systex | 8ccf46c55fd1c9d6cb3d1e6a5495ac202e0ef14241fb810ad0e4bd9a6271911e

Analysis

max time kernel
149s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/08/2026, 15:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_768ea7b2c618c7917f42d8b4faad87f6_amadey_darkgate_elex_smoke-loader_stop.exe
Size 384KB
Sample260820-sn27bsem91
SHA256 8ccf46c55fd1c9d6cb3d1e6a5495ac202e0ef14241fb810ad0e4bd9a6271911e
MD5 768ea7b2c618c7917f42d8b4faad87f6
SHA1 3be261e3770929ca104b6eead9d8fab6e1ee1e0e
SHA512 4292bfaaac4c5f0679f96e41a454dd106415e07f724a10d87bf9507ee572a97cbac48b8f0ff2c41a5af6abc1514a05514e5fac55ad423447489080c65f8cc4ef
SSDEEP 3072:e9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:8ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C9847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
4884	icausmkecxvpnhfc.exe
1892	icausmkecxvpnhfc.sys
2088	CreateProcess.exe
5864	kicauspkhc.exe
2888	CreateProcess.exe
3368	CreateProcess.exe
3360	i_kicauspkhc.exe
6120	rmkecwupmk.sys
3332	CreateProcess.exe
1216	mjhcxupmhe.exe
2628	CreateProcess.exe
6008	CreateProcess.exe
1172	i_mjhcxupmhe.exe
3680	bwtrmjeczu.sys
2856	CreateProcess.exe
4236	cwuomgecwu.exe
4516	CreateProcess.exe
2528	CreateProcess.exe
3904	i_cwuomgecwu.exe
4256	wuomgeywro.sys
4440	CreateProcess.exe
4400	olgeywqomj.exe
756	CreateProcess.exe
4564	CreateProcess.exe
3720	i_olgeywqomj.exe
1848	eywtolgeyw.sys
3336	CreateProcess.exe
4968	gbywtolgey.exe
856	CreateProcess.exe
5400	CreateProcess.exe
1396	i_gbywtolgey.exe
5800	bvtqolgdyw.sys
5112	CreateProcess.exe
4324	vtqoigayqo.exe
2644	CreateProcess.exe
3308	CreateProcess.exe
5352	i_vtqoigayqo.exe
3268	sqoiysqoig.sys
4752	CreateProcess.exe
4592	lfdyvqnlfd.exe
5544	CreateProcess.exe
2344	CreateProcess.exe
5840	i_lfdyvqnlfd.exe
3356	sqkicaxvpn.sys
1176	CreateProcess.exe
2424	vtnkicaxnh.exe
1888	CreateProcess.exe
1316	CreateProcess.exe
5808	i_vtnkicaxnh.exe
2908	pnhfcxvpnh.sys
4320	CreateProcess.exe
3436	snkfaxvpki.exe
3264	CreateProcess.exe
4204	CreateProcess.exe
4704	i_snkfaxvpki.exe
5680	hfcxupmhec.sys
3312	CreateProcess.exe
4388	hecxupnhfz.exe
2288	CreateProcess.exe
4176	CreateProcess.exe
3356	i_hecxupnhfz.exe
5596	kecxupmkeu.sys
4172	CreateProcess.exe
2688	bzurpmhezx.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_347945821\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_347945821\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_314874243\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_2120962218\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_1457508057\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_314874243\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_2120962218\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_2120962218\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4272_2120962218\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtqoigayqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnkicaxnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjhcxupmhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwuomgecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lfdyvqnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzurpmhezx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebztrpjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnlfdaysqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkfcxvsqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbywtolgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snkfaxvpki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snkfaxvpki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwuomgecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbywtolgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnkicaxnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbywrojgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbywrojgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkfcxvsqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icausmkecxvpnhfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicauspkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kicauspkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lfdyvqnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bzurpmhezx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebztrpjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtqljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhfcxusmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_olgeywqomj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dyvqoifdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dyvqoifdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhfcxusmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_768ea7b2c618c7917f42d8b4faad87f6_amadey_darkgate_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjhcxupmhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	olgeywqomj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtqoigayqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hecxupnhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnlfdaysqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkecwupmhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkecwupmhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hecxupnhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvtqljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmjhezxupm.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2836	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1892	ipconfig.exe
2984	ipconfig.exe
2384	ipconfig.exe
5376	ipconfig.exe
1136	ipconfig.exe
1232	ipconfig.exe
4208	ipconfig.exe
6112	ipconfig.exe
4296	ipconfig.exe
2156	ipconfig.exe
3324	ipconfig.exe
4204	ipconfig.exe
4612	ipconfig.exe
2456	ipconfig.exe
3304	ipconfig.exe
4628	ipconfig.exe
5836	ipconfig.exe
2992	ipconfig.exe
3532	ipconfig.exe
4692	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134317126388771332"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{945D52A2-F46F-4EFC-A1E1-1F564A0D4C33}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3956	2026-08-20_768ea7b2c618c7917f42d8b4faad87f6_amadey_darkgate_elex_smoke-loader_stop.exe
3956	2026-08-20_768ea7b2c618c7917f42d8b4faad87f6_amadey_darkgate_elex_smoke-loader_stop.exe
3956	2026-08-20_768ea7b2c618c7917f42d8b4faad87f6_amadey_darkgate_elex_smoke-loader_stop.exe
3956	2026-08-20_768ea7b2c618c7917f42d8b4faad87f6_amadey_darkgate_elex_smoke-loader_stop.exe
3956	2026-08-20_768ea7b2c618c7917f42d8b4faad87f6_amadey_darkgate_elex_smoke-loader_stop.exe
3956	2026-08-20_768ea7b2c618c7917f42d8b4faad87f6_amadey_darkgate_elex_smoke-loader_stop.exe
3956	2026-08-20_768ea7b2c618c7917f42d8b4faad87f6_amadey_darkgate_elex_smoke-loader_stop.exe
3956	2026-08-20_768ea7b2c618c7917f42d8b4faad87f6_amadey_darkgate_elex_smoke-loader_stop.exe
3956	2026-08-20_768ea7b2c618c7917f42d8b4faad87f6_amadey_darkgate_elex_smoke-loader_stop.exe
3956	2026-08-20_768ea7b2c618c7917f42d8b4faad87f6_amadey_darkgate_elex_smoke-loader_stop.exe
3956	2026-08-20_768ea7b2c618c7917f42d8b4faad87f6_amadey_darkgate_elex_smoke-loader_stop.exe
3956	2026-08-20_768ea7b2c618c7917f42d8b4faad87f6_amadey_darkgate_elex_smoke-loader_stop.exe
3956	2026-08-20_768ea7b2c618c7917f42d8b4faad87f6_amadey_darkgate_elex_smoke-loader_stop.exe
3956	2026-08-20_768ea7b2c618c7917f42d8b4faad87f6_amadey_darkgate_elex_smoke-loader_stop.exe
3956	2026-08-20_768ea7b2c618c7917f42d8b4faad87f6_amadey_darkgate_elex_smoke-loader_stop.exe
3956	2026-08-20_768ea7b2c618c7917f42d8b4faad87f6_amadey_darkgate_elex_smoke-loader_stop.exe
3956	2026-08-20_768ea7b2c618c7917f42d8b4faad87f6_amadey_darkgate_elex_smoke-loader_stop.exe
3956	2026-08-20_768ea7b2c618c7917f42d8b4faad87f6_amadey_darkgate_elex_smoke-loader_stop.exe
3956	2026-08-20_768ea7b2c618c7917f42d8b4faad87f6_amadey_darkgate_elex_smoke-loader_stop.exe
3956	2026-08-20_768ea7b2c618c7917f42d8b4faad87f6_amadey_darkgate_elex_smoke-loader_stop.exe
3956	2026-08-20_768ea7b2c618c7917f42d8b4faad87f6_amadey_darkgate_elex_smoke-loader_stop.exe
3956	2026-08-20_768ea7b2c618c7917f42d8b4faad87f6_amadey_darkgate_elex_smoke-loader_stop.exe
3956	2026-08-20_768ea7b2c618c7917f42d8b4faad87f6_amadey_darkgate_elex_smoke-loader_stop.exe
3956	2026-08-20_768ea7b2c618c7917f42d8b4faad87f6_amadey_darkgate_elex_smoke-loader_stop.exe
3956	2026-08-20_768ea7b2c618c7917f42d8b4faad87f6_amadey_darkgate_elex_smoke-loader_stop.exe
3956	2026-08-20_768ea7b2c618c7917f42d8b4faad87f6_amadey_darkgate_elex_smoke-loader_stop.exe
3956	2026-08-20_768ea7b2c618c7917f42d8b4faad87f6_amadey_darkgate_elex_smoke-loader_stop.exe
3956	2026-08-20_768ea7b2c618c7917f42d8b4faad87f6_amadey_darkgate_elex_smoke-loader_stop.exe
3956	2026-08-20_768ea7b2c618c7917f42d8b4faad87f6_amadey_darkgate_elex_smoke-loader_stop.exe
3956	2026-08-20_768ea7b2c618c7917f42d8b4faad87f6_amadey_darkgate_elex_smoke-loader_stop.exe
3956	2026-08-20_768ea7b2c618c7917f42d8b4faad87f6_amadey_darkgate_elex_smoke-loader_stop.exe
3956	2026-08-20_768ea7b2c618c7917f42d8b4faad87f6_amadey_darkgate_elex_smoke-loader_stop.exe
3956	2026-08-20_768ea7b2c618c7917f42d8b4faad87f6_amadey_darkgate_elex_smoke-loader_stop.exe
3956	2026-08-20_768ea7b2c618c7917f42d8b4faad87f6_amadey_darkgate_elex_smoke-loader_stop.exe
3956	2026-08-20_768ea7b2c618c7917f42d8b4faad87f6_amadey_darkgate_elex_smoke-loader_stop.exe
3956	2026-08-20_768ea7b2c618c7917f42d8b4faad87f6_amadey_darkgate_elex_smoke-loader_stop.exe
3956	2026-08-20_768ea7b2c618c7917f42d8b4faad87f6_amadey_darkgate_elex_smoke-loader_stop.exe
3956	2026-08-20_768ea7b2c618c7917f42d8b4faad87f6_amadey_darkgate_elex_smoke-loader_stop.exe
3956	2026-08-20_768ea7b2c618c7917f42d8b4faad87f6_amadey_darkgate_elex_smoke-loader_stop.exe
3956	2026-08-20_768ea7b2c618c7917f42d8b4faad87f6_amadey_darkgate_elex_smoke-loader_stop.exe
3956	2026-08-20_768ea7b2c618c7917f42d8b4faad87f6_amadey_darkgate_elex_smoke-loader_stop.exe
3956	2026-08-20_768ea7b2c618c7917f42d8b4faad87f6_amadey_darkgate_elex_smoke-loader_stop.exe
3956	2026-08-20_768ea7b2c618c7917f42d8b4faad87f6_amadey_darkgate_elex_smoke-loader_stop.exe
3956	2026-08-20_768ea7b2c618c7917f42d8b4faad87f6_amadey_darkgate_elex_smoke-loader_stop.exe
3956	2026-08-20_768ea7b2c618c7917f42d8b4faad87f6_amadey_darkgate_elex_smoke-loader_stop.exe
3956	2026-08-20_768ea7b2c618c7917f42d8b4faad87f6_amadey_darkgate_elex_smoke-loader_stop.exe
3956	2026-08-20_768ea7b2c618c7917f42d8b4faad87f6_amadey_darkgate_elex_smoke-loader_stop.exe
3956	2026-08-20_768ea7b2c618c7917f42d8b4faad87f6_amadey_darkgate_elex_smoke-loader_stop.exe
3956	2026-08-20_768ea7b2c618c7917f42d8b4faad87f6_amadey_darkgate_elex_smoke-loader_stop.exe
3956	2026-08-20_768ea7b2c618c7917f42d8b4faad87f6_amadey_darkgate_elex_smoke-loader_stop.exe
3956	2026-08-20_768ea7b2c618c7917f42d8b4faad87f6_amadey_darkgate_elex_smoke-loader_stop.exe
3956	2026-08-20_768ea7b2c618c7917f42d8b4faad87f6_amadey_darkgate_elex_smoke-loader_stop.exe
3956	2026-08-20_768ea7b2c618c7917f42d8b4faad87f6_amadey_darkgate_elex_smoke-loader_stop.exe
3956	2026-08-20_768ea7b2c618c7917f42d8b4faad87f6_amadey_darkgate_elex_smoke-loader_stop.exe
3956	2026-08-20_768ea7b2c618c7917f42d8b4faad87f6_amadey_darkgate_elex_smoke-loader_stop.exe
3956	2026-08-20_768ea7b2c618c7917f42d8b4faad87f6_amadey_darkgate_elex_smoke-loader_stop.exe
4884	icausmkecxvpnhfc.exe
4884	icausmkecxvpnhfc.exe
4884	icausmkecxvpnhfc.exe
4884	icausmkecxvpnhfc.exe
4884	icausmkecxvpnhfc.exe
4884	icausmkecxvpnhfc.exe
4884	icausmkecxvpnhfc.exe
4884	icausmkecxvpnhfc.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe
4272	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	3360	i_kicauspkhc.exe
Token: SeDebugPrivilege	1172	i_mjhcxupmhe.exe
Token: SeDebugPrivilege	3904	i_cwuomgecwu.exe
Token: SeDebugPrivilege	3720	i_olgeywqomj.exe
Token: SeDebugPrivilege	1396	i_gbywtolgey.exe
Token: SeDebugPrivilege	5352	i_vtqoigayqo.exe
Token: SeDebugPrivilege	5840	i_lfdyvqnlfd.exe
Token: SeDebugPrivilege	5808	i_vtnkicaxnh.exe
Token: SeDebugPrivilege	4704	i_snkfaxvpki.exe
Token: SeDebugPrivilege	3356	i_hecxupnhfz.exe
Token: SeDebugPrivilege	3544	i_bzurpmhezx.exe
Token: SeDebugPrivilege	1320	i_ebztrpjhbz.exe
Token: SeDebugPrivilege	6120	i_gbywrojgey.exe
Token: SeDebugPrivilege	5328	i_bvtqljdbvt.exe
Token: SeDebugPrivilege	4300	i_dyvqoifdyv.exe
Token: SeDebugPrivilege	4616	i_qnlfdaysqk.exe
Token: SeDebugPrivilege	1320	i_sqkfcxvsqk.exe
Token: SeDebugPrivilege	1800	i_pnhfcxusmk.exe
Token: SeDebugPrivilege	3180	i_mkecwupmhe.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4272	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3956 wrote to memory of 4884	3956	2026-08-20_768ea7b2c618c7917f42d8b4faad87f6_amadey_darkgate_elex_smoke-loader_stop.exe	89
PID 3956 wrote to memory of 4224	3956	2026-08-20_768ea7b2c618c7917f42d8b4faad87f6_amadey_darkgate_elex_smoke-loader_stop.exe	90
PID 4224 wrote to memory of 4272	4224	iexplore.exe	91
PID 4272 wrote to memory of 1160	4272	msedge.exe	92
PID 4272 wrote to memory of 5244	4272	msedge.exe	93
PID 4272 wrote to memory of 2836	4272	msedge.exe	95
PID 4272 wrote to memory of 5244	4272	msedge.exe	93
PID 4272 wrote to memory of 5244	4272	msedge.exe	93
PID 4272 wrote to memory of 4972	4272	msedge.exe	96
PID 4272 wrote to memory of 4972	4272	msedge.exe	96
PID 4272 wrote to memory of 5548	4272	msedge.exe	97
PID 4272 wrote to memory of 1600	4272	msedge.exe	98
PID 4272 wrote to memory of 5548	4272	msedge.exe	97
PID 4272 wrote to memory of 5548	4272	msedge.exe	97
PID 4272 wrote to memory of 1600	4272	msedge.exe	98
PID 4272 wrote to memory of 1600	4272	msedge.exe	98
PID 4272 wrote to memory of 5820	4272	msedge.exe	99
PID 4272 wrote to memory of 5256	4272	msedge.exe	100
PID 4272 wrote to memory of 5820	4272	msedge.exe	99
PID 4272 wrote to memory of 5820	4272	msedge.exe	99
PID 4272 wrote to memory of 5256	4272	msedge.exe	100
PID 4272 wrote to memory of 5256	4272	msedge.exe	100
PID 4272 wrote to memory of 2672	4272	msedge.exe	101
PID 4272 wrote to memory of 2672	4272	msedge.exe	101
PID 4272 wrote to memory of 5164	4272	msedge.exe	105
PID 4272 wrote to memory of 5164	4272	msedge.exe	105
PID 4272 wrote to memory of 5072	4272	msedge.exe	106
PID 4272 wrote to memory of 5072	4272	msedge.exe	106
PID 4884 wrote to memory of 2088	4884	icausmkecxvpnhfc.exe	107
PID 5864 wrote to memory of 2888	5864	kicauspkhc.exe	110
PID 4272 wrote to memory of 4460	4272	msedge.exe	114
PID 4272 wrote to memory of 3904	4272	msedge.exe	115
PID 4272 wrote to memory of 3904	4272	msedge.exe	115
PID 4272 wrote to memory of 6016	4272	msedge.exe	116
PID 4272 wrote to memory of 6016	4272	msedge.exe	116
PID 4884 wrote to memory of 3368	4884	icausmkecxvpnhfc.exe	119
PID 4884 wrote to memory of 3332	4884	icausmkecxvpnhfc.exe	123
PID 1216 wrote to memory of 2628	1216	mjhcxupmhe.exe	125
PID 4884 wrote to memory of 6008	4884	icausmkecxvpnhfc.exe	128
PID 4884 wrote to memory of 2856	4884	icausmkecxvpnhfc.exe	132
PID 4236 wrote to memory of 4516	4236	cwuomgecwu.exe	134
PID 4884 wrote to memory of 2528	4884	icausmkecxvpnhfc.exe	137
PID 4884 wrote to memory of 4440	4884	icausmkecxvpnhfc.exe	141
PID 4400 wrote to memory of 756	4400	olgeywqomj.exe	144
PID 4884 wrote to memory of 4564	4884	icausmkecxvpnhfc.exe	147
PID 4272 wrote to memory of 1404	4272	msedge.exe	149
PID 4272 wrote to memory of 2424	4272	msedge.exe	150
PID 4272 wrote to memory of 2420	4272	msedge.exe	151
PID 4884 wrote to memory of 3336	4884	icausmkecxvpnhfc.exe	154
PID 4968 wrote to memory of 856	4968	gbywtolgey.exe	156
PID 4884 wrote to memory of 5400	4884	icausmkecxvpnhfc.exe	159
PID 4884 wrote to memory of 5112	4884	icausmkecxvpnhfc.exe	163
PID 4324 wrote to memory of 2644	4324	vtqoigayqo.exe	165
PID 4884 wrote to memory of 3308	4884	icausmkecxvpnhfc.exe	168
PID 4884 wrote to memory of 4752	4884	icausmkecxvpnhfc.exe	172
PID 4592 wrote to memory of 5544	4592	lfdyvqnlfd.exe	174
PID 4884 wrote to memory of 2344	4884	icausmkecxvpnhfc.exe	177
PID 4884 wrote to memory of 1176	4884	icausmkecxvpnhfc.exe	181
PID 2424 wrote to memory of 1888	2424	vtnkicaxnh.exe	183
PID 4884 wrote to memory of 1316	4884	icausmkecxvpnhfc.exe	186
PID 4272 wrote to memory of 5900	4272	msedge.exe	188
PID 4272 wrote to memory of 5900	4272	msedge.exe	188
PID 4884 wrote to memory of 4320	4884	icausmkecxvpnhfc.exe	194
PID 3436 wrote to memory of 3264	3436	snkfaxvpki.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-08-20_768ea7b2c618c7917f42d8b4faad87f6_amadey_darkgate_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_768ea7b2c618c7917f42d8b4faad87f6_amadey_darkgate_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3956
- C:\Temp\icausmkecxvpnhfc.exe
  C:\Temp\icausmkecxvpnhfc.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4884
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kicauspkhc.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2088
  - - C:\Temp\kicauspkhc.exe
      C:\Temp\kicauspkhc.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5864
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2888
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2992
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kicauspkhc.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3368
  - - C:\Temp\i_kicauspkhc.exe
      C:\Temp\i_kicauspkhc.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3360
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mjhcxupmhe.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3332
  - - C:\Temp\mjhcxupmhe.exe
      C:\Temp\mjhcxupmhe.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1216
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2628
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3324
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mjhcxupmhe.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6008
  - - C:\Temp\i_mjhcxupmhe.exe
      C:\Temp\i_mjhcxupmhe.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1172
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cwuomgecwu.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2856
  - - C:\Temp\cwuomgecwu.exe
      C:\Temp\cwuomgecwu.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4236
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4516
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4204
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cwuomgecwu.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2528
  - - C:\Temp\i_cwuomgecwu.exe
      C:\Temp\i_cwuomgecwu.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3904
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\olgeywqomj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4440
  - - C:\Temp\olgeywqomj.exe
      C:\Temp\olgeywqomj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4400
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:756
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1136
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_olgeywqomj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4564
  - - C:\Temp\i_olgeywqomj.exe
      C:\Temp\i_olgeywqomj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3720
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gbywtolgey.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3336
  - - C:\Temp\gbywtolgey.exe
      C:\Temp\gbywtolgey.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4968
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:856
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1892
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gbywtolgey.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5400
  - - C:\Temp\i_gbywtolgey.exe
      C:\Temp\i_gbywtolgey.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1396
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtqoigayqo.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5112
  - - C:\Temp\vtqoigayqo.exe
      C:\Temp\vtqoigayqo.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4324
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2644
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2984
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtqoigayqo.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3308
  - - C:\Temp\i_vtqoigayqo.exe
      C:\Temp\i_vtqoigayqo.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5352
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lfdyvqnlfd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4752
  - - C:\Temp\lfdyvqnlfd.exe
      C:\Temp\lfdyvqnlfd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4592
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5544
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4612
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lfdyvqnlfd.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2344
  - - C:\Temp\i_lfdyvqnlfd.exe
      C:\Temp\i_lfdyvqnlfd.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5840
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtnkicaxnh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1176
  - - C:\Temp\vtnkicaxnh.exe
      C:\Temp\vtnkicaxnh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2424
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1888
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3532
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtnkicaxnh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1316
  - - C:\Temp\i_vtnkicaxnh.exe
      C:\Temp\i_vtnkicaxnh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5808
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\snkfaxvpki.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4320
  - - C:\Temp\snkfaxvpki.exe
      C:\Temp\snkfaxvpki.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3436
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3264
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2456
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_snkfaxvpki.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4204
  - - C:\Temp\i_snkfaxvpki.exe
      C:\Temp\i_snkfaxvpki.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4704
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hecxupnhfz.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3312
  - - C:\Temp\hecxupnhfz.exe
      C:\Temp\hecxupnhfz.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4388
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2288
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3304
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hecxupnhfz.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4176
  - - C:\Temp\i_hecxupnhfz.exe
      C:\Temp\i_hecxupnhfz.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3356
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bzurpmhezx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4172
  - - C:\Temp\bzurpmhezx.exe
      C:\Temp\bzurpmhezx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2688
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5020
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2384
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bzurpmhezx.exe ups_ins
    3⤵
    PID:1688
  - - C:\Temp\i_bzurpmhezx.exe
      C:\Temp\i_bzurpmhezx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3544
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ebztrpjhbz.exe ups_run
    3⤵
    PID:2920
  - - C:\Temp\ebztrpjhbz.exe
      C:\Temp\ebztrpjhbz.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3760
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1920
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4628
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ebztrpjhbz.exe ups_ins
    3⤵
    PID:3468
  - - C:\Temp\i_ebztrpjhbz.exe
      C:\Temp\i_ebztrpjhbz.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1320
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gbywrojgey.exe ups_run
    3⤵
    PID:968
  - - C:\Temp\gbywrojgey.exe
      C:\Temp\gbywrojgey.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4484
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3540
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1232
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gbywrojgey.exe ups_ins
    3⤵
    PID:4560
  - - C:\Temp\i_gbywrojgey.exe
      C:\Temp\i_gbywrojgey.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6120
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bvtqljdbvt.exe ups_run
    3⤵
    PID:1704
  - - C:\Temp\bvtqljdbvt.exe
      C:\Temp\bvtqljdbvt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2052
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4104
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5836
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bvtqljdbvt.exe ups_ins
    3⤵
    PID:2468
  - - C:\Temp\i_bvtqljdbvt.exe
      C:\Temp\i_bvtqljdbvt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5328
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dyvqoifdyv.exe ups_run
    3⤵
    PID:4072
  - - C:\Temp\dyvqoifdyv.exe
      C:\Temp\dyvqoifdyv.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2432
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5952
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4208
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dyvqoifdyv.exe ups_ins
    3⤵
    PID:3736
  - - C:\Temp\i_dyvqoifdyv.exe
      C:\Temp\i_dyvqoifdyv.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4300
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qnlfdaysqk.exe ups_run
    3⤵
    PID:5036
  - - C:\Temp\qnlfdaysqk.exe
      C:\Temp\qnlfdaysqk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5404
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1404
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6112
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qnlfdaysqk.exe ups_ins
    3⤵
    PID:5424
  - - C:\Temp\i_qnlfdaysqk.exe
      C:\Temp\i_qnlfdaysqk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4616
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqkfcxvsqk.exe ups_run
    3⤵
    PID:4156
  - - C:\Temp\sqkfcxvsqk.exe
      C:\Temp\sqkfcxvsqk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4996
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5344
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4296
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqkfcxvsqk.exe ups_ins
    3⤵
    PID:5352
  - - C:\Temp\i_sqkfcxvsqk.exe
      C:\Temp\i_sqkfcxvsqk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1320
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pnhfcxusmk.exe ups_run
    3⤵
    PID:3256
  - - C:\Temp\pnhfcxusmk.exe
      C:\Temp\pnhfcxusmk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1236
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3732
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2156
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pnhfcxusmk.exe ups_ins
    3⤵
    PID:2788
  - - C:\Temp\i_pnhfcxusmk.exe
      C:\Temp\i_pnhfcxusmk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1800
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mkecwupmhe.exe ups_run
    3⤵
    PID:2884
  - - C:\Temp\mkecwupmhe.exe
      C:\Temp\mkecwupmhe.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2732
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4504
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4692
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mkecwupmhe.exe ups_ins
    3⤵
    PID:5808
  - - C:\Temp\i_mkecwupmhe.exe
      C:\Temp\i_mkecwupmhe.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3180
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rmjhezxupm.exe ups_run
    3⤵
    PID:3640
  - - C:\Temp\rmjhezxupm.exe
      C:\Temp\rmjhezxupm.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4864
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2380
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5376
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffeb824c188,0x7ffeb824c194,0x7ffeb824c1a0
      4⤵
      PID:1160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1708,i,7652774028344993683,15947616124377607982,262144 --field-trial-handle=2596,i,14998312392538168926,16147934493174354576,262144 --variations-seed-version --mojo-platform-channel-handle=2592 /prefetch:2
      4⤵
      PID:5244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,224905042373389017,13140024450257958409,524288 --field-trial-handle=2596,i,14998312392538168926,16147934493174354576,262144 --variations-seed-version --mojo-platform-channel-handle=2688 /prefetch:11
      4⤵
      System Time Discovery
      PID:2836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2288,i,11999764744985977464,5910288158297700121,524288 --field-trial-handle=2596,i,14998312392538168926,16147934493174354576,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:13
      4⤵
      PID:4972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3580,i,10594473395790346491,16672966682999105697,2097152 --field-trial-handle=2596,i,14998312392538168926,16147934493174354576,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
      4⤵
      PID:5548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3588,i,9256348061898967579,13444269202187298467,2097152 --field-trial-handle=2596,i,14998312392538168926,16147934493174354576,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
      4⤵
      PID:1600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4308,i,9807792394513341008,10035179539166765803,2097152 --field-trial-handle=2596,i,14998312392538168926,16147934493174354576,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:1
      4⤵
      PID:5820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4320,i,322896958403232982,8653425736530032654,2097152 --field-trial-handle=2596,i,14998312392538168926,16147934493174354576,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:9
      4⤵
      PID:5256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,3934690358821515766,16470052412680115505,524288 --field-trial-handle=2596,i,14998312392538168926,16147934493174354576,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:14
      4⤵
      PID:2672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,5314138109698150148,9992282869665609377,524288 --field-trial-handle=2596,i,14998312392538168926,16147934493174354576,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:14
      4⤵
      PID:5164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5508,i,1379259205396436164,3701438010498638750,524288 --field-trial-handle=2596,i,14998312392538168926,16147934493174354576,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
      4⤵
      PID:5072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,11668460058097727796,14668869602733608741,524288 --field-trial-handle=2596,i,14998312392538168926,16147934493174354576,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
      4⤵
      PID:3044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,11668460058097727796,14668869602733608741,524288 --field-trial-handle=2596,i,14998312392538168926,16147934493174354576,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
      4⤵
      PID:4460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,14336395945630169004,16571095359764674053,524288 --field-trial-handle=2596,i,14998312392538168926,16147934493174354576,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:14
      4⤵
      PID:3904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6612,i,16066904041233374131,14484044628617387986,524288 --field-trial-handle=2596,i,14998312392538168926,16147934493174354576,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:14
      4⤵
      PID:6016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,6046071802210238460,5841316412761851486,524288 --field-trial-handle=2596,i,14998312392538168926,16147934493174354576,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:14
      4⤵
      PID:1404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,15754520762843514601,813922952338855921,524288 --field-trial-handle=2596,i,14998312392538168926,16147934493174354576,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:14
      4⤵
      PID:2424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,5130268433805765390,16657226605529686859,524288 --field-trial-handle=2596,i,14998312392538168926,16147934493174354576,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:14
      4⤵
      PID:2420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3776,i,10490551868555322937,13167710942839246745,524288 --field-trial-handle=2596,i,14998312392538168926,16147934493174354576,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:14
      4⤵
      PID:5900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,10993636852563853855,14711917419638033771,524288 --field-trial-handle=2596,i,14998312392538168926,16147934493174354576,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:14
      4⤵
      PID:5416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=920,i,15048403306476400544,15946840086830727467,524288 --field-trial-handle=2596,i,14998312392538168926,16147934493174354576,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:14
      4⤵
      PID:3444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=920,i,14917711844623556038,4556223217772704632,524288 --field-trial-handle=2596,i,14998312392538168926,16147934493174354576,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:14
      4⤵
      PID:4612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6920,i,10295387093912112535,5389162501322104257,262144 --field-trial-handle=2596,i,14998312392538168926,16147934493174354576,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:10
      4⤵
      PID:4652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,13503444228264727652,4363319593514668255,524288 --field-trial-handle=2596,i,14998312392538168926,16147934493174354576,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:14
      4⤵
      PID:5436

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4072

C:\Temp\icausmkecxvpnhfc.sys
C:\Temp\icausmkecxvpnhfc.sys
1⤵
- Executes dropped EXE
PID:1892

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4252

C:\Temp\rmkecwupmk.sys
C:\Temp\rmkecwupmk.sys
1⤵
- Executes dropped EXE
PID:6120

C:\Temp\bwtrmjeczu.sys
C:\Temp\bwtrmjeczu.sys
1⤵
- Executes dropped EXE
PID:3680

C:\Temp\wuomgeywro.sys
C:\Temp\wuomgeywro.sys
1⤵
- Executes dropped EXE
PID:4256

C:\Temp\eywtolgeyw.sys
C:\Temp\eywtolgeyw.sys
1⤵
- Executes dropped EXE
PID:1848

C:\Temp\bvtqolgdyw.sys
C:\Temp\bvtqolgdyw.sys
1⤵
- Executes dropped EXE
PID:5800

C:\Temp\sqoiysqoig.sys
C:\Temp\sqoiysqoig.sys
1⤵
- Executes dropped EXE
PID:3268

C:\Temp\sqkicaxvpn.sys
C:\Temp\sqkicaxvpn.sys
1⤵
- Executes dropped EXE
PID:3356

C:\Temp\pnhfcxvpnh.sys
C:\Temp\pnhfcxvpnh.sys
1⤵
- Executes dropped EXE
PID:2908

C:\Temp\hfcxupmhec.sys
C:\Temp\hfcxupmhec.sys
1⤵
- Executes dropped EXE
PID:5680

C:\Temp\kecxupmkeu.sys
C:\Temp\kecxupmkeu.sys
1⤵
- Executes dropped EXE
PID:5596

C:\Temp\ebwuomjhez.sys
C:\Temp\ebwuomjhez.sys
1⤵
PID:5140

C:\Temp\bzwromheyw.sys
C:\Temp\bzwromheyw.sys
1⤵
PID:4504

C:\Temp\bytqolgdyw.sys
C:\Temp\bytqolgdyw.sys
1⤵
PID:5816

C:\Temp\igaytqoiga.sys
C:\Temp\igaytqoiga.sys
1⤵
PID:4628

C:\Temp\bvtnlfdxvq.sys
C:\Temp\bvtnlfdxvq.sys
1⤵
PID:4384

C:\Temp\usnkfdxvpn.sys
C:\Temp\usnkfdxvpn.sys
1⤵
PID:1752

C:\Temp\spkhcaxvpn.sys
C:\Temp\spkhcaxvpn.sys
1⤵
PID:1464

C:\Temp\uspkhfcxrp.sys
C:\Temp\uspkhfcxrp.sys
1⤵
PID:5356

C:\Temp\urmjecwuom.sys
C:\Temp\urmjecwuom.sys
1⤵
PID:2500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bvtqolgdyw.sys

Path C:\Temp\bvtqolgdyw.sys
Size 293KB
SHA256 9be38db84e000047aff89139f1c5529adf829cb66044f99b9a42b0afe6fdeb29
MD5 f4641bf9397fd3b2faea6e0af1b95599
SHA1 895131ed5ea5a86cdc98968c142e5c446b953378
SHA512 923a0773528093a6e7e4969eb367035adb2c59ff05e2ce099c2a5052a3d39fbda78e7d81df88db1541ad92c12b18eabf00a2d03bd2b37437515c3615261c9475
SSDEEP 3072:utKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:uIJjiJcbI03GBc3ucY5DCSj
TLSH
T1B9545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bwtrmjeczu.sys

Path C:\Temp\bwtrmjeczu.sys
Size 293KB
SHA256 8bdc7b34b18420b37ea38db86d5f9f32f92d62669b595b57e6c4d5c737122299
MD5 545b65bfa2776dc369c94879d4e8c1e0
SHA1 388ca87a7395f06186b4742ae4b0e883f0852b55
SHA512 67c8514a49980764daf8344ca2f4831d03a976cf434138488b03ce4c798dc00ffbf76f977479197f4ccd3edd9b30288e76a4aa2c0e043ec6f003f244f989fddd
SSDEEP 3072:mtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:mIJjiJcbI03GBc3ucY5DCSj
TLSH
T1BD545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cwuomgecwu.exe

Path C:\Temp\cwuomgecwu.exe
Size 384KB
SHA256 3e9dc62830a2a7d72518e9b9b6f362cba4f4654bb1fabec462f45e758c2223a2
MD5 b86903d87ad3dba381fe640c9aa8f82c
SHA1 5aef502d74e8318cd6b1f8894417e71d38015770
SHA512 368b0a0ec85bcbc3ba8fcdad6143c502731e864965d922ab61b2fafa8838515ebfa3386b5ef91faa294bac723d7d4d38346a076175815cbbcd5e51cf71d736b1
SSDEEP 3072:H9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:dctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T17D847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eywtolgeyw.sys

Path C:\Temp\eywtolgeyw.sys
Size 293KB
SHA256 b4940ef41c1b97b198b140ff791ace952ac33bfab6e64d9b03703b2c5c5f95db
MD5 acac9b217b11021e29901ae72631c159
SHA1 c12f2e9c8d07f08df8f6627bc53e20bfcc3639e9
SHA512 57531a68bd024ea9005f01b213f5abf0d1149f5dc3d83af1a9de2e982b4a34680f9b846d31590147c3a63941dd90f290d7651d7e52277e10eab412b341f072c0
SSDEEP 3072:9tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:9IJjiJcbI03GBc3ucY5DCSj
TLSH
T17E545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbywtolgey.exe

Path C:\Temp\gbywtolgey.exe
Size 384KB
SHA256 2543da12709d05da19986af6b8870014a11fd45171624a7f1fa5d1d97e7665d7
MD5 987ad2b95518c3d0235caf7f2d5dd191
SHA1 5f47ff565be47dce8b2a43ecb780eabaf167f272
SHA512 3fb5b23d26582266200edd0b33ad0f08b84a777f76e990a93db3f3b0bd2050d37dbd672b30e585897567d57ce92e06cade1101736ccad609f772d96990192609
SSDEEP 3072:09ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:OctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T10A847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_cwuomgecwu.exe

Path C:\Temp\i_cwuomgecwu.exe
Size 384KB
SHA256 0178ad0ec2b64cda9ab1f779d408f7265a2e419e0a7a959306792b4523651913
MD5 bbfed33ae6900936155fa7526bdadf30
SHA1 09a3853d49472d46eec22d1fa540aa470fae2eb2
SHA512 bd06d0cc8227c1113a6ed79f50bad5e5a489c759144b598e18ff70f1e1b7e074d10bae00e6293654d6e6428069274a50ce3404242ddf5d089fbd29a5b7b10f51
SSDEEP 3072:S9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:octFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D4847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gbywtolgey.exe

Path C:\Temp\i_gbywtolgey.exe
Size 384KB
SHA256 782a86bd38645778f654eb12857e13858e5a8caaa2757d68d722433fa4e21069
MD5 35e377ac2430163db7171d1c2e4f2b48
SHA1 76b16218f180f662ef4d2e33a02ee8742feb77dc
SHA512 53194cc3c0f5bf5b82cb68b747ab1804567f8a60cd28b5a78129c110abcf7b9c4945b90381b6e2690b844444897d975da0327c43f16fd32adc0eb8a0c06c2e28
SSDEEP 3072:e9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:8ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T167847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_kicauspkhc.exe

Path C:\Temp\i_kicauspkhc.exe
Size 384KB
SHA256 b2ec86f2ffef0bb43929b34e65fcf53a0b3806e21d1761cdfb168f209c645c38
MD5 eee9c611ce63fc8b451ddd8b1c8232f6
SHA1 b8988f93ed2bb1441a7c0225c5e038c1323c4cb6
SHA512 4a2c87a356fe90d0083009c2ae9e08bf653f7d420be2465b1f40eb73098e663506313a33fa5baa5da098ec32f3fac2e24d0c9634cc6969ba0776f05b2dad9f8a
SSDEEP 3072:F9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:nctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T10B847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mjhcxupmhe.exe

Path C:\Temp\i_mjhcxupmhe.exe
Size 384KB
SHA256 83356bd5f42b9e054f40a29f0fef147827ea94858910fe5f0c0bf936f283c546
MD5 141867fd9d2d20402269722df7487e79
SHA1 9355a00b6668f2c6aefc40048fd40660d21e7c65
SHA512 2c6075aaa2322899e56b73ec7cb0e030a7e10a2e0dd47bdf80c887d6e4185b906a3359554bb1d477e6daaafb64ec2995d27744c91fb64102be5bef67c1176300
SSDEEP 3072:99ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:PctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T135847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_olgeywqomj.exe

Path C:\Temp\i_olgeywqomj.exe
Size 384KB
SHA256 ccfe1c33528b7a573658d8d6fad5f2cd544c92f88dd37a3d6ca96944dc09550e
MD5 fb0c656cbfb825f23204a4e4433c6cf7
SHA1 6c34521e5c0d721adef0529d0ee7ff32a7ca0ceb
SHA512 816cd72501c6aef4df468ad19e09423af12f290b607fa05904712275f086875ba91990586b290d671b5a9c2a566b369b94a22087eb46d164f9cde727172a6dc7
SSDEEP 3072:X9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:tctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T119847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icausmkecxvpnhfc.exe

Path C:\Temp\icausmkecxvpnhfc.exe
Size 384KB
SHA256 e922f2d0ca5a4042a0eabedd7f510f4ec2b8a3faa74b37a3d6ba588d1977fb2b
MD5 0b6170d484eababaa212b69e89b5f895
SHA1 f334695ed723c9d31b285b43cfddf867f2316e6f
SHA512 c11a75f7ad69eca4901932e5fcf774bc2fef6984c983429acf3fdd53f03bf37646723c6e70904bbb50a28fe75ca8ce68db5d624fba8d02417c4d241647938012
SSDEEP 3072:D9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:hctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C6847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icausmkecxvpnhfc.sys

Path C:\Temp\icausmkecxvpnhfc.sys
Size 293KB
SHA256 9030e4688a8ab73ea7e87bc98234085f92e1fcc133b79e587357097dc4286fd4
MD5 d30dd5fbc44196bd372d56c8e5220d3f
SHA1 c317ab338f621494402743763c6fbdb199de2570
SHA512 0f111f478eba2f236a2e145ce2bdd76832e5821c87cc84af58de281bdab02f8127c4c2f7b5db5195ccd5c717800b61b14f2ba96445e698166b953e76e9ac1323
SSDEEP 3072:etKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:eIJjiJcbI03GBc3ucY5DCSj
TLSH
T1D4545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kicauspkhc.exe

Path C:\Temp\kicauspkhc.exe
Size 384KB
SHA256 552ebdc3b6c4b3fc069cb12343203bbc64be68a20300b1d45107ac4f954037bb
MD5 ae430f55cdece29aa5c6c40acca21686
SHA1 b8bb1a8358175f828f25a12b43ba5990acb3ef32
SHA512 1fa75b481efb92fb7d27e5a27c72d0b9fdcba99ba52052151f454feb5190b5b99aefa1d8930d6e6a0b3ffe467bff97a61e373b92c28191c8d8fda70b33dafe2c
SSDEEP 3072:U9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:uctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T133847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mjhcxupmhe.exe

Path C:\Temp\mjhcxupmhe.exe
Size 384KB
SHA256 b872402b814dd37d1cee2b4cea3f3fae523263475c28c6ccc9f80e2c172ae7c3
MD5 739c90f565514dc193f45bb67fd59723
SHA1 dd373206396ba27ed8d99b3818f20697acb431ac
SHA512 13959f9ca8b77e5ca28ff57b439087d4acd826b8b63a8a5f0f24ce38c5338dda61627becb0ab647bdf0a4af7f85bf24deace2a566c5e3a422f227499c8cf3c0d
SSDEEP 3072:C9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:YctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T19A847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

olgeywqomj.exe

Path C:\Temp\olgeywqomj.exe
Size 384KB
SHA256 ee7b5182d35d936cd3233ad3a595192a6c8abd2e1515a5dda6d521420ebc53c9
MD5 1a551468a2e5a9f9f9d7f89351275336
SHA1 9b9a37f62230b27daae301ba1a85927c73d87138
SHA512 0588e2745872ffd59cdad537bcd01dd08739bbdec6f2ac3a5dca4270f083d65e701800e87bcf65aef7b8658404c03d9b0af55c05a0ddb38e63f4f14398956ff8
SSDEEP 3072:s9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:2ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T139846A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmkecwupmk.sys

Path C:\Temp\rmkecwupmk.sys
Size 293KB
SHA256 9d19740db3bf2a9bcd281ef77bf68a1570e964fa3e0a73cfa6a90a849b487f0d
MD5 c2785e0ff6457ae497396a13a9dba6a2
SHA1 a32e69b5bc9aa5d36bb0da9d4da24ae001609b6d
SHA512 ed493f42889ff28ad179545e33030b28720a706a818b522066dfe2deeb82c8901c6449ba6bf7b8395b7a5054265a848e82d8c9fbf599bdc0dce5e80e436e1dc1
SSDEEP 3072:6tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:6IJjiJcbI03GBc3ucY5DCSj
TLSH
T1CD545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtqoigayqo.exe

Path C:\Temp\vtqoigayqo.exe
Size 384KB
SHA256 b7190818a63f0ef44825572825bca74afeb594e636f34ef56d82262cf9b335a2
MD5 d0a796f7740a1c6f865b99c3fe0f81e9
SHA1 d623b4107ae677280d55e9559df5a31e197006ef
SHA512 84a73d41b08732ee6276226eeeab9d9961faf180537e1850bd22268d9c5fd663fb4b22983a8b2b40868120c058f2e5327a7bff1f17fe6776453b858aa538aecf
SSDEEP 3072:N9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:fctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T195846A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wuomgeywro.sys

Path C:\Temp\wuomgeywro.sys
Size 293KB
SHA256 0f90fa449f1807ce31fd80725ca8364d3e33da2cedb7a6b82fc88452a1f1956e
MD5 bebc11d50e54b79764eb277c290789e5
SHA1 94e62b35f6abd7a4ff94bf01b9a82524e9739f87
SHA512 54b0b6da12f7795751a530039a921ba9b80769e9dcdb084412313f16a4c5e0455f7d43ef81240f84c637b5dae2ff120141e3ecfb644b2283cc4e5decbf8e158c
SSDEEP 3072:BtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:BIJjiJcbI03GBc3ucY5DCSj
TLSH
T103545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4f4786549ce7942c30cef19040df68b3125b2472124e3dcd8fe5fb2852062de6
MD5 627f2c70f3760098a653bc1ee8c47f0c
SHA1 3d21e78849dff56ef80a066b0af3d01827223d28
SHA512 d8d8dc6bd32a30cb9377b73a2299f1dc4e6f6c51155d82994039997de2f955eba51987844814f6ad329130f509a6ec8bc09cca6c2f577885890da07fb3b29849
TLSH
T15F6183B7A32906DAEB20C53190E5846835F4CA4DC24FBE9EC4ED5DFAA406F0542F281F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5946b4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5946b4.TMP
Size 3KB
SHA256 7784902d947a1521614f74939ec1f06207365756f12fd64b1779753a7f768848
MD5 3adbacaac085e2d530bca85834f9a31b
SHA1 11d873262af897d488c3b824216b3d6aecc8d502
SHA512 7aee4bbbdca2e273fe8c2ae8b853cfb7637f78b9b9f8aadfa10e1e773d73034ff49e908d6ec68c3f91ee21476e00b388bcf6d1a34b090b3e9ed9a85863ac3e20
TLSH
T1AF6183B7A32906D9EB20C53190E9846835F4CA4DC24FBE9EC0ED5DFAA406F0552F281F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

72d350ad-f1ed-4832-a353-e6b51b4e8e03.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\72d350ad-f1ed-4832-a353-e6b51b4e8e03.tmp
Size 1KB
SHA256 1c8d50081ea942a7150fbe7947005fe2302ee095b4cd37d2bb9a718fd6d4cadf
MD5 0f68f31ff9d1ca8210dded58a8d1b451
SHA1 87cbfcd9ef13930cfc06bf16246e9bd8b0aa1726
SHA512 5858009814fd6c7c6a401d1d3fa5e56f547a2a17515e1bb6df8048beb7bc12ae0c27cd6c77b4205ab3db2d2966ee431e813bc5403b2e6585e84dd1a7377e4717
TLSH
T19C319CF783F4893D8A1196F4AA186F1BCE2C0521432C7D5AC9E4AE2B93F3471E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 35b45cacb87822a947abeb54d399fb8f393c518dd3c431511006387057899274
MD5 aacd9ae1ff4b28ece237fd45ce7bed81
SHA1 ab327224cbaf90f65bf1022c4a93ee5ed6ca779c
SHA512 7b06489c8a7b40dae9965b221e253c1e78ab75f9ed796a116c7724d9ff73efeaab15b7265fd0e273d4d5b819919d5321d6160fd17d0addfd554f0710a896f05a
SSDEEP 192:sxRWg4RdCW/fXsc1dZrzoA8p98/g6+WNCCh/YoZdCYHG3IgVIJ:sxRWg4mW/fXsc1TKK/5B/et+
TLSH
T16D42B6166928A93B8CC7E21DFA55BF53D2F95073A1D16E48AAFCCA1C44E76CD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 b811d0f6e581bc74027457ee2a7be17df900454441c1513670bdbac7f264407c
MD5 a6ecc62348a8e4d4c92a11f8a9d92671
SHA1 9409f3f7ebeafd8614b1985ba137fe6112d79fdb
SHA512 958af0ba64bc675d6ff23c0f67670b9870693530ad7cb6bec1e6b798bb44554032d4a728269466358cea1b831434c1d7be0d91ecd475b759ba46e3a03f4de677
SSDEEP 192:sxRWgjRdCW/fXsnJdZrzoA8p98/g6+WNCCh/YoNpCYHG3IgDOIJ:sxRWgjmW/fXsnJTKK/5B/Stn
TLSH
T16842B7166968A93B8CC7E219BB55BF53D3F9507361916E48AAFCCA1C40E76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 cdcf99e9f6538f55dc5fed496a55b9f6e952b80b67a8609241607a55fa51240f
MD5 137df330b4dfda7effcb1ff72c99bbe9
SHA1 7eaa23f39739725704e86d41a91ffb2034ec5d8d
SHA512 77fb00818e857115d270adaeeccfd4ecddf14468786cb8236f5443a38b1c2039930beaa9e91b5161db979d0eec0b9c03b5724b44e2f5029d0de227083af22f7a
SSDEEP 192:sxRWgjRdCW/fXsn1dZrzoA8p98/g6+WNCCh/YoZdCYHG3IgDcIJ:sxRWgjmW/fXsn1TKK/5B/etZ
TLSH
T17842B6166928A93B8CC7E21DFA55BF53D2F95072A1D16E48AAFCCA1C44E76CD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 11801b7e81fdaf1e6b98b26ec85918987af0ce46a627d640c0618a34516e788f
MD5 5bdda37c1662e70fa0dac9c61df83a7c
SHA1 6962432c45ed0f10ca5e64836c97cb5593bf3e63
SHA512 2fb1da8d34cbb13a657d9f4d881f7d9c40bf7ff91ed9a3c61f45b37bbc457065b4da8469ae13d6680ec18407816152cec4d18cae3a770faa9d6a5681af7b266f
SSDEEP 768:j26Hpo7pLuL7MRWgs2f028F1+UoAYDCx9Tuqh0VfUC9xbog/OVcOBVuwGro9He05:j26HpUE7MRWgs2f02u1jazOB4w9ua
TLSH
T182D2DA7B640DCABE4F804ADDEC197E9F6D6802CB9698CD8047FA851C03C6BEA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 ef540da84f6bd9e9fc66cdcdf419fe4ee0b482065459f5b10a301adc6f9c8706
MD5 26182a6d9ed751d4eaa52e9866c0082c
SHA1 3045a2415f77461af36e0f1812c9e1abe2954643
SHA512 201edfa7f364c9577dc8732e5ab923467fc2aa439ecae0670e680236c61edca00cd6a494f80b4b9395c77fcf90e8dbca282cdd4726b781f43e108bcf65f67412
SSDEEP 768:cFQH3dwg+jEdpsOWBbatrONXyer1IRCzni9MfuM:PH3ttSIqnXfuM
TLSH
T16C1339F184D38937D8AD9383A33D6E429EBCC063B5888990BBD55E5DCC8257FC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 423305fd83a8302fab678688de4ed8c0a51ba1f4eda7df88686c2fd63f56888e
MD5 8a4893bdc7b2e8a0abb05c5613bcf470
SHA1 e16042a2c4519baada7da7b286b0733335db46fb
SHA512 846f914cf44fb31792612a502311adf81f4a8d19cc8906175c7480201899f80dbb102f175cc48c59aaf30bcb0256fa8a9cdcbfbaba1811eb3fdab22b52c4c91b
SSDEEP 768:Lrv+4UNbdJ3Fjwe/TBOWBbat7ONXyer1IRCzni9MfD:LbsbP3XmSIqnXfD
TLSH
T12403CF31E0A89E234CE2E395B14B77537FB820A788C54B90EDDA5F9D058799E230F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 16f6984b232a7f2cfa3322d55db943ad720d54dd5d2fa20560700e91b2c9a935
MD5 0a44d2f694cf3f9d8a11ba756b8dad82
SHA1 a42e137b99a0b53890a4a83cd0c46c416d307ca2
SHA512 add6d841668e3dd96b7e5633af19068d140c51454a663c1489c83a60389a9f6f4626f171d340c56e9d7fdbbc3efdd30b93f407a2af223acd6e011d97c85b243d
SSDEEP 768:hrv+4UNbdz3C6/TBOWBoONXyer1IRCzniBHeVH1SK7:hbsbV3TESIqnoEH1l
TLSH
T1BB03BF32E4A89E334DE2A3C6B14776137FB86057D6800790EDDE1F4E069B59D230B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 025bcb97e1efe7e9aabb784e58b17223b7f0653faed1671139675fc548ce5a4b
MD5 f05db21935732814b420bfb500bff0cc
SHA1 278b32c0fa25493674b7b72f776f4b2e17afb963
SHA512 63b81e5191d7106fe41a65276a3003fc61739a86109f8673f376760c5bf651717f06bd8d3c6b9baf751deb73a0e676e481504e60d33759c737dbd8975e0b88c2
SSDEEP 768:9C3ajGe/TBOWBbat7ONXyer1IRCzni9MfuM:9C3kmSIqnXfuM
TLSH
T145F2BF7094A5DD230CE5E3C6B2466753BFF81073C9C58A90EDEA9F1E0587A5E170B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 d0085078dcdc000a4174f9c5520e18872ca0815e5d25a3883fdf76e789f9c26d
MD5 d8f25895a1ecb9fb08b5100c73815c87
SHA1 45e6136b78a26e05aa6745f0686356f1c0494dba
SHA512 5f27c169220331617cfd97bf1a5dbbbcf93823012afa3bb451518bc3769dc5893348a7041ff3236b5eb4e7715d697ca48076da452c33ed4590103b941e59974a
SSDEEP 768:SC34jGe/TBOWBbat7ONXyer1IRCzni9MfuM:SC3amSIqnXfuM
TLSH
T197F2BF7094A59D230CE5F3C6B2466753BFF810B3C9C98A50EDEA9F1E0587A5E170B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 ca521c7b5516e38c95275f174bac37225e1969fd7d09023711f6a449b94034f0
MD5 b4ea40b876698e559063aa9966e8e040
SHA1 0c370b5bc39cf22dc31fd57930037903f44ff2c1
SHA512 55c9a81f1231d01ddb9d5adceef078c57332be26ebc9a799a35a01ee006341ad18de487c79faaf8e9238a596f8f8e6ac6eff7d52741870cacf8fb7de15ea10f2
SSDEEP 768:+rv+4UNbdz38o/TBOWBbatXONXyer1IRCzniwMeVH1SK7:+bsbV3PMSIqnoEH1l
TLSH
T1BA03BF31A0A8DE334DE2B396B14773537FB8206789800B90EDDA5F5E059759E230F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

880813ff-e81d-4cd9-bb9b-6ce67daa7311.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\880813ff-e81d-4cd9-bb9b-6ce67daa7311.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4272_1408870809\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 13efbad9601a1babbca614baf6df2bdd67153e44e240dc2e527bf51fe8225d01
MD5 b9fd7b916e3fabbb5cc492c6d2bbd7b3
SHA1 3dc80e9fbd496576d4820dcc39219f358d1f0d8c
SHA512 1e713661a33ad77c969b4acb7779faf2c8a6552080c5276308caa735a3ef1a6ab640a46d1c1e83a059f14f06adfec72cf5dd98fa2d16e8bc22f51e970ba4c660
TLSH
T1F471008357A9DAB3C19A5FF102835248F1BB2238073330200B525586AB34A3A64B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1464-456-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1752-436-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1848-280-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1892-63-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2500-477-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2908-329-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3268-317-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3356-322-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3680-232-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4256-260-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4384-431-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4504-394-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4628-419-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5140-404-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5140-382-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5356-460-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5596-362-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5680-333-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5800-319-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5800-293-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5816-407-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5816-421-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6120-181-0x0000000000010000-0x00000000000AB000-memory.dmp

Download