dd7e4e721_amadey_darkgate_elex_smoke-loader_stop.exe
2916	2026-08-14_43c2cc6dc7ed1a5ff9196c7dd7e4e721_amadey_darkgate_elex_smoke-loader_stop.exe
2916	2026-08-14_43c2cc6dc7ed1a5ff9196c7dd7e4e721_amadey_darkgate_elex_smoke-loader_stop.exe
2916	2026-08-14_43c2cc6dc7ed1a5ff9196c7dd7e4e721_amadey_darkgate_elex_smoke-loader_stop.exe
2916	2026-08-14_43c2cc6dc7ed1a5ff9196c7dd7e4e721_amadey_darkgate_elex_smoke-loader_stop.exe
2916	2026-08-14_43c2cc6dc7ed1a5ff9196c7dd7e4e721_amadey_darkgate_elex_smoke-loader_stop.exe
2916	2026-08-14_43c2cc6dc7ed1a5ff9196c7dd7e4e721_amadey_darkgate_elex_smoke-loader_stop.exe
2916	2026-08-14_43c2cc6dc7ed1a5ff9196c7dd7e4e721_amadey_darkgate_elex_smoke-loader_stop.exe
2916	2026-08-14_43c2cc6dc7ed1a5ff9196c7dd7e4e721_amadey_darkgate_elex_smoke-loader_stop.exe
2916	2026-08-14_43c2cc6dc7ed1a5ff9196c7dd7e4e721_amadey_darkgate_elex_smoke-loader_stop.exe
2916	2026-08-14_43c2cc6dc7ed1a5ff9196c7dd7e4e721_amadey_darkgate_elex_smoke-loader_stop.exe
2916	2026-08-14_43c2cc6dc7ed1a5ff9196c7dd7e4e721_amadey_darkgate_elex_smoke-loader_stop.exe
2916	2026-08-14_43c2cc6dc7ed1a5ff9196c7dd7e4e721_amadey_darkgate_elex_smoke-loader_stop.exe
2916	2026-08-14_43c2cc6dc7ed1a5ff9196c7dd7e4e721_amadey_darkgate_elex_smoke-loader_stop.exe
2916	2026-08-14_43c2cc6dc7ed1a5ff9196c7dd7e4e721_amadey_darkgate_elex_smoke-loader_stop.exe
2916	2026-08-14_43c2cc6dc7ed1a5ff9196c7dd7e4e721_amadey_darkgate_elex_smoke-loader_stop.exe
2916	2026-08-14_43c2cc6dc7ed1a5ff9196c7dd7e4e721_amadey_darkgate_elex_smoke-loader_stop.exe
2916	2026-08-14_43c2cc6dc7ed1a5ff9196c7dd7e4e721_amadey_darkgate_elex_smoke-loader_stop.exe
2916	2026-08-14_43c2cc6dc7ed1a5ff9196c7dd7e4e721_amadey_darkgate_elex_smoke-loader_stop.exe
2916	2026-08-14_43c2cc6dc7ed1a5ff9196c7dd7e4e721_amadey_darkgate_elex_smoke-loader_stop.exe
2916	2026-08-14_43c2cc6dc7ed1a5ff9196c7dd7e4e721_amadey_darkgate_elex_smoke-loader_stop.exe
2916	2026-08-14_43c2cc6dc7ed1a5ff9196c7dd7e4e721_amadey_darkgate_elex_smoke-loader_stop.exe
2916	2026-08-14_43c2cc6dc7ed1a5ff9196c7dd7e4e721_amadey_darkgate_elex_smoke-loader_stop.exe
2916	2026-08-14_43c2cc6dc7ed1a5ff9196c7dd7e4e721_amadey_darkgate_elex_smoke-loader_stop.exe
2916	2026-08-14_43c2cc6dc7ed1a5ff9196c7dd7e4e721_amadey_darkgate_elex_smoke-loader_stop.exe
2916	2026-08-14_43c2cc6dc7ed1a5ff9196c7dd7e4e721_amadey_darkgate_elex_smoke-loader_stop.exe
2916	2026-08-14_43c2cc6dc7ed1a5ff9196c7dd7e4e721_amadey_darkgate_elex_smoke-loader_stop.exe
2916	2026-08-14_43c2cc6dc7ed1a5ff9196c7dd7e4e721_amadey_darkgate_elex_smoke-loader_stop.exe
2916	2026-08-14_43c2cc6dc7ed1a5ff9196c7dd7e4e721_amadey_darkgate_elex_smoke-loader_stop.exe
2916	2026-08-14_43c2cc6dc7ed1a5ff9196c7dd7e4e721_amadey_darkgate_elex_smoke-loader_stop.exe
2916	2026-08-14_43c2cc6dc7ed1a5ff9196c7dd7e4e721_amadey_darkgate_elex_smoke-loader_stop.exe
2916	2026-08-14_43c2cc6dc7ed1a5ff9196c7dd7e4e721_amadey_darkgate_elex_smoke-loader_stop.exe
2916	2026-08-14_43c2cc6dc7ed1a5ff9196c7dd7e4e721_amadey_darkgate_elex_smoke-loader_stop.exe
2916	2026-08-14_43c2cc6dc7ed1a5ff9196c7dd7e4e721_amadey_darkgate_elex_smoke-loader_stop.exe
2916	2026-08-14_43c2cc6dc7ed1a5ff9196c7dd7e4e721_amadey_darkgate_elex_smoke-loader_stop.exe
2916	2026-08-14_43c2cc6dc7ed1a5ff9196c7dd7e4e721_amadey_darkgate_elex_smoke-loader_stop.exe
2916	2026-08-14_43c2cc6dc7ed1a5ff9196c7dd7e4e721_amadey_darkgate_elex_smoke-loader_stop.exe
2916	2026-08-14_43c2cc6dc7ed1a5ff9196c7dd7e4e721_amadey_darkgate_elex_smoke-loader_stop.exe
2916	2026-08-14_43c2cc6dc7ed1a5ff9196c7dd7e4e721_amadey_darkgate_elex_smoke-loader_stop.exe
2916	2026-08-14_43c2cc6dc7ed1a5ff9196c7dd7e4e721_amadey_darkgate_elex_smoke-loader_stop.exe
2916	2026-08-14_43c2cc6dc7ed1a5ff9196c7dd7e4e721_amadey_darkgate_elex_smoke-loader_stop.exe
2916	2026-08-14_43c2cc6dc7ed1a5ff9196c7dd7e4e721_amadey_darkgate_elex_smoke-loader_stop.exe
2916	2026-08-14_43c2cc6dc7ed1a5ff9196c7dd7e4e721_amadey_darkgate_elex_smoke-loader_stop.exe
2916	2026-08-14_43c2cc6dc7ed1a5ff9196c7dd7e4e721_amadey_darkgate_elex_smoke-loader_stop.exe
2916	2026-08-14_43c2cc6dc7ed1a5ff9196c7dd7e4e721_amadey_darkgate_elex_smoke-loader_stop.exe
2916	2026-08-14_43c2cc6dc7ed1a5ff9196c7dd7e4e721_amadey_darkgate_elex_smoke-loader_stop.exe
2916	2026-08-14_43c2cc6dc7ed1a5ff9196c7dd7e4e721_amadey_darkgate_elex_smoke-loader_stop.exe
2916	2026-08-14_43c2cc6dc7ed1a5ff9196c7dd7e4e721_amadey_darkgate_elex_smoke-loader_stop.exe
2916	2026-08-14_43c2cc6dc7ed1a5ff9196c7dd7e4e721_amadey_darkgate_elex_smoke-loader_stop.exe
2916	2026-08-14_43c2cc6dc7ed1a5ff9196c7dd7e4e721_amadey_darkgate_elex_smoke-loader_stop.exe
4296	jdbvtoljdbwtrljg.exe
4296	jdbvtoljdbwtrljg.exe
2916	2026-08-14_43c2cc6dc7ed1a5ff9196c7dd7e4e721_amadey_darkgate_elex_smoke-loader_stop.exe
2916	2026-08-14_43c2cc6dc7ed1a5ff9196c7dd7e4e721_amadey_darkgate_elex_smoke-loader_stop.exe
4296	jdbvtoljdbwtrljg.exe
4296	jdbvtoljdbwtrljg.exe
4296	jdbvtoljdbwtrljg.exe
4296	jdbvtoljdbwtrljg.exe
4296	jdbvtoljdbwtrljg.exe
4296	jdbvtoljdbwtrljg.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	2516	i_trljdbwtom.exe
Token: SeDebugPrivilege	1104	i_ayvtqlidbv.exe
Token: SeDebugPrivilege	1736	i_ysqkicavsn.exe
Token: SeDebugPrivilege	1740	i_nlidavsnlf.exe
Token: SeDebugPrivilege	4128	i_icausmkfcx.exe
Token: SeDebugPrivilege	852	i_zurpnkeczu.exe
Token: SeDebugPrivilege	4120	i_hezwrpjhbz.exe
Token: SeDebugPrivilege	5464	i_cwuomgezwr.exe
Token: SeDebugPrivilege	4772	i_dbztrojgbz.exe
Token: SeDebugPrivilege	3696	i_vtrligaytq.exe
Token: SeDebugPrivilege	1712	i_qnigaysqki.exe
Token: SeDebugPrivilege	5680	i_igayvtnkig.exe
Token: SeDebugPrivilege	1928	i_lfdxvpnhfa.exe
Token: SeDebugPrivilege	1792	i_cxvpnkhczx.exe
Token: SeDebugPrivilege	4672	i_hczxuomkec.exe
Token: SeDebugPrivilege	1476	i_rmkecwuomg.exe
Token: SeDebugPrivilege	3256	i_omgezwrojh.exe
Token: SeDebugPrivilege	2932	i_trljdbvtol.exe
Token: SeDebugPrivilege	1168	i_nlgdywtnlg.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3140	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 4296	2916	2026-08-14_43c2cc6dc7ed1a5ff9196c7dd7e4e721_amadey_darkgate_elex_smoke-loader_stop.exe	89
PID 2916 wrote to memory of 5812	2916	2026-08-14_43c2cc6dc7ed1a5ff9196c7dd7e4e721_amadey_darkgate_elex_smoke-loader_stop.exe	90
PID 5812 wrote to memory of 3140	5812	iexplore.exe	91
PID 3140 wrote to memory of 4636	3140	msedge.exe	92
PID 3140 wrote to memory of 1980	3140	msedge.exe	93
PID 3140 wrote to memory of 2584	3140	msedge.exe	94
PID 3140 wrote to memory of 1980	3140	msedge.exe	93
PID 3140 wrote to memory of 1980	3140	msedge.exe	93
PID 3140 wrote to memory of 3432	3140	msedge.exe	96
PID 3140 wrote to memory of 3432	3140	msedge.exe	96
PID 3140 wrote to memory of 1048	3140	msedge.exe	97
PID 3140 wrote to memory of 1048	3140	msedge.exe	97
PID 3140 wrote to memory of 1048	3140	msedge.exe	97
PID 3140 wrote to memory of 1504	3140	msedge.exe	98
PID 3140 wrote to memory of 1504	3140	msedge.exe	98
PID 3140 wrote to memory of 1504	3140	msedge.exe	98
PID 3140 wrote to memory of 1528	3140	msedge.exe	99
PID 3140 wrote to memory of 6060	3140	msedge.exe	100
PID 3140 wrote to memory of 1528	3140	msedge.exe	99
PID 3140 wrote to memory of 1528	3140	msedge.exe	99
PID 3140 wrote to memory of 6060	3140	msedge.exe	100
PID 3140 wrote to memory of 6060	3140	msedge.exe	100
PID 3140 wrote to memory of 1840	3140	msedge.exe	101
PID 3140 wrote to memory of 1840	3140	msedge.exe	101
PID 3140 wrote to memory of 6116	3140	msedge.exe	105
PID 3140 wrote to memory of 2324	3140	msedge.exe	106
PID 3140 wrote to memory of 6116	3140	msedge.exe	105
PID 3140 wrote to memory of 2324	3140	msedge.exe	106
PID 4296 wrote to memory of 4796	4296	jdbvtoljdbwtrljg.exe	107
PID 764 wrote to memory of 4804	764	trljdbwtom.exe	110
PID 3140 wrote to memory of 5728	3140	msedge.exe	114
PID 3140 wrote to memory of 2672	3140	msedge.exe	115
PID 3140 wrote to memory of 2672	3140	msedge.exe	115
PID 3140 wrote to memory of 4676	3140	msedge.exe	116
PID 3140 wrote to memory of 4676	3140	msedge.exe	116
PID 4296 wrote to memory of 6032	4296	jdbvtoljdbwtrljg.exe	119
PID 4296 wrote to memory of 2716	4296	jdbvtoljdbwtrljg.exe	123
PID 4900 wrote to memory of 3192	4900	ayvtqlidbv.exe	125
PID 4296 wrote to memory of 4420	4296	jdbvtoljdbwtrljg.exe	128
PID 4296 wrote to memory of 4712	4296	jdbvtoljdbwtrljg.exe	132
PID 2672 wrote to memory of 3892	2672	ysqkicavsn.exe	134
PID 4296 wrote to memory of 2456	4296	jdbvtoljdbwtrljg.exe	137
PID 4296 wrote to memory of 4884	4296	jdbvtoljdbwtrljg.exe	141
PID 4880 wrote to memory of 3464	4880	nlidavsnlf.exe	143
PID 4296 wrote to memory of 1692	4296	jdbvtoljdbwtrljg.exe	147
PID 3140 wrote to memory of 3184	3140	msedge.exe	149
PID 3140 wrote to memory of 4348	3140	msedge.exe	150
PID 3140 wrote to memory of 4172	3140	msedge.exe	151
PID 4296 wrote to memory of 5244	4296	jdbvtoljdbwtrljg.exe	154
PID 6108 wrote to memory of 5092	6108	icausmkfcx.exe	156
PID 4296 wrote to memory of 3652	4296	jdbvtoljdbwtrljg.exe	159
PID 4296 wrote to memory of 1000	4296	jdbvtoljdbwtrljg.exe	163
PID 1216 wrote to memory of 5688	1216	zurpnkeczu.exe	165
PID 4296 wrote to memory of 1644	4296	jdbvtoljdbwtrljg.exe	168
PID 4296 wrote to memory of 3248	4296	jdbvtoljdbwtrljg.exe	172
PID 2224 wrote to memory of 2908	2224	hezwrpjhbz.exe	174
PID 4296 wrote to memory of 3444	4296	jdbvtoljdbwtrljg.exe	177
PID 4296 wrote to memory of 4476	4296	jdbvtoljdbwtrljg.exe	181
PID 4252 wrote to memory of 1116	4252	cwuomgezwr.exe	183
PID 4296 wrote to memory of 1104	4296	jdbvtoljdbwtrljg.exe	186
PID 3140 wrote to memory of 6116	3140	msedge.exe	188
PID 3140 wrote to memory of 6116	3140	msedge.exe	188
PID 4296 wrote to memory of 4916	4296	jdbvtoljdbwtrljg.exe	194
PID 4604 wrote to memory of 2516	4604	dbztrojgbz.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-08-14_43c2cc6dc7ed1a5ff9196c7dd7e4e721_amadey_darkgate_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_43c2cc6dc7ed1a5ff9196c7dd7e4e721_amadey_darkgate_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Temp\jdbvtoljdbwtrljg.exe
  C:\Temp\jdbvtoljdbwtrljg.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4296
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\trljdbwtom.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4796
  - - C:\Temp\trljdbwtom.exe
      C:\Temp\trljdbwtom.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:764
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4804
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5584
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_trljdbwtom.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6032
  - - C:\Temp\i_trljdbwtom.exe
      C:\Temp\i_trljdbwtom.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2516
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ayvtqlidbv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2716
  - - C:\Temp\ayvtqlidbv.exe
      C:\Temp\ayvtqlidbv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4900
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3192
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5600
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ayvtqlidbv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4420
  - - C:\Temp\i_ayvtqlidbv.exe
      C:\Temp\i_ayvtqlidbv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1104
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ysqkicavsn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4712
  - - C:\Temp\ysqkicavsn.exe
      C:\Temp\ysqkicavsn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2672
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3892
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5648
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ysqkicavsn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2456
  - - C:\Temp\i_ysqkicavsn.exe
      C:\Temp\i_ysqkicavsn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1736
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nlidavsnlf.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4884
  - - C:\Temp\nlidavsnlf.exe
      C:\Temp\nlidavsnlf.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4880
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3464
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1076
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nlidavsnlf.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1692
  - - C:\Temp\i_nlidavsnlf.exe
      C:\Temp\i_nlidavsnlf.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1740
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\icausmkfcx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5244
  - - C:\Temp\icausmkfcx.exe
      C:\Temp\icausmkfcx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6108
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5092
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5020
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_icausmkfcx.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3652
  - - C:\Temp\i_icausmkfcx.exe
      C:\Temp\i_icausmkfcx.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4128
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zurpnkeczu.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1000
  - - C:\Temp\zurpnkeczu.exe
      C:\Temp\zurpnkeczu.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1216
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5688
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4644
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zurpnkeczu.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1644
  - - C:\Temp\i_zurpnkeczu.exe
      C:\Temp\i_zurpnkeczu.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:852
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hezwrpjhbz.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3248
  - - C:\Temp\hezwrpjhbz.exe
      C:\Temp\hezwrpjhbz.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2224
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2908
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2540
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hezwrpjhbz.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3444
  - - C:\Temp\i_hezwrpjhbz.exe
      C:\Temp\i_hezwrpjhbz.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4120
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cwuomgezwr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4476
  - - C:\Temp\cwuomgezwr.exe
      C:\Temp\cwuomgezwr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4252
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1116
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5672
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cwuomgezwr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1104
  - - C:\Temp\i_cwuomgezwr.exe
      C:\Temp\i_cwuomgezwr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5464
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbztrojgbz.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4916
  - - C:\Temp\dbztrojgbz.exe
      C:\Temp\dbztrojgbz.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4604
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2516
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2936
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbztrojgbz.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2252
  - - C:\Temp\i_dbztrojgbz.exe
      C:\Temp\i_dbztrojgbz.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4772
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtrligaytq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3236
  - - C:\Temp\vtrligaytq.exe
      C:\Temp\vtrligaytq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3016
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4692
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4512
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtrligaytq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5404
  - - C:\Temp\i_vtrligaytq.exe
      C:\Temp\i_vtrligaytq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3696
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qnigaysqki.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:824
  - - C:\Temp\qnigaysqki.exe
      C:\Temp\qnigaysqki.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:6024
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2824
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5992
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qnigaysqki.exe ups_ins
    3⤵
    PID:3052
  - - C:\Temp\i_qnigaysqki.exe
      C:\Temp\i_qnigaysqki.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1712
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\igayvtnkig.exe ups_run
    3⤵
    PID:3624
  - - C:\Temp\igayvtnkig.exe
      C:\Temp\igayvtnkig.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4704
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5408
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4324
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_igayvtnkig.exe ups_ins
    3⤵
    PID:5716
  - - C:\Temp\i_igayvtnkig.exe
      C:\Temp\i_igayvtnkig.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5680
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lfdxvpnhfa.exe ups_run
    3⤵
    PID:4832
  - - C:\Temp\lfdxvpnhfa.exe
      C:\Temp\lfdxvpnhfa.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2200
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1948
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4860
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lfdxvpnhfa.exe ups_ins
    3⤵
    PID:5320
  - - C:\Temp\i_lfdxvpnhfa.exe
      C:\Temp\i_lfdxvpnhfa.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1928
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cxvpnkhczx.exe ups_run
    3⤵
    PID:2376
  - - C:\Temp\cxvpnkhczx.exe
      C:\Temp\cxvpnkhczx.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:892
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4600
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5968
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cxvpnkhczx.exe ups_ins
    3⤵
    PID:2136
  - - C:\Temp\i_cxvpnkhczx.exe
      C:\Temp\i_cxvpnkhczx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1792
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hczxuomkec.exe ups_run
    3⤵
    PID:5584
  - - C:\Temp\hczxuomkec.exe
      C:\Temp\hczxuomkec.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4864
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5172
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5948
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hczxuomkec.exe ups_ins
    3⤵
    PID:4580
  - - C:\Temp\i_hczxuomkec.exe
      C:\Temp\i_hczxuomkec.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4672
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rmkecwuomg.exe ups_run
    3⤵
    PID:1136
  - - C:\Temp\rmkecwuomg.exe
      C:\Temp\rmkecwuomg.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3376
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1740
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2788
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rmkecwuomg.exe ups_ins
    3⤵
    PID:4428
  - - C:\Temp\i_rmkecwuomg.exe
      C:\Temp\i_rmkecwuomg.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1476
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\omgezwrojh.exe ups_run
    3⤵
    PID:3292
  - - C:\Temp\omgezwrojh.exe
      C:\Temp\omgezwrojh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2276
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2500
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:664
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_omgezwrojh.exe ups_ins
    3⤵
    PID:5044
  - - C:\Temp\i_omgezwrojh.exe
      C:\Temp\i_omgezwrojh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3256
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\trljdbvtol.exe ups_run
    3⤵
    PID:1736
  - - C:\Temp\trljdbvtol.exe
      C:\Temp\trljdbvtol.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1712
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3748
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3520
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_trljdbvtol.exe ups_ins
    3⤵
    PID:5996
  - - C:\Temp\i_trljdbvtol.exe
      C:\Temp\i_trljdbvtol.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2932
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nlgdywtnlg.exe ups_run
    3⤵
    PID:1304
  - - C:\Temp\nlgdywtnlg.exe
      C:\Temp\nlgdywtnlg.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5012
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4520
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5612
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nlgdywtnlg.exe ups_ins
    3⤵
    PID:3824
  - - C:\Temp\i_nlgdywtnlg.exe
      C:\Temp\i_nlgdywtnlg.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1168
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tnlfdyvqoi.exe ups_run
    3⤵
    PID:5332
  - - C:\Temp\tnlfdyvqoi.exe
      C:\Temp\tnlfdyvqoi.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1780
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4744
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3740
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffc1b02c188,0x7ffc1b02c194,0x7ffc1b02c1a0
      4⤵
      PID:4636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1692,i,9843687257349378807,17697020489273840072,262144 --field-trial-handle=2296,i,1484454469037868144,17538715630832844578,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:2
      4⤵
      PID:1980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,9992604815987543048,11640180935109627796,524288 --field-trial-handle=2296,i,1484454469037868144,17538715630832844578,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:11
      4⤵
      System Time Discovery
      PID:2584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2320,i,17906932670719905608,11137378675910743603,524288 --field-trial-handle=2296,i,1484454469037868144,17538715630832844578,262144 --variations-seed-version --mojo-platform-channel-handle=3272 /prefetch:13
      4⤵
      PID:3432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3548,i,7420863471764441287,9307750749718724620,2097152 --field-trial-handle=2296,i,1484454469037868144,17538715630832844578,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
      4⤵
      PID:1048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3564,i,273154207113445454,14015918372033092012,2097152 --field-trial-handle=2296,i,1484454469037868144,17538715630832844578,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
      4⤵
      PID:1504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4336,i,15435816906153017459,15543999654989154360,2097152 --field-trial-handle=2296,i,1484454469037868144,17538715630832844578,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:9
      4⤵
      PID:1528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4320,i,12760527633114780367,10695851390647556934,2097152 --field-trial-handle=2296,i,1484454469037868144,17538715630832844578,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:1
      4⤵
      PID:6060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,13742154386670106367,3873677730800639267,524288 --field-trial-handle=2296,i,1484454469037868144,17538715630832844578,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:14
      4⤵
      PID:1840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,1180856064648357818,8618225973270957305,524288 --field-trial-handle=2296,i,1484454469037868144,17538715630832844578,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:14
      4⤵
      PID:6116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,98284480067766390,9485676266182148352,524288 --field-trial-handle=2296,i,1484454469037868144,17538715630832844578,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
      4⤵
      PID:2324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,17951089836003230285,13058068904113383536,524288 --field-trial-handle=2296,i,1484454469037868144,17538715630832844578,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:14
      4⤵
      PID:5100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,17951089836003230285,13058068904113383536,524288 --field-trial-handle=2296,i,1484454469037868144,17538715630832844578,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:14
      4⤵
      PID:5728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,1426588218751695395,823178083209538033,524288 --field-trial-handle=2296,i,1484454469037868144,17538715630832844578,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:14
      4⤵
      PID:2672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6560,i,8673043190821591125,6840414211327673844,524288 --field-trial-handle=2296,i,1484454469037868144,17538715630832844578,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:14
      4⤵
      PID:4676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4496,i,2616937244987321381,9556214330414961835,524288 --field-trial-handle=2296,i,1484454469037868144,17538715630832844578,262144 --variations-seed-version --mojo-platform-channel-handle=4624 /prefetch:14
      4⤵
      PID:3184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4316,i,8799564328076042327,7718506887243096955,524288 --field-trial-handle=2296,i,1484454469037868144,17538715630832844578,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:14
      4⤵
      PID:4348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4908,i,4946936799675848963,12749181940010812531,524288 --field-trial-handle=2296,i,1484454469037868144,17538715630832844578,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:14
      4⤵
      PID:4172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3860,i,16411216058302489008,4626920572665124548,524288 --field-trial-handle=2296,i,1484454469037868144,17538715630832844578,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:14
      4⤵
      PID:6116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,8772818519460474059,213813800864601866,524288 --field-trial-handle=2296,i,1484454469037868144,17538715630832844578,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
      4⤵
      PID:5100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=944,i,15766306863702346668,2353307672695462527,524288 --field-trial-handle=2296,i,1484454469037868144,17538715630832844578,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:14
      4⤵
      PID:1136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,1438920679359967619,15499276600623492976,524288 --field-trial-handle=2296,i,1484454469037868144,17538715630832844578,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:14
      4⤵
      PID:2532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6448,i,11682319398707547118,17750158104335148341,262144 --field-trial-handle=2296,i,1484454469037868144,17538715630832844578,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:10
      4⤵
      PID:4080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,15609754094430815983,14893139263857460321,524288 --field-trial-handle=2296,i,1484454469037868144,17538715630832844578,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:14
      4⤵
      PID:4132

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4792

C:\Temp\jdbvtoljdbwtrljg.sys
C:\Temp\jdbvtoljdbwtrljg.sys
1⤵
- Executes dropped EXE
PID:4800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5456

C:\Temp\ljdbwtnigd.sys
C:\Temp\ljdbwtnigd.sys
1⤵
- Executes dropped EXE
PID:2280

C:\Temp\gayvqnlgdy.sys
C:\Temp\gayvqnlgdy.sys
1⤵
- Executes dropped EXE
PID:4272

C:\Temp\vpnifaysqk.sys
C:\Temp\vpnifaysqk.sys
1⤵
- Executes dropped EXE
PID:3496

C:\Temp\nkfdxvpnhf.sys
C:\Temp\nkfdxvpnhf.sys
1⤵
- Executes dropped EXE
PID:5672

C:\Temp\czuspkhczx.sys
C:\Temp\czuspkhczx.sys
1⤵
- Executes dropped EXE
PID:2056

C:\Temp\jhecaurmke.sys
C:\Temp\jhecaurmke.sys
1⤵
- Executes dropped EXE
PID:1776

C:\Temp\cwuomgezwr.sys
C:\Temp\cwuomgezwr.sys
1⤵
- Executes dropped EXE
PID:4432

C:\Temp\ebwtoljhbz.sys
C:\Temp\ebwtoljhbz.sys
1⤵
- Executes dropped EXE
PID:4128

C:\Temp\trljdbytql.sys
C:\Temp\trljdbytql.sys
1⤵
- Executes dropped EXE
PID:3024

C:\Temp\wqoigaywtq.sys
C:\Temp\wqoigaywtq.sys
1⤵
- Executes dropped EXE
PID:1212

C:\Temp\kidavtqlid.sys
C:\Temp\kidavtqlid.sys
1⤵
PID:2136

C:\Temp\nlfcaxvpnk.sys
C:\Temp\nlfcaxvpnk.sys
1⤵
PID:3400

C:\Temp\kecxvpnhfz.sys
C:\Temp\kecxvpnhfz.sys
1⤵
PID:2972

C:\Temp\khfcwuspnh.sys
C:\Temp\khfcwuspnh.sys
1⤵
PID:2568

C:\Temp\romhecwupm.sys
C:\Temp\romhecwupm.sys
1⤵
PID:3952

C:\Temp\rmjebwuroj.sys
C:\Temp\rmjebwuroj.sys
1⤵
PID:5464

C:\Temp\rljgbywqoj.sys
C:\Temp\rljgbywqoj.sys
1⤵
PID:3300

C:\Temp\ytqljdbvtn.sys
C:\Temp\ytqljdbvtn.sys
1⤵
PID:2040

C:\Temp\tqligdyvqn.sys
C:\Temp\tqligdyvqn.sys
1⤵
PID:4824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ayvtqlidbv.exe

Path C:\Temp\ayvtqlidbv.exe
Size 384KB
SHA256 7a589a228625ace2b2512325c68317f89f04cb75d6a1e28697453a67860c97a3
MD5 ea7cf0e0a877e85d46088d6cb21656b2
SHA1 a30c304770c1805dfd6087526ab4f7891a807efd
SHA512 5541026d8d28fae6f1170c5551dfed8f66345f8a71e65bea99c4256c4dd1edba8af031485f7dd6556438b97582b17aa4d655a9c45fa4a1dbe195f29d26545511
SSDEEP 3072:c9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:mctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A5847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

czuspkhczx.sys

Path C:\Temp\czuspkhczx.sys
Size 293KB
SHA256 8337331c46dcfe76eca9629db5847d334272cefef8dbfb54170cc44451e9b4a7
MD5 aa5a368f928cb1361dadf97b9539d72c
SHA1 d2b8e52af78fd9cd89a976c23368373b966a3fba
SHA512 06b2b5bbd1ef3c1f08c0183b314a13010dea0111e88c16fe11119a344f7ec486d9ac400c7b7f1e1b008fae2b3503041592ed713d28cc2afa2687c6e057c463ae
SSDEEP 3072:ZtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:ZIJjiJcbI03GBc3ucY5DCSj
TLSH
T161545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gayvqnlgdy.sys

Path C:\Temp\gayvqnlgdy.sys
Size 293KB
SHA256 142fe02b1487cb302db2c38aa5adae12846509fedcd4aefadf1578bdb4e4d223
MD5 0bd3ced9c1c82639d9c74020e6fd8ca0
SHA1 05d8ed9620ebc95764c8de9cedb2cf22b503fb05
SHA512 642e7ea6f66fd96d2ef3e1170cd0259d0f01c7754273157df017ea70fc361fc275250c7e4b93082463d94577e8f0ef46353a55d33fbf817555c4e3ac2d0f1254
SSDEEP 3072:XtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:XIJjiJcbI03GBc3ucY5DCSj
TLSH
T177545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ayvtqlidbv.exe

Path C:\Temp\i_ayvtqlidbv.exe
Size 384KB
SHA256 58ae4010b4908ffc2e21c6ce8545569b70ee98c04c2a5780a0017626456b372d
MD5 2c7f22de11f8e510147fabb69740aa94
SHA1 1ccb7c6c867caa79b28ad8034ce565fc19d422ea
SHA512 0df5de09a8c284c29abd38b1f67fc7b437d4efeb5f5c9581284a70cdb20f8233c1fc79fa5eae0f28beb7bf195bba5558b39b52d953f9627e9216be6e7784d463
SSDEEP 3072:R9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:bctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T102847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_icausmkfcx.exe

Path C:\Temp\i_icausmkfcx.exe
Size 384KB
SHA256 4a1d98ff30843b7367e55c975b533f91b034ff1682b69a5e74068515bf1fd82b
MD5 efc94703b779911feb4d2f5586bbac91
SHA1 7827d46dca1213e1c7bac96b052a19746976704c
SHA512 5c052d9302b9fb90cf052effc128864c7e91f710f32e12391a0c0c57015725f84d165eefdd656b68bee73466476fe64dcb6d715d0b110ac221b2d38219c4b1e2
SSDEEP 3072:39ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:NctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T10E847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nlidavsnlf.exe

Path C:\Temp\i_nlidavsnlf.exe
Size 384KB
SHA256 449951b79b737a5b4a520f6ea643bcf31dd33d114ab8918fffb52c3df9d605a5
MD5 3a9de47ed288afa3f5fdffe422538e2e
SHA1 f1378b004b4d6277f562e002753dd12f8dae0d21
SHA512 c861cd7ff1fcbd128dc9170c43dd2f546cf9068b472312725815e0b868fdb719a31b0cf7d4780cfc3f8ad65a0dd232ca33df51f9ed444e8fb8e81a514f0c9e30
SSDEEP 3072:X9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:tctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E8847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_trljdbwtom.exe

Path C:\Temp\i_trljdbwtom.exe
Size 384KB
SHA256 e9f94b9f8294ba166951e9eb41cfda3abc08dbb950c63e8930790ff3198f4795
MD5 7ec2e0053d9b2693b47cdc2597e852af
SHA1 344ae48f6623a7b6fb9854a7ad9411062d40dd55
SHA512 c07950e6db74a2cabaeb0a9b770349c32791270ae1d42f10350b1a99b8fced351b2bb8bba7a7cee38ba73d920a4cfbed419797633571ca4e57d05c1d53f777e8
SSDEEP 3072:A9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:SctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T135847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ysqkicavsn.exe

Path C:\Temp\i_ysqkicavsn.exe
Size 384KB
SHA256 2ae2db5f5f8e12d90d638b1abe59f04c2860cef5c37f2c80c2aa3f8d3528e4a5
MD5 b7984d44bf825e0057fc69d0d0911ca1
SHA1 67a58370f0c3c550911fdbfda41bb452acdca7d0
SHA512 223fbabdb919a6717607ca038e66b4445b53ab29a3c39aaec3292d8bb0baeaf0f009bffa79451c320b08944972d614a548dd21ada814f529fe05970cd77ca366
SSDEEP 3072:x9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:7ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T12D847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icausmkfcx.exe

Path C:\Temp\icausmkfcx.exe
Size 384KB
SHA256 6ccaf961441c156d4e8d6265ce3aeaa4f5da59b41c6d2725e88bfb7b7a034a30
MD5 9c90ffdf9204d5b188f92b7277bde5c1
SHA1 b706b7a8446b445aeb3e183134c3d89360fc8be0
SHA512 4eb4565f4a0aa45e20df828b3796d752058babae0565bf750f2b7d07efd31490637bec62415cff3ef48fc54930342a6937dd91c27f8efc73560dad6bb7b381cc
SSDEEP 3072:E9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:ectFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T14B847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdbvtoljdbwtrljg.exe

Path C:\Temp\jdbvtoljdbwtrljg.exe
Size 384KB
SHA256 8db89410dc6fb430e17f0de3e380c18491ee82ba619e81180dec5b5ae807e7c6
MD5 f1d7f3e3990ab93c472c233611df3f42
SHA1 9ee573d7ec30f93a16f05ee11b44a42849d6f9d5
SHA512 f84e76e8c0a9d289b8a83895e0ad65dadba2a58eb432932b7d831a20ee9e0ec445c18a99ec515ca55890356c3018e82bcb5a68ffdf16fd6649f4c736364b2b2d
SSDEEP 3072:s9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:2ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1FB847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdbvtoljdbwtrljg.sys

Path C:\Temp\jdbvtoljdbwtrljg.sys
Size 293KB
SHA256 af18fe18f8e1590e939c3d0fa592318d9393116197cce75a92f8f8219b2fb13e
MD5 3c1ad2b9e309e3bc90bc2f01f58df854
SHA1 2510269b65db940a8b5f084b8f88f4d3907798db
SHA512 0bbd5f679638ea9f439e6392d14d6d38d298edc9d108e6f1990e45a80eebf2d97ba3f82f4c2aad48ce6d86da3a4ece092d774a6bde5080814cda5b5b7d6c3b98
SSDEEP 3072:ptKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:pIJjiJcbI03GBc3ucY5DCSj
TLSH
T154545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljdbwtnigd.sys

Path C:\Temp\ljdbwtnigd.sys
Size 293KB
SHA256 22944bfd5d2dc6da943174b24c99117e12ce867cbbc7865cab95cda6c2e15c2c
MD5 e86277806dc857c76bda7f10b1c37ed9
SHA1 b63a23a2f88938ff1c28e0a26f420accea61953f
SHA512 01255771bae4cfc63e95a8aaa371596391abd8c74e8566aa9f7443d5ef8552a63b1f1337fe35262e46f376b6b4ca11468dec3c8fe8ea3876ca7e229faccf806a
SSDEEP 3072:ktKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:kIJjiJcbI03GBc3ucY5DCSj
TLSH
T176545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nkfdxvpnhf.sys

Path C:\Temp\nkfdxvpnhf.sys
Size 293KB
SHA256 4c5b774774120b7692d2ebedb991bf6f7deec18ddcfb3a75ca0202882e1f201b
MD5 fcfe4a0eaa88e3afdf8a2f0fa9b22d77
SHA1 d34b7fabfaa790cf72e0d143785c083fb642d6b1
SHA512 8c6aadcd00e82e82542dbd90cf4f231e3b34dd16459302765cb841c27082c32ebe1a9ccffa96e17a71d10455d7cc94c634729bf658e81b9bdffc61f5cc9e36ea
SSDEEP 3072:6tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:6IJjiJcbI03GBc3ucY5DCSj
TLSH
T15B545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlidavsnlf.exe

Path C:\Temp\nlidavsnlf.exe
Size 384KB
SHA256 df7e056574f233caa73d22baba0ab0466614e0ce7b855ea2de2ceac7563b48de
MD5 a9173fd1f1297399e880a54d3b9d241d
SHA1 8b640cff3dedabcb7251214856875b255613904f
SHA512 176b04dc487084f6d51e8313f8402277a2a7b84d2673061cb39dd7759c9d5f2201fb8bf704ae97ed3b6b84a8a100aa8f83c8b04e5a663284a4e14022e9a7d7fd
SSDEEP 3072:U9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:uctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T13E847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trljdbwtom.exe

Path C:\Temp\trljdbwtom.exe
Size 384KB
SHA256 f03c2654925bb8630a9a2155f7f8ee7b6b4b407a93956886297e1f4eec70b326
MD5 3decffb9171ec7bff65419f6a0e56c46
SHA1 b76689bbedf2ebdb2a8a328f701004ee2db51fd9
SHA512 0eff37568227dc04ed5c493ac2c66c2330a9015efbbe827a64b276c4b74bcd365ce57d6c5365a13a9789914c653f65f2310eeaf1d12724ade8263609ea38e0a1
SSDEEP 3072:79ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:pctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T10C847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vpnifaysqk.sys

Path C:\Temp\vpnifaysqk.sys
Size 293KB
SHA256 1b1fbbd62bac340285dd5365c109c2e56a1c5a1262ad86d2af2baf2044c07a54
MD5 64db425bc666b88722bf68c065e6215c
SHA1 d5aac171bd3c4540b1b13093fe06d5a4eef6aa28
SHA512 4c8d642d690da8f3e929d8e17ad277ac49e73f2f0e3bc514559210971031bf7ee08f90bebdeadfcc06cc723d46320bbb88391dbbe8ea8ca0ca5bcb74236772f7
SSDEEP 3072:ztKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:zIJjiJcbI03GBc3ucY5DCSj
TLSH
T1BA545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ysqkicavsn.exe

Path C:\Temp\ysqkicavsn.exe
Size 384KB
SHA256 2bfdc252bcb7f77b811bae24ef30446421a1e841cd1543bd7d12aad4459440c2
MD5 9c82ec1a0c5624247cba4b6a9fe366d3
SHA1 5af050f7b7a2cfa95c4867efd196c2f26a23d1c0
SHA512 585befe85174b0ec9dfc63f6a3202cdb34f0299d798522b9c2531ede6282cee1f25128c3191aa9b1d7b729b3cd040bbb7086b1d3203321b8e11f48eea860de4b
SSDEEP 3072:Y9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:actFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T17F846B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zurpnkeczu.exe

Path C:\Temp\zurpnkeczu.exe
Size 384KB
SHA256 47386347f257ca36787a82b2154969334be4b003591afa16e00b8ae0861091d3
MD5 faa5472037ec35311d2f556eb4f2ee38
SHA1 c87800b128fe07d30d72906ac06f9373d6cd310c
SHA512 e54b7038df256739cf70aa1bb9e302f36f7e6551051173934bea144710440016ff96f2cae9c59aa42b30d6ffe4fb5ef8b01d75a0f946fc230ab4a4f28ac302f1
SSDEEP 3072:v9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:1ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T182847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 22c1d58ffa7df77a7e0440ce3b2c474b1e03f30b60355bbf5dd6392fefb641fd
MD5 b9f45a900b1f64efbf90731f41c6ad44
SHA1 0c28e85e464e328fbbc07373b05113d39f83bdcc
SHA512 132313545c55ea809da0e811d6d5d324ecf5b6cfaefadb3fa4a29df5e6266dfeca7cffa4daf21754b4b37771504d3692189b5660a468784b5eaf80bf92f59ae0
TLSH
T11ED02BA033044C0CCE40203215B9A210720484204849031A8E41F02C8C6FD4387161F7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ee3af991fa1719733ca1e3ac746d5b605f4205e269bf244bd9ae780ceadb9bd8
MD5 a044f6413820c4c3fbd300ee9b379ebc
SHA1 94fc91536a25274f06d3a6e89322dec7fde7912e
SHA512 ced4374c54d7b4ea2b76afe4ca5d8841dfb55d8cb5db96de4ed49e64bd3850a817db5301787c268756641c94c0bf85eb4ee188f04fc891fa2e45ad48284985a5
TLSH
T13AD02BA433044D0CCE40203215B8A210720484209C49031A8D41B01C8C6FD4387171FB
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 eb6860dbc92390b7af9947b7ce4a3fa8dbe7a0bc2628300b46366180b17dcfa2
MD5 6dd5d517764a6db0439f3f6b7c68d95e
SHA1 35e0afeb7234ddfa5515bfff4ca1c124f6f620d2
SHA512 4113002271da420ed9528c95dfe1aa743ea40dd607f1b37bf87e5ea85ce0311665b4ef739249ad74086f02e3da09cc7ad24308c1b4e8e090b5637e19ad405c3e
TLSH
T16F615FF263102DC2FBA6997001F5B4683BF480DA6E071F2583807E364A09F5462F272F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59bb19.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59bb19.TMP
Size 3KB
SHA256 52ac6ada3b01d95239b6361b2013f211e0f31d889a49cfea7a7c23b047764432
MD5 81c5d9597846f329772a6e891ef2fce6
SHA1 ba59f0741355f65705a61e6e8f53bed5e24d91ee
SHA512 6c8eb9bcb86c86cfa0093c4f23764389bf186ea17779bfeea9d6984fc3c96fdb9c5918bdaf8c8eb731def5ea773b281105ec81055888d5401a18835a578d21be
TLSH
T1AA613FF263102DC2FB96997001F5B4683BF484DA6E071F2583806E765A09F5562F272F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 1486eb244dc89d74e57580bec951c6851a6fed0d8136b2ddb063d10a6d206903
MD5 bd927c4cd8e5923e80f73e8e3d6afbbe
SHA1 7aea9f43d68bd07c661d93feae1246c9d2cac30b
SHA512 8cfe789d2556198818f6ea85c0f0cc3fb4f146095463e2ee527571e3b28979053bbbfe8f61b7ae23db193f0f186daf22c40eb6344cf9f16703c96490c3b2dc11
TLSH
T142419EF7C3F8856E8D0196F0AA186E1FCE1D0515432C7D5AC9E4AE2B93E3471E141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 46c2766c4d1f62d6378569bbb001d05b1453e2dea813983f55d8adde1b03e100
MD5 70c642ab6876fc0c6f38de150795000f
SHA1 9fd1422d20781a5bd831857faa22b2b63d4672bd
SHA512 f5be8b9ccc4898fd409e4e33de17ceb8bfbb4efb69fc0283a976c99893a1cfea9a5d86805463fc332def3f51f25e6fb51f8a9f62ef88f4b2939460726cb3e913
SSDEEP 192:sxRzR7Ci/f2sGhBZH2zoD8p98/g6+WNCth/YG6bzkG+GwIgVoJ:sxRz8i/f2sGhPHqG/5O/FGCm
TLSH
T16F42C7166D68A93B4CCBE25DBB557F53D6F91032A1D51E48AAFC8B1C04EB6DD220380F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 59c6c2d1124dacfe5c2ff773ae695b9ef905feea4f63d5a98045e4e5f6aee539
MD5 ac7f810709ebe71d50ae2a71bc9b72ce
SHA1 fff53ff480a4cf849bed7ce6e5f3ebb82e6037fb
SHA512 1fc6dc427356cd418be10489a31ebce55b31c18fc421c9572d52dcfb6d9ed3f991610a88a829cab19ea3dbef12432a3c3204b734ab50f2b9118b04a8810c9f59
SSDEEP 192:sxRMR7Ci/f2s0hBZH2zoD8p98/g6+WNCth/YG6bzkG+GwIgDEoJ:sxRM8i/f2s0hPHqG/5O/FGCJ
TLSH
T19342C7166968A93B4CCBE259BB957F53D6F91032A1D51E48AAFC8B1C04EB6DD220340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 36626ce84e8fcb95dda3895fc64d7defb424b9108bac0f949511f61c9dc8e49c
MD5 998d1eb5adbbd1340281550d2c8bbe8e
SHA1 e1a43b50c1addc7e8178374f68bd2f3b0d53edcd
SHA512 b0ae549dac807b4f862c7740ebeee60de59267c7aa8ebcce9a199a00e459ab063ad8bb3fea321a7677eb1b2e691cee7106e53acaaa4fb24d744bb86bac4f4a09
SSDEEP 192:sxRMR7Ci/f2s0dBZH2zoD8p98/g6+WNCth/YGSeRkG+GwIgDmoJ:sxRM8i/f2s0dPHqG/5O/gZGC/
TLSH
T13842C81A69686D3B4CCBE259BB557F53D3F95032A0D51E48ABFC8B1C04EB6DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 188de3fa92ae5cd00beda69aa80a1bda296b6e0bb3890b67f1f5345e93abecc4
MD5 30671302a94ea9dc540af76e2ec10609
SHA1 9ba208bfaf3290c31f8f71b44877a4795c1ca28f
SHA512 66f7d9b45c1637ba373b0c202f901e67e10d3d1efe189f610d37a1eec894a1cdffe795c7409c3639e103893f52342f62640fe09d8318f11a8d5993713e68b24b
SSDEEP 768:UQYih37pLuL78NWgv7fxJ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVO65pNKUroWB:UQYihxE78NWgv7fxJu1jal65fK/M
TLSH
T19DD2DB7B640CCB7E4F804A9D9C297E9F6DA802CB9698CD9047FE941C02C6BFB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ef1b99a5-258e-4ea4-9c00-447089cfb6d9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\ef1b99a5-258e-4ea4-9c00-447089cfb6d9.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 e00c7ff26289fd69b434d731066b3281d7ec038208931cc10af1b47b49b2a8e8
MD5 02df99c65d6e6724634eaba46ede9883
SHA1 70f9429fef26830d185f5a6b8acddeb404721003
SHA512 bf2ee8eb5dc2c75f64017651cfb3f2f292041d3e25992fc425e29cc100eaad371e80798450dc0c3bf15aa735c097970f4fbd713d0d5cb17209b983b620e9e3d7
SSDEEP 768:xFQv3Iwg+2WkVSPZEh7Hucys6BRvi82oP4/z6himo6LPi9Pn:Av3X2W9EA3imOz6ImoUPI
TLSH
T1A4134AF198D78936DCAE9787A77D2E429AFCD163B4885894B7D54E0CCC825BFC30A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 7db4e1276669b09817dd5975a5abfdb88a8b316b5580545779599be24edced42
MD5 396cd676a69241b78436ac254c80e4ee
SHA1 69b49760a99549e3751314fb3c4ba1fabf603c4e
SHA512 671b1f00c655a6a29473732d53b9a494b9e1fa8afb14d0829f7fe56b9fdadd4ec20409f7eab1569118183aca973c1408058dfb4401d0d1296913a4a9cce24297
SSDEEP 768:Frv+4UNbd03t25VQlYyrZPl7Hucys6BRvi82oP4/z6himo6LPi9P7:FbsbC3t250Ps3imOz6ImoUPw
TLSH
T1EE13C030F4689D63DCE7D2C4B18A3B937FE8217394C91994EAD69B0D16C759E131B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 a1a15ce871004c6c814256850ae73266eba20ae4ecb3380a76fb4ec6b4dafbe8
MD5 8ff352ef70e93a2a3ffb802b66388dde
SHA1 f64e9f3625bf5f8ec48988aa4615dd1926071abf
SHA512 264b175d74a140bc3c49efd133eda2c0b1bb6244293954d375e379318de29b7337b18149c926c5108d9a8d633787f82b50bcbfc725bad83d970b4a4f3ff6e897
SSDEEP 768:xGrv+4UNbdS35IJlYyr77Hucys6BRvi82oP4/z6himo+f2bwn+h:xGbsbw3533imOz6Imos0w+
TLSH
T1D303C031E4549D33DCEBC288B1467A973FF4522345C91AC0E6DE6B0E029BA9E531BC63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 ac8a560ea80ed23a39519e507a29b46a983a909d2f5f8ba6e8d6845897c217f6
MD5 e00f50e5ae01a1fc7b85844a295b405c
SHA1 c68ef82c472914e6846d1437f14c4abfcddd991d
SHA512 5a6b5ffd0834e9616745c6ce19afacfcd5af32a59b49c2f3a1fd183c479d6a78b05c8ab047e29a22e92801c696f5d3cd0a95ea9be2e84f76b19649d660b944ff
SSDEEP 768:mb3Z2WVQlYyrZPl7Hucys6BRvi82oP4/z6himo6LPi9Pn:mb3Z2W0Ps3imOz6ImoUPI
TLSH
T19DF2C030A8659D63DCEBD3C5B58A3B937EE4223394C85D94EAEADB0D15C365D031B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 d2df53c67c0b61d7beea4e1ff9c7fbf2dfc3e49f75d503543152b141031ab68b
MD5 92a5ff03b2bcaf90dd7493757b8682f1
SHA1 9312ab6fb46b373e9f18b9634d722af0b020bb27
SHA512 26a441ed2639a6eafa5af52994f2c2b0698b9c02a44bcf4a21b86304789e5d324fb55a110bd5ca2f238bab2f63d8733a843607ebe26ef9608c429794b90a44f5
SSDEEP 768:7b3I2WVQlYyrZPl7Hucys6BRvi82oP4/z6himo6LPi9Pn:7b3I2W0Ps3imOz6ImoUPI
TLSH
T1E5F2C030A8659D63DCEBD3C5B58A3B837EE4223394C85D94EADADB0D15C365E031B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 a5c01e317cc6acfd3ad1b90529603d2b343802990fa3a715c8be43b8f723bf3c
MD5 b6e4a1f42ce9d53133c0d911f9853f14
SHA1 60b7c9077de7aedf2614fac50f222292ece5c33a
SHA512 e8ce294f1e2015b1783e8ef911564acc7d5375ca9bb2f7f1a9175beff7c320bf039d6b3ff8e3003a0c3cecd4adf52a34db862e8eac31f21810842dd4f1266c05
SSDEEP 768:trv+4UNbdS3f/KlYyrZ37Hucys6BRvi82oP4/z6himofL2bwn+h:tbsbw3fkW3imOz6ImoD0w+
TLSH
T1AC03BF31E4199D33DDEBD284B4467B937FF4527348C95A90EADA5B0E0187A5E231F823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

8f34d4cb-5db1-4a7f-b0d7-ab7802651514.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\8f34d4cb-5db1-4a7f-b0d7-ab7802651514.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3140_1409689536\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 3b5e8b8d949e2973412e050ac87419c224f980784e76213db93ca0c551e70d08
MD5 7e28e6a25ed40b80e3caae8c1bad49aa
SHA1 b4d77b778aebaedbcae25b577517269c52ec4b44
SHA512 6a6f93ddac237bc3db9e86d24e01f156c57748caee21be009bc7b0a43ca716804fd3434c04af618d8d0ef0596b916bb2497d785b6f89acbb0406c4fd51655862
TLSH
T18971238357A8D5B2C1DE9BF503835644F5FF2238473330600BA1598AEB30A7A68B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1212-360-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1776-312-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2040-466-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2056-285-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2136-381-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2280-183-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2568-425-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2972-405-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3024-362-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3300-462-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3400-401-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3496-260-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3952-436-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4128-316-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4272-232-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4432-317-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4800-64-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4824-483-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5464-440-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5672-272-0x0000000000010000-0x00000000000AB000-memory.dmp

Download