systex | 0b65a50095ef06726e9e4bff4bed0e45bfdc6770b7407a4224803dcd4c00ea5f

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 09:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_eb53a65ea1b3a781404826c439c6d900_amadey_darkgate_elex_smoke-loader_stop.exe
Size 384KB
Sample260910-k6whhatxhy
SHA256 0b65a50095ef06726e9e4bff4bed0e45bfdc6770b7407a4224803dcd4c00ea5f
MD5 eb53a65ea1b3a781404826c439c6d900
SHA1 2260c284af9e53119400fe64cb438ac42bf3e375
SHA512 e6355617c03b7cfb45b2f0794ed25cf8ac152faee089f4e887980adfebfe2d75ac58121c10bb402628863a2285faebd6ebb7dcf25f5fef23e4928a74ca0a65a8
SSDEEP 3072:r99ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9g:jctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T100847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
4544	cxupnhfzxrpkhcau.exe
5356	cxupnhfzxrpkhcau.sys
4408	CreateProcess.exe
4188	czxrpjezup.exe
2196	CreateProcess.exe
936	CreateProcess.exe
5980	i_czxrpjezup.exe
4604	wupmhfzxrp.sys
1028	CreateProcess.exe
5280	mhezxrpjhb.exe
1612	CreateProcess.exe
5092	CreateProcess.exe
3000	i_mhezxrpjhb.exe
2316	bztrmjecwu.sys
696	CreateProcess.exe
5776	wrojhbztrm.exe
5672	CreateProcess.exe
2784	CreateProcess.exe
3796	i_wrojhbztrm.exe
2456	jgebwtrlje.sys
4396	CreateProcess.exe
2804	oigbytrljd.exe
1388	CreateProcess.exe
4788	CreateProcess.exe
3148	i_oigbytrljd.exe
1036	dbvtqljdbv.sys
4280	CreateProcess.exe
1016	bvtlidbvtn.exe
3836	CreateProcess.exe
1376	CreateProcess.exe
2504	i_bvtlidbvtn.exe
2304	qolgdavtnl.sys
5216	CreateProcess.exe
3172	igaysqkida.exe
4732	CreateProcess.exe
5740	CreateProcess.exe
1532	i_igaysqkida.exe
2028	sqkicavsnl.sys
2560	CreateProcess.exe
4324	sqkidxvtnl.exe
4136	CreateProcess.exe
4864	CreateProcess.exe
900	i_sqkidxvtnl.exe
4604	pnkicaxspn.sys
6076	CreateProcess.exe
6020	sqkifzxusm.exe
1080	CreateProcess.exe
3580	CreateProcess.exe
3348	i_sqkifzxusm.exe
1876	xrpjhczusm.sys
4460	CreateProcess.exe
3440	rpjhczusmk.exe
5496	CreateProcess.exe
5104	CreateProcess.exe
3456	i_rpjhczusmk.exe
3360	usmkhcausm.sys
876	CreateProcess.exe
4604	hezwrpjhbz.exe
5736	CreateProcess.exe
912	CreateProcess.exe
5088	i_hezwrpjhbz.exe
4960	omgezwrpjh.sys
1036	CreateProcess.exe
4536	omgezwrpjh.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2720_634497773\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2720_530400731\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2720_530400731\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2720_2047707184\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2720_527615805\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2720_527615805\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2720_527615805\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2720_2047707184\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2720_527615805\office_endpoints_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhfzxrpjhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhfzxrpjhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-10_eb53a65ea1b3a781404826c439c6d900_amadey_darkgate_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxupnhfzxrpkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhczusmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urpmgezwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urpmgezwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhezxrpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigbytrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igaysqkida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hezwrpjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhezxrpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgezwrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqoigbytrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkifzxusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhczusmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljebwtrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkifayspk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtlidbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igaysqkida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgezwrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nligayvsqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrojhbztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrojhbztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hezwrpjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljebwtrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpnifaysqc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigbytrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvtlidbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkidxvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkidxvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqoigbytrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpnifaysqc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkifayspk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czxrpjezup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czxrpjezup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkifzxusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nligayvsqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkecxupmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smkecxupmk.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3852	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5272	ipconfig.exe
5624	ipconfig.exe
1448	ipconfig.exe
3568	ipconfig.exe
2128	ipconfig.exe
1860	ipconfig.exe
5300	ipconfig.exe
1496	ipconfig.exe
4964	ipconfig.exe
2412	ipconfig.exe
5900	ipconfig.exe
4236	ipconfig.exe
2676	ipconfig.exe
3128	ipconfig.exe
5408	ipconfig.exe
1532	ipconfig.exe
4504	ipconfig.exe
1552	ipconfig.exe
3764	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335052090508905"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-189034102-168398478-1159367937-1000\{5782A131-A79F-4002-B9A6-13F1585742ED}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3544	2026-09-10_eb53a65ea1b3a781404826c439c6d900_amadey_darkgate_elex_smoke-loader_stop.exe
3544	2026-09-10_eb53a65ea1b3a781404826c439c6d900_amadey_darkgate_elex_smoke-loader_stop.exe
3544	2026-09-10_eb53a65ea1b3a781404826c439c6d900_amadey_darkgate_elex_smoke-loader_stop.exe
3544	2026-09-10_eb53a65ea1b3a781404826c439c6d900_amadey_darkgate_elex_smoke-loader_stop.exe
3544	2026-09-10_eb53a65ea1b3a781404826c439c6d900_amadey_darkgate_elex_smoke-loader_stop.exe
3544	2026-09-10_eb53a65ea1b3a781404826c439c6d900_amadey_darkgate_elex_smoke-loader_stop.exe
3544	2026-09-10_eb53a65ea1b3a781404826c439c6d900_amadey_darkgate_elex_smoke-loader_stop.exe
3544	2026-09-10_eb53a65ea1b3a781404826c439c6d900_amadey_darkgate_elex_smoke-loader_stop.exe
3544	2026-09-10_eb53a65ea1b3a781404826c439c6d900_amadey_darkgate_elex_smoke-loader_stop.exe
3544	2026-09-10_eb53a65ea1b3a781404826c439c6d900_amadey_darkgate_elex_smoke-loader_stop.exe
3544	2026-09-10_eb53a65ea1b3a781404826c439c6d900_amadey_darkgate_elex_smoke-loader_stop.exe
3544	2026-09-10_eb53a65ea1b3a781404826c439c6d900_amadey_darkgate_elex_smoke-loader_stop.exe
3544	2026-09-10_eb53a65ea1b3a781404826c439c6d900_amadey_darkgate_elex_smoke-loader_stop.exe
3544	2026-09-10_eb53a65ea1b3a781404826c439c6d900_amadey_darkgate_elex_smoke-loader_stop.exe
3544	2026-09-10_eb53a65ea1b3a781404826c439c6d900_amadey_darkgate_elex_smoke-loader_stop.exe
3544	2026-09-10_eb53a65ea1b3a781404826c439c6d900_amadey_darkgate_elex_smoke-loader_stop.exe
3544	2026-09-10_eb53a65ea1b3a781404826c439c6d900_amadey_darkgate_elex_smoke-loader_stop.exe
3544	2026-09-10_eb53a65ea1b3a781404826c439c6d900_amadey_darkgate_elex_smoke-loader_stop.exe
3544	2026-09-10_eb53a65ea1b3a781404826c439c6d900_amadey_darkgate_elex_smoke-loader_stop.exe
3544	2026-09-10_eb53a65ea1b3a781404826c439c6d900_amadey_darkgate_elex_smoke-loader_stop.exe
3544	2026-09-10_eb53a65ea1b3a781404826c439c6d900_amadey_darkgate_elex_smoke-loader_stop.exe
3544	2026-09-10_eb53a65ea1b3a781404826c439c6d900_amadey_darkgate_elex_smoke-loader_stop.exe
3544	2026-09-10_eb53a65ea1b3a781404826c439c6d900_amadey_darkgate_elex_smoke-loader_stop.exe
3544	2026-09-10_eb53a65ea1b3a781404826c439c6d900_amadey_darkgate_elex_smoke-loader_stop.exe
3544	2026-09-10_eb53a65ea1b3a781404826c439c6d900_amadey_darkgate_elex_smoke-loader_stop.exe
3544	2026-09-10_eb53a65ea1b3a781404826c439c6d900_amadey_darkgate_elex_smoke-loader_stop.exe
3544	2026-09-10_eb53a65ea1b3a781404826c439c6d900_amadey_darkgate_elex_smoke-loader_stop.exe
3544	2026-09-10_eb53a65ea1b3a781404826c439c6d900_amadey_darkgate_elex_smoke-loader_stop.exe
3544	2026-09-10_eb53a65ea1b3a781404826c439c6d900_amadey_darkgate_elex_smoke-loader_stop.exe
3544	2026-09-10_eb53a65ea1b3a781404826c439c6d900_amadey_darkgate_elex_smoke-loader_stop.exe
3544	2026-09-10_eb53a65ea1b3a781404826c439c6d900_amadey_darkgate_elex_smoke-loader_stop.exe
3544	2026-09-10_eb53a65ea1b3a781404826c439c6d900_amadey_darkgate_elex_smoke-loader_stop.exe
3544	2026-09-10_eb53a65ea1b3a781404826c439c6d900_amadey_darkgate_elex_smoke-loader_stop.exe
3544	2026-09-10_eb53a65ea1b3a781404826c439c6d900_amadey_darkgate_elex_smoke-loader_stop.exe
3544	2026-09-10_eb53a65ea1b3a781404826c439c6d900_amadey_darkgate_elex_smoke-loader_stop.exe
4544	cxupnhfzxrpkhcau.exe
3544	2026-09-10_eb53a65ea1b3a781404826c439c6d900_amadey_darkgate_elex_smoke-loader_stop.exe
4544	cxupnhfzxrpkhcau.exe
3544	2026-09-10_eb53a65ea1b3a781404826c439c6d900_amadey_darkgate_elex_smoke-loader_stop.exe
4544	cxupnhfzxrpkhcau.exe
3544	2026-09-10_eb53a65ea1b3a781404826c439c6d900_amadey_darkgate_elex_smoke-loader_stop.exe
4544	cxupnhfzxrpkhcau.exe
3544	2026-09-10_eb53a65ea1b3a781404826c439c6d900_amadey_darkgate_elex_smoke-loader_stop.exe
3544	2026-09-10_eb53a65ea1b3a781404826c439c6d900_amadey_darkgate_elex_smoke-loader_stop.exe
4544	cxupnhfzxrpkhcau.exe
4544	cxupnhfzxrpkhcau.exe
3544	2026-09-10_eb53a65ea1b3a781404826c439c6d900_amadey_darkgate_elex_smoke-loader_stop.exe
3544	2026-09-10_eb53a65ea1b3a781404826c439c6d900_amadey_darkgate_elex_smoke-loader_stop.exe
4544	cxupnhfzxrpkhcau.exe
4544	cxupnhfzxrpkhcau.exe
3544	2026-09-10_eb53a65ea1b3a781404826c439c6d900_amadey_darkgate_elex_smoke-loader_stop.exe
3544	2026-09-10_eb53a65ea1b3a781404826c439c6d900_amadey_darkgate_elex_smoke-loader_stop.exe
4544	cxupnhfzxrpkhcau.exe
4544	cxupnhfzxrpkhcau.exe
3544	2026-09-10_eb53a65ea1b3a781404826c439c6d900_amadey_darkgate_elex_smoke-loader_stop.exe
3544	2026-09-10_eb53a65ea1b3a781404826c439c6d900_amadey_darkgate_elex_smoke-loader_stop.exe
4544	cxupnhfzxrpkhcau.exe
4544	cxupnhfzxrpkhcau.exe
3544	2026-09-10_eb53a65ea1b3a781404826c439c6d900_amadey_darkgate_elex_smoke-loader_stop.exe
3544	2026-09-10_eb53a65ea1b3a781404826c439c6d900_amadey_darkgate_elex_smoke-loader_stop.exe
4544	cxupnhfzxrpkhcau.exe
4544	cxupnhfzxrpkhcau.exe
3544	2026-09-10_eb53a65ea1b3a781404826c439c6d900_amadey_darkgate_elex_smoke-loader_stop.exe
3544	2026-09-10_eb53a65ea1b3a781404826c439c6d900_amadey_darkgate_elex_smoke-loader_stop.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	5980	i_czxrpjezup.exe
Token: SeDebugPrivilege	3000	i_mhezxrpjhb.exe
Token: SeDebugPrivilege	3796	i_wrojhbztrm.exe
Token: SeDebugPrivilege	3148	i_oigbytrljd.exe
Token: SeDebugPrivilege	2504	i_bvtlidbvtn.exe
Token: SeDebugPrivilege	1532	i_igaysqkida.exe
Token: SeDebugPrivilege	900	i_sqkidxvtnl.exe
Token: SeDebugPrivilege	3348	i_sqkifzxusm.exe
Token: SeDebugPrivilege	3456	i_rpjhczusmk.exe
Token: SeDebugPrivilege	5088	i_hezwrpjhbz.exe
Token: SeDebugPrivilege	3784	i_omgezwrpjh.exe
Token: SeDebugPrivilege	1704	i_ljebwtrljd.exe
Token: SeDebugPrivilege	4196	i_wqoigbytrl.exe
Token: SeDebugPrivilege	2128	i_nligayvsqk.exe
Token: SeDebugPrivilege	5288	i_vpnifaysqc.exe
Token: SeDebugPrivilege	3848	i_sqkifayspk.exe
Token: SeDebugPrivilege	1964	i_smkecxupmk.exe
Token: SeDebugPrivilege	5500	i_mhfzxrpjhc.exe
Token: SeDebugPrivilege	4760	i_urpmgezwrp.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2720	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3544 wrote to memory of 4544	3544	2026-09-10_eb53a65ea1b3a781404826c439c6d900_amadey_darkgate_elex_smoke-loader_stop.exe	90
PID 3544 wrote to memory of 780	3544	2026-09-10_eb53a65ea1b3a781404826c439c6d900_amadey_darkgate_elex_smoke-loader_stop.exe	91
PID 780 wrote to memory of 2720	780	iexplore.exe	92
PID 2720 wrote to memory of 2284	2720	msedge.exe	93
PID 2720 wrote to memory of 3852	2720	msedge.exe	94
PID 2720 wrote to memory of 4588	2720	msedge.exe	95
PID 2720 wrote to memory of 4588	2720	msedge.exe	95
PID 2720 wrote to memory of 4588	2720	msedge.exe	95
PID 2720 wrote to memory of 2020	2720	msedge.exe	96
PID 2720 wrote to memory of 2020	2720	msedge.exe	96
PID 2720 wrote to memory of 1504	2720	msedge.exe	98
PID 2720 wrote to memory of 120	2720	msedge.exe	99
PID 2720 wrote to memory of 1504	2720	msedge.exe	98
PID 2720 wrote to memory of 1504	2720	msedge.exe	98
PID 2720 wrote to memory of 120	2720	msedge.exe	99
PID 2720 wrote to memory of 120	2720	msedge.exe	99
PID 2720 wrote to memory of 5940	2720	msedge.exe	100
PID 2720 wrote to memory of 2104	2720	msedge.exe	101
PID 2720 wrote to memory of 5940	2720	msedge.exe	100
PID 2720 wrote to memory of 5940	2720	msedge.exe	100
PID 2720 wrote to memory of 2104	2720	msedge.exe	101
PID 2720 wrote to memory of 2104	2720	msedge.exe	101
PID 2720 wrote to memory of 1904	2720	msedge.exe	102
PID 2720 wrote to memory of 1904	2720	msedge.exe	102
PID 2720 wrote to memory of 2844	2720	msedge.exe	106
PID 2720 wrote to memory of 2192	2720	msedge.exe	107
PID 2720 wrote to memory of 2844	2720	msedge.exe	106
PID 2720 wrote to memory of 2192	2720	msedge.exe	107
PID 2720 wrote to memory of 2636	2720	msedge.exe	109
PID 2720 wrote to memory of 1192	2720	msedge.exe	110
PID 2720 wrote to memory of 1192	2720	msedge.exe	110
PID 4544 wrote to memory of 4408	4544	cxupnhfzxrpkhcau.exe	111
PID 4188 wrote to memory of 2196	4188	czxrpjezup.exe	116
PID 2720 wrote to memory of 5564	2720	msedge.exe	119
PID 2720 wrote to memory of 5564	2720	msedge.exe	119
PID 4544 wrote to memory of 936	4544	cxupnhfzxrpkhcau.exe	120
PID 4544 wrote to memory of 1028	4544	cxupnhfzxrpkhcau.exe	124
PID 5280 wrote to memory of 1612	5280	mhezxrpjhb.exe	126
PID 4544 wrote to memory of 5092	4544	cxupnhfzxrpkhcau.exe	129
PID 4544 wrote to memory of 696	4544	cxupnhfzxrpkhcau.exe	133
PID 5776 wrote to memory of 5672	5776	wrojhbztrm.exe	135
PID 4544 wrote to memory of 2784	4544	cxupnhfzxrpkhcau.exe	138
PID 4544 wrote to memory of 4396	4544	cxupnhfzxrpkhcau.exe	143
PID 2804 wrote to memory of 1388	2804	oigbytrljd.exe	145
PID 4544 wrote to memory of 4788	4544	cxupnhfzxrpkhcau.exe	148
PID 2720 wrote to memory of 4556	2720	msedge.exe	150
PID 2720 wrote to memory of 4232	2720	msedge.exe	151
PID 2720 wrote to memory of 5088	2720	msedge.exe	152
PID 4544 wrote to memory of 4280	4544	cxupnhfzxrpkhcau.exe	155
PID 1016 wrote to memory of 3836	1016	bvtlidbvtn.exe	157
PID 4544 wrote to memory of 1376	4544	cxupnhfzxrpkhcau.exe	160
PID 4544 wrote to memory of 5216	4544	cxupnhfzxrpkhcau.exe	164
PID 3172 wrote to memory of 4732	3172	igaysqkida.exe	166
PID 4544 wrote to memory of 5740	4544	cxupnhfzxrpkhcau.exe	169
PID 4544 wrote to memory of 2560	4544	cxupnhfzxrpkhcau.exe	173
PID 4324 wrote to memory of 4136	4324	sqkidxvtnl.exe	175
PID 4544 wrote to memory of 4864	4544	cxupnhfzxrpkhcau.exe	178
PID 4544 wrote to memory of 6076	4544	cxupnhfzxrpkhcau.exe	182
PID 6020 wrote to memory of 1080	6020	sqkifzxusm.exe	184
PID 4544 wrote to memory of 3580	4544	cxupnhfzxrpkhcau.exe	187
PID 2720 wrote to memory of 3404	2720	msedge.exe	189
PID 2720 wrote to memory of 3404	2720	msedge.exe	189
PID 4544 wrote to memory of 4460	4544	cxupnhfzxrpkhcau.exe	195
PID 3440 wrote to memory of 5496	3440	rpjhczusmk.exe	197

C:\Users\Admin\AppData\Local\Temp\2026-09-10_eb53a65ea1b3a781404826c439c6d900_amadey_darkgate_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_eb53a65ea1b3a781404826c439c6d900_amadey_darkgate_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3544
- C:\Temp\cxupnhfzxrpkhcau.exe
  C:\Temp\cxupnhfzxrpkhcau.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4544
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\czxrpjezup.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4408
  - - C:\Temp\czxrpjezup.exe
      C:\Temp\czxrpjezup.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4188
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2196
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2128
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_czxrpjezup.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:936
  - - C:\Temp\i_czxrpjezup.exe
      C:\Temp\i_czxrpjezup.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5980
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mhezxrpjhb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1028
  - - C:\Temp\mhezxrpjhb.exe
      C:\Temp\mhezxrpjhb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5280
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1612
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5272
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mhezxrpjhb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5092
  - - C:\Temp\i_mhezxrpjhb.exe
      C:\Temp\i_mhezxrpjhb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3000
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wrojhbztrm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:696
  - - C:\Temp\wrojhbztrm.exe
      C:\Temp\wrojhbztrm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5776
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5672
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4236
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wrojhbztrm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2784
  - - C:\Temp\i_wrojhbztrm.exe
      C:\Temp\i_wrojhbztrm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3796
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\oigbytrljd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4396
  - - C:\Temp\oigbytrljd.exe
      C:\Temp\oigbytrljd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2804
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1388
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2676
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_oigbytrljd.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4788
  - - C:\Temp\i_oigbytrljd.exe
      C:\Temp\i_oigbytrljd.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3148
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bvtlidbvtn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4280
  - - C:\Temp\bvtlidbvtn.exe
      C:\Temp\bvtlidbvtn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1016
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3836
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1860
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bvtlidbvtn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1376
  - - C:\Temp\i_bvtlidbvtn.exe
      C:\Temp\i_bvtlidbvtn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2504
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\igaysqkida.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5216
  - - C:\Temp\igaysqkida.exe
      C:\Temp\igaysqkida.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3172
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4732
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5624
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_igaysqkida.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5740
  - - C:\Temp\i_igaysqkida.exe
      C:\Temp\i_igaysqkida.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1532
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqkidxvtnl.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2560
  - - C:\Temp\sqkidxvtnl.exe
      C:\Temp\sqkidxvtnl.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4324
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4136
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5300
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqkidxvtnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4864
  - - C:\Temp\i_sqkidxvtnl.exe
      C:\Temp\i_sqkidxvtnl.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:900
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqkifzxusm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6076
  - - C:\Temp\sqkifzxusm.exe
      C:\Temp\sqkifzxusm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6020
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1080
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3764
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqkifzxusm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3580
  - - C:\Temp\i_sqkifzxusm.exe
      C:\Temp\i_sqkifzxusm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3348
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rpjhczusmk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4460
  - - C:\Temp\rpjhczusmk.exe
      C:\Temp\rpjhczusmk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3440
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5496
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3128
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rpjhczusmk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5104
  - - C:\Temp\i_rpjhczusmk.exe
      C:\Temp\i_rpjhczusmk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3456
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hezwrpjhbz.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:876
  - - C:\Temp\hezwrpjhbz.exe
      C:\Temp\hezwrpjhbz.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4604
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5736
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5408
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hezwrpjhbz.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:912
  - - C:\Temp\i_hezwrpjhbz.exe
      C:\Temp\i_hezwrpjhbz.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5088
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\omgezwrpjh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1036
  - - C:\Temp\omgezwrpjh.exe
      C:\Temp\omgezwrpjh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4536
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2504
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1496
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_omgezwrpjh.exe ups_ins
    3⤵
    PID:2448
  - - C:\Temp\i_omgezwrpjh.exe
      C:\Temp\i_omgezwrpjh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3784
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljebwtrljd.exe ups_run
    3⤵
    PID:4236
  - - C:\Temp\ljebwtrljd.exe
      C:\Temp\ljebwtrljd.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3768
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4716
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1532
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljebwtrljd.exe ups_ins
    3⤵
    PID:1988
  - - C:\Temp\i_ljebwtrljd.exe
      C:\Temp\i_ljebwtrljd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1704
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wqoigbytrl.exe ups_run
    3⤵
    PID:5240
  - - C:\Temp\wqoigbytrl.exe
      C:\Temp\wqoigbytrl.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5596
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5360
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1448
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wqoigbytrl.exe ups_ins
    3⤵
    PID:5372
  - - C:\Temp\i_wqoigbytrl.exe
      C:\Temp\i_wqoigbytrl.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4196
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nligayvsqk.exe ups_run
    3⤵
    PID:5232
  - - C:\Temp\nligayvsqk.exe
      C:\Temp\nligayvsqk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:300
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3644
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4504
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nligayvsqk.exe ups_ins
    3⤵
    PID:2260
  - - C:\Temp\i_nligayvsqk.exe
      C:\Temp\i_nligayvsqk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2128
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vpnifaysqc.exe ups_run
    3⤵
    PID:6072
  - - C:\Temp\vpnifaysqc.exe
      C:\Temp\vpnifaysqc.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1192
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3464
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4964
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vpnifaysqc.exe ups_ins
    3⤵
    PID:1704
  - - C:\Temp\i_vpnifaysqc.exe
      C:\Temp\i_vpnifaysqc.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5288
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqkifayspk.exe ups_run
    3⤵
    PID:3332
  - - C:\Temp\sqkifayspk.exe
      C:\Temp\sqkifayspk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5528
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2880
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2412
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqkifayspk.exe ups_ins
    3⤵
    PID:5784
  - - C:\Temp\i_sqkifayspk.exe
      C:\Temp\i_sqkifayspk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3848
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\smkecxupmk.exe ups_run
    3⤵
    PID:1160
  - - C:\Temp\smkecxupmk.exe
      C:\Temp\smkecxupmk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4504
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4768
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1552
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_smkecxupmk.exe ups_ins
    3⤵
    PID:4448
  - - C:\Temp\i_smkecxupmk.exe
      C:\Temp\i_smkecxupmk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1964
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mhfzxrpjhc.exe ups_run
    3⤵
    PID:4784
  - - C:\Temp\mhfzxrpjhc.exe
      C:\Temp\mhfzxrpjhc.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1384
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:772
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5900
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mhfzxrpjhc.exe ups_ins
    3⤵
    PID:1224
  - - C:\Temp\i_mhfzxrpjhc.exe
      C:\Temp\i_mhfzxrpjhc.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5500
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\urpmgezwrp.exe ups_run
    3⤵
    PID:2220
  - - C:\Temp\urpmgezwrp.exe
      C:\Temp\urpmgezwrp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1904
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5760
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3568
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_urpmgezwrp.exe ups_ins
    3⤵
    PID:6092
  - - C:\Temp\i_urpmgezwrp.exe
      C:\Temp\i_urpmgezwrp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4760
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ztrljebwuo.exe ups_run
    3⤵
    PID:5980
  - - C:\Temp\ztrljebwuo.exe
      C:\Temp\ztrljebwuo.exe ups_run
      4⤵
      PID:2484
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ff87f78c188,0x7ff87f78c194,0x7ff87f78c1a0
      4⤵
      PID:2284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,8758109078956894673,8382071318192743219,524288 --field-trial-handle=2932,i,3295725934601966213,10773765139627719532,262144 --variations-seed-version --mojo-platform-channel-handle=3020 /prefetch:11
      4⤵
      System Time Discovery
      PID:3852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1616,i,14061709167622877000,1537246100250203926,262144 --field-trial-handle=2932,i,3295725934601966213,10773765139627719532,262144 --variations-seed-version --mojo-platform-channel-handle=2928 /prefetch:2
      4⤵
      PID:4588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,16811070761656278591,16891688010861387589,524288 --field-trial-handle=2932,i,3295725934601966213,10773765139627719532,262144 --variations-seed-version --mojo-platform-channel-handle=3116 /prefetch:13
      4⤵
      PID:2020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3532,i,12889900665481534550,2178200657324468185,2097152 --field-trial-handle=2932,i,3295725934601966213,10773765139627719532,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
      4⤵
      PID:1504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3556,i,16624559003225824466,9437763693029370307,2097152 --field-trial-handle=2932,i,3295725934601966213,10773765139627719532,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
      4⤵
      PID:120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,12609862417116157898,5295036140277519814,2097152 --field-trial-handle=2932,i,3295725934601966213,10773765139627719532,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:1
      4⤵
      PID:5940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,14459753386266153030,12852538160269924887,2097152 --field-trial-handle=2932,i,3295725934601966213,10773765139627719532,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:9
      4⤵
      PID:2104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,10481606381511211327,658512051131034986,524288 --field-trial-handle=2932,i,3295725934601966213,10773765139627719532,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:14
      4⤵
      PID:1904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,699559634856378923,16756909109902198620,524288 --field-trial-handle=2932,i,3295725934601966213,10773765139627719532,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
      4⤵
      PID:2844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,3688073282114934578,10897054291562582074,524288 --field-trial-handle=2932,i,3295725934601966213,10773765139627719532,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14
      4⤵
      PID:2192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,17375215306593126602,11472448055686172928,524288 --field-trial-handle=2932,i,3295725934601966213,10773765139627719532,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:14
      4⤵
      PID:5116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,17375215306593126602,11472448055686172928,524288 --field-trial-handle=2932,i,3295725934601966213,10773765139627719532,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:14
      4⤵
      PID:2636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,15109090015348590642,5049153963790551999,524288 --field-trial-handle=2932,i,3295725934601966213,10773765139627719532,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:14
      4⤵
      PID:1192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6648,i,10630026500451502500,14576387446134920504,524288 --field-trial-handle=2932,i,3295725934601966213,10773765139627719532,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:14
      4⤵
      PID:5564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4232,i,4628780569536945268,9644730818739459805,524288 --field-trial-handle=2932,i,3295725934601966213,10773765139627719532,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:14
      4⤵
      PID:4556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4804,i,9519250340992532009,86514252734690865,524288 --field-trial-handle=2932,i,3295725934601966213,10773765139627719532,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:14
      4⤵
      PID:4232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4832,i,11193291564635775016,4186870405087508387,524288 --field-trial-handle=2932,i,3295725934601966213,10773765139627719532,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:14
      4⤵
      PID:5088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5636,i,7111455905801703253,3671366185862797706,524288 --field-trial-handle=2932,i,3295725934601966213,10773765139627719532,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:14
      4⤵
      PID:3404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2852,i,3272855399304832391,8827998579928740555,524288 --field-trial-handle=2932,i,3295725934601966213,10773765139627719532,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:14
      4⤵
      PID:3148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=928,i,6218707600563091513,17257470363460840230,524288 --field-trial-handle=2932,i,3295725934601966213,10773765139627719532,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:14
      4⤵
      PID:3900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6448,i,4751414850159237736,10343632997121237884,524288 --field-trial-handle=2932,i,3295725934601966213,10773765139627719532,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:14
      4⤵
      PID:5128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6328,i,2526263398798927289,5024047586215021094,262144 --field-trial-handle=2932,i,3295725934601966213,10773765139627719532,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:10
      4⤵
      PID:1828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3836,i,5279862715928118194,759685395484701097,524288 --field-trial-handle=2932,i,3295725934601966213,10773765139627719532,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:14
      4⤵
      PID:4088

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4112

C:\Temp\cxupnhfzxrpkhcau.sys
C:\Temp\cxupnhfzxrpkhcau.sys
1⤵
- Executes dropped EXE
PID:5356

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5496

C:\Temp\wupmhfzxrp.sys
C:\Temp\wupmhfzxrp.sys
1⤵
- Executes dropped EXE
PID:4604

C:\Temp\bztrmjecwu.sys
C:\Temp\bztrmjecwu.sys
1⤵
- Executes dropped EXE
PID:2316

C:\Temp\jgebwtrlje.sys
C:\Temp\jgebwtrlje.sys
1⤵
- Executes dropped EXE
PID:2456

C:\Temp\dbvtqljdbv.sys
C:\Temp\dbvtqljdbv.sys
1⤵
- Executes dropped EXE
PID:1036

C:\Temp\qolgdavtnl.sys
C:\Temp\qolgdavtnl.sys
1⤵
- Executes dropped EXE
PID:2304

C:\Temp\sqkicavsnl.sys
C:\Temp\sqkicavsnl.sys
1⤵
- Executes dropped EXE
PID:2028

C:\Temp\pnkicaxspn.sys
C:\Temp\pnkicaxspn.sys
1⤵
- Executes dropped EXE
PID:4604

C:\Temp\xrpjhczusm.sys
C:\Temp\xrpjhczusm.sys
1⤵
- Executes dropped EXE
PID:1876

C:\Temp\usmkhcausm.sys
C:\Temp\usmkhcausm.sys
1⤵
- Executes dropped EXE
PID:3360

C:\Temp\omgezwrpjh.sys
C:\Temp\omgezwrpjh.sys
1⤵
- Executes dropped EXE
PID:4960

C:\Temp\rojhbztrlj.sys
C:\Temp\rojhbztrlj.sys
1⤵
PID:4504

C:\Temp\ywtolgdywq.sys
C:\Temp\ywtolgdywq.sys
1⤵
PID:6008

C:\Temp\bvtnlgdyoi.sys
C:\Temp\bvtnlgdyoi.sys
1⤵
PID:3296

C:\Temp\yvqnifaysq.sys
C:\Temp\yvqnifaysq.sys
1⤵
PID:5224

C:\Temp\vpnhfdxvpn.sys
C:\Temp\vpnhfdxvpn.sys
1⤵
PID:8

C:\Temp\spnhfcaxsp.sys
C:\Temp\spnhfcaxsp.sys
1⤵
PID:1328

C:\Temp\upmhecxupm.sys
C:\Temp\upmhecxupm.sys
1⤵
PID:296

C:\Temp\urpjhbzxro.sys
C:\Temp\urpjhbzxro.sys
1⤵
PID:2800

C:\Temp\ztrljebztr.sys
C:\Temp\ztrljebztr.sys
1⤵
PID:5176

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bvtlidbvtn.exe

Path C:\Temp\bvtlidbvtn.exe
Size 384KB
SHA256 71150889a8cc1e501f5cbdbf5b25de195a618ff3fad33fd66af1d3675021a080
MD5 a8d0a563eb01d22955fec1b0bc8cff21
SHA1 4d721b56b3a6f1aee85791f80a69acda70a305a5
SHA512 07753a8dceecd1e7565712d226a2f8ebafc9d43927644f019f4b2373e11c1e9d249d931002bdb049fe85a89e5b8851103677e6a6eb7cb6696dba93f6d2cace5f
SSDEEP 3072:U9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:uctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T14B847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bztrmjecwu.sys

Path C:\Temp\bztrmjecwu.sys
Size 293KB
SHA256 9e15dfdea3d2b3230ba4c8c5ab876d0a2daefc6aa4a2e109086bd39c440975b9
MD5 63b6fc11ffe227fd1379f445e8c45b1d
SHA1 6aa37affc8e28ad0045211506863d89dd820ad96
SHA512 1d1a9b89b97d0099db99e34f2bd79eb32d112a72e99a0c179ec07661d1f00c00acf9ac85dcff2f3bd4ab1f8d20b6737c8fa067950120fc5998515f3840a933f3
SSDEEP 3072:7tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:7IJjiJcbI03GBc3ucY5DCSj
TLSH
T1E5545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cxupnhfzxrpkhcau.exe

Path C:\Temp\cxupnhfzxrpkhcau.exe
Size 384KB
SHA256 4d0ed5e7bfc87594cf60d3c52e3896ab0b915e9fd220755cc6f4de5232351636
MD5 bdf04a297f50a39f1bd812c4c2b82f2a
SHA1 eaf3b7afe1216f0b8e32f7f3702a7b1e30dd4209
SHA512 37aa9c762a6843e711d70ea7e632a57b9d9959e6bee8c25fef0b97a56b08408a2f7351251d7e7ebb40ee4754d2996da6e7ab0c91bd9f36bb564999bb141bb852
SSDEEP 3072:j99ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9w:LctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C0847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cxupnhfzxrpkhcau.sys

Path C:\Temp\cxupnhfzxrpkhcau.sys
Size 293KB
SHA256 69f05d501b9f5146e06bb025c3d968cbafc8be4890b5c6254fb76c601a18b1cd
MD5 6a8d9893b1ad0fb7b99081a2b73b673e
SHA1 36dfedf52dfdedfa1b5bf4c7c07b50a21a1d5042
SHA512 6bf274d83d036dbe6021d8ef16450e0c3d26d6811bec8f8b0f46758d23155daace156f888f5e8dd97f0e9bb21a2aebb72d3528ff73a1f61f25a338befe45d083
SSDEEP 3072:ItKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:IIJjiJcbI03GBc3ucY5DCSj
TLSH
T1CE545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

czxrpjezup.exe

Path C:\Temp\czxrpjezup.exe
Size 384KB
SHA256 02780d68937f6aa51115a514df06a32ce96eb738658864d28672fa4fcc98dc0b
MD5 36674efdc7f00ac4f0331cb5bf2f1093
SHA1 f61437ed41a2b707dc5c384b9ddd2c745ee9e28c
SHA512 bee5131ba534c4b54f2f9262a84f700024ebd57781f5b2d0b131968f4e7c64342ad7ca407a3665bb3e5942c02a1325e6a38d09fc6b2b6e27686b736e75f892b7
SSDEEP 3072:y9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:IctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T18C847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbvtqljdbv.sys

Path C:\Temp\dbvtqljdbv.sys
Size 293KB
SHA256 a4891f77990be8c1bf16117d5bfbcd0fe34f79983e42964e219749b7ac70ab34
MD5 d250651d7c472757190699d6dc52dd79
SHA1 36cf57f9afae04bab05346549bc6e34d36f5d813
SHA512 5cd3c482d445dbc30e46e6e04bf0a901b30ba034442f4cb899ffdc16afec22656ac8b19c7f6954bc6dfc435a8a689e32757f04bdf54e6ac26d687a8fe9e65a07
SSDEEP 3072:HtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:HIJjiJcbI03GBc3ucY5DCSj
TLSH
T1EF545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bvtlidbvtn.exe

Path C:\Temp\i_bvtlidbvtn.exe
Size 384KB
SHA256 9450dc95041851cdd5d038420dba17c7cd324967e9b28897289c175018dbed98
MD5 e66fe9f8b7430dca5be602a9ff84a295
SHA1 08089138f35da04aea88401d54dc65a4903a8834
SHA512 1dcc802a1515d33fa469a44a36768b881a89cb0742fc973e59c3ae186aec90fe609d00db111ac0502a4d003882514223c9ccbe1d81eed34c33b4b791ceb11fe2
SSDEEP 3072:V9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:3ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T10B847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_czxrpjezup.exe

Path C:\Temp\i_czxrpjezup.exe
Size 384KB
SHA256 f8b6c249b4490789d6cbf8f795c49698b6180772c2fcde45cc2010a0035763db
MD5 8c35b94da63a050c142b094f046c9b55
SHA1 1631a4d74c10c3a14efac506b5d5fa8c2f04fb6c
SHA512 fd6e749605a159fd5862386cd47fc77b49242bb67267d03cba87a3c84a12e6a19d483283a9171eaaf0035de862f6f67bfbb6b4635319dd6c3fe650b376473b67
SSDEEP 3072:t9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:/ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T15F847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_igaysqkida.exe

Path C:\Temp\i_igaysqkida.exe
Size 384KB
SHA256 f6243e482f7ba90c319d8bc041ca5dcd0f1ac9dd76a72af8402ab1c95c249d1a
MD5 b0d01737702ae4d41b7b8d3dd678c2e6
SHA1 d89727c6f469c65ca6fdf7f011404004e4d425c2
SHA512 23a50bb4558d028845abaaf200bcc552891d45a3e238556a44a710650973df4f84b502b2ed40db3b700016e2254da15b7c99d6155fa6eb60a1c86dec53422476
SSDEEP 3072:e9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:8ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C4846B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mhezxrpjhb.exe

Path C:\Temp\i_mhezxrpjhb.exe
Size 384KB
SHA256 1587c2072def8ecce446937af7119765458ade1377991b48c7e7205c2db586fd
MD5 65828e9e5c89b08a6c81a40ff1a05b02
SHA1 c8dd1515085f92400598adf700aefcac5cfe86a9
SHA512 5778124678cddd1a43b39b2c2c9e1f849827df0faef72eb501816f0c0cf9c81bbda5211ec6400dff74ee31ed13d81a46365108783cbaef8adb0dbe564a361978
SSDEEP 3072:I9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:KctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B5846A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_oigbytrljd.exe

Path C:\Temp\i_oigbytrljd.exe
Size 384KB
SHA256 b3acb02299438b4a202fe4ba1b8a7bfe78b68e7475fa4f56b09759810c22a5d1
MD5 a2f5398ae1b8212d460351905fa64d2e
SHA1 dc43a2843a47c10f1b42ba1b67e21d3eafab793b
SHA512 a0e7b2544ebae39a66d0b8fc6c9f86fa7dd0676b4d9c328a015464d36ac84376de0fa1d48b90f3674c16656ab094dde99579f6aa7293f8df0d74e61ab70bc3a1
SSDEEP 3072:E9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:ectFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F0847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wrojhbztrm.exe

Path C:\Temp\i_wrojhbztrm.exe
Size 384KB
SHA256 27cd86c1d7c93e7e7c414548da760fe09ab16735b911ee847af50375010b340f
MD5 31b064c11cfeef1051902f16117d72f9
SHA1 e6dccdfd8492c1559965d475480fcf626188b3ea
SHA512 1fadea8463da998dcf1aaa378d007bd68336a997f90b4100af64331c6eb12a3554764fc53260820d6c1b18a1fc4872424d1578e8f8522a0fdb456c63830d86c1
SSDEEP 3072:m9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:UctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1ED847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igaysqkida.exe

Path C:\Temp\igaysqkida.exe
Size 384KB
SHA256 65f36bda4006325a4720e4224541903b08954948682224fab27057ecb80904da
MD5 044bfb119325f7de8de64594da9df7bf
SHA1 cc3f0afe8230fe946b4895ac02b3ad5f3bf66fe0
SHA512 22c92ade72a8cecbb070d4ea12f40c81f7977cbac5a58b75953fc097ac42425ebe05786ce11c20b2a790a714d59c5b5479ebfa2cb8039c05fd134f9cefae4edb
SSDEEP 3072:49ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:6ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T11D847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jgebwtrlje.sys

Path C:\Temp\jgebwtrlje.sys
Size 293KB
SHA256 40e6fab13bd6867616fa64bea10f7472653d2a721c1c6e705e2fce427568f55a
MD5 8c008c1f1dd1d870909c44fb91728787
SHA1 45c96ae927b34b56f9afff248075627071db23cd
SHA512 a059f38c34717e14a74571ce827a607bb9619cc8f564d86a3134500555094e93932c510f645f72e022acb65255527dc3f1a6ff6c6a6e363fc94de8ea5efd93a2
SSDEEP 3072:HtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:HIJjiJcbI03GBc3ucY5DCSj
TLSH
T110545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mhezxrpjhb.exe

Path C:\Temp\mhezxrpjhb.exe
Size 384KB
SHA256 6d5d779a2b7faccb38d5eabf62a0054b5f7a541baba300cd573c4a7d01628959
MD5 a6d3240d14aed95a122083b85fdc37b9
SHA1 5e85969838f69a697ac0b15ec02b99981f225649
SHA512 1414bbf86198d5769eb2add30b3160e7daef26ba281c5e57c0b9dd68323cf6e35cb263536dbd22b7dd29b86cb1b1b6f97814c678768ad1edeee447ed965baab3
SSDEEP 3072:l9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:HctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B2847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oigbytrljd.exe

Path C:\Temp\oigbytrljd.exe
Size 384KB
SHA256 ef03ee361c25f4eb94efa5598b6b48a19065dd371d0a91353783e784c356ef0d
MD5 205c7630a5ddc41ee87e226fa3970fbe
SHA1 ea6402e227f06f4fc84097da753dcff542901b97
SHA512 966b1a02f2bbde5ec4a8f2d4f3dc302c2b46de73296072cc06be44347aec8020f2931645ed0232d1378bb32db97e0adc5171feb6ecc167dccff6de39778fe7b6
SSDEEP 3072:e9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:8ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T197847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qolgdavtnl.sys

Path C:\Temp\qolgdavtnl.sys
Size 293KB
SHA256 48cb04e8fcdbb4e6015e0b8d36a22bb32714570fe0791f366ebcc1ca638fbaed
MD5 b2fa00952bbc3c28dd958a65cd14443c
SHA1 445227f6e87ad2c2554f95900e6f0a51f70860c9
SHA512 eb7dccaaac24f1b1083c933c9511b3955b94e01063fc0ad4036ecacff2d751105fdb4702630307b46772172301319294a518ec49fbbd48c5f79af40bcb3a287b
SSDEEP 3072:AtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:AIJjiJcbI03GBc3ucY5DCSj
TLSH
T1D6545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrojhbztrm.exe

Path C:\Temp\wrojhbztrm.exe
Size 384KB
SHA256 84a00ad37f2619f221bf12f8c435c3d26deac311ee8848ab70a0f12777409d4b
MD5 a0357216a5dff4140822050fb0ecb243
SHA1 af6c2042ecb9b0ebc05ed0703d6dd53d4e8d2e98
SHA512 13936fcc655529eddef8a2ed38fb1c5243d3d409f02dbaef8339d4415c33d12a20df02c48d9936cc1d5329bc1ae74ae63ba383de75e2a2b4baad028b34ecae55
SSDEEP 3072:v9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:1ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T18F847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wupmhfzxrp.sys

Path C:\Temp\wupmhfzxrp.sys
Size 293KB
SHA256 1825f0c889ae6e4b0ff723bcb3e12c21947acb9511ec578030ef99ecccf57fb8
MD5 fdb4e51841b0abc716ac09ab59c181d4
SHA1 6d633616c0600d7c08e48e0f72657bd939b7720b
SHA512 cc2c76e9b37cc26cfbc4c6ef831d7f7b7cd37f774fd34dfbe82ed3c8b56d17042794f45e18c504390a6de2ec76da0793613ab8b2fcf4c95e4d1dd188b2a80942
SSDEEP 3072:8tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:8IJjiJcbI03GBc3ucY5DCSj
TLSH
T1D8545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ffe13798c5910685872d371e84c30baa9eefaaa5db1419603eb30d473d7b2e37
MD5 03c111f9396889c77f6d9883c5df333f
SHA1 be65300843096dba92c5695fd35e2dffcbb7eb0a
SHA512 a77dfe3b48fcb72648f1adfafbf0d0fcd4d88690dcf41609a03e1d6b645d1336b6e322931b2205673283b920d20ed0225c6aa320a83a2d3a410771f18d120c19
TLSH
T1B1D09BD079145D78C4C1353231A773155A516435865C46481151F3BACD65141667E59D
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7add6572365d752d8c3a090b9a256c43e3c5ff716f29ed7aa3c53dc57a08ba60
MD5 0da70f521ac5aee3489abf6e3eb4e375
SHA1 0f3cd9919820116ecc86bab93f4712c08485dc56
SHA512 a9cddd04863b2ac842fe4f91265c19a41d8b7442be8f07a91747705beca52c1e1d563e3c46cf68e1b73606695624f13ca69a8246653c2535d0684ced42c37d33
TLSH
T182D09BD479045D78C4C1353231A673155A616435DA5C46481051F3AACD65141667F5AD
MD5 SHA1 SHA512 TLSH

Submit Download

1c28ca69-7f36-47e8-8451-eb0ce92a1fc5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1c28ca69-7f36-47e8-8451-eb0ce92a1fc5.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 9af39b017dfb360f11129cb2d363123bec718caecbf4bf643d3a711b30ed05eb
MD5 270395f9745244a8f12e4c628d790d5e
SHA1 70cbd9fa790778efe3a6a56e2803c853e4ed3852
SHA512 7b0e3a15088191ce38b1d32af56a3d756d90a9540512bc4c2f6619df827b0472d46ef565714e540df08d3d7213b21458ce77b326599e553ea426fbedf494f3e0
TLSH
T1FA51AA5A136DBDDDDF61B7F270D00388F2F28846A4673E92C022AE78450BF0621E2193
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 64a60bd80ced89460f62b65dbca33d1a1f24bbc2cc30d06c25d603110c7aa5b6
MD5 c57b2494c8b0dc02e03b4fdad00422fa
SHA1 b191a4f3e61eb5ff4a1329af5a513c9a6fab1776
SHA512 82d5aa90ec88bbc6dfcd0a6e13ae7b15856d4d0ebd7d4f9599e4e78046a4f9b43b2b6aa795691f5f43f4e79cf3ddb33ba2225e8f94fd31f4369abbfa6f0fdbd6
TLSH
T1A341B0F383F4867ECA0196F0AA186E2FCE2D0515432C7D5A85E4AE2B93E3471E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 c4647378003f3eae773b2d506d227c3369bc98bb1fd88c18658e3eb0f9c74f93
MD5 9d38571a6cc589b3c6d8e0fdb7428990
SHA1 4982f999f28169e4de71bd5f8e3d42c2fffd01c7
SHA512 2dfa8b33697e2a3118610705c487fc10a64e30c8f86a6f867ee9bbab32e2a1478a3a456662b10628f3c9b2f9dc06b9e35b1d02c2ad1d05e2d58730f0312ffa69
SSDEEP 192:sxRIRxCg/f3sKUZlJgzoA8p9V/g6+WNC0j/YlvZ67dE+GFIgVzJ:sxRIWg/f3sKqlJZz/5F/1dE73
TLSH
T1BF42B7556968AD3B8CC7D60DBA657F53D2F99033A0D41F48E6FC9A1C05EB6DE220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 7a70b5c13677b2c8d2b9d1e4a0adcd20e01a7c57cefd06e4f91beb13cd422981
MD5 24be764a24a1727bc7ae865958107471
SHA1 0727d408caa501fa97e80f7f1d2effcff80c5cff
SHA512 1def06aed250cbca6572b2ea32b7f4d0eede3a8ff5455e610a4d405235ec6f108063c6b7998b180bc3d8738f244359951ce1e33e625b1a0ef377dba45d1656b9
SSDEEP 192:sxRzRxCg/f3sLUZlJgzoA8p9V/g6+WNC0j/YllZK7dE+GFIgD7vzJ:sxRzWg/f3sLqlJZz/5F/VdE7v9
TLSH
T1FA42B755A968AE3B8CCBD70DBA557F53D2F9903290D41F48A6FC9A1C05E76DE220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 95af692104db81cfc0f826293d22ac72a65b17aea1aadbea0cb3502fcc505ece
MD5 5674b921879dded7d85d91feed91acc4
SHA1 7d898cdb410e67a83731518b6c0ef619f1dc98da
SHA512 3c7b79de838e82296f64de59703342d7fb303bd9179723c8f5942d475abfce76b767f45f1f212fe422fdae4d78e361471b768bdf347c9f3a4a94787d5c07f39d
SSDEEP 192:sxRzRxCg/f3s+UZlJgzoA8p9V/g6+WNC0j/YlvZ67dE+GFIgD7VzJ:sxRzWg/f3s+qlJZz/5F/1dE7v3
TLSH
T1E242B755A964AE3B8CCBD70DBA557F53D2F99032A0D41F48E6FC9A1C05E76DE220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 3ae3b7894f71248358547a622cf21eb648b8f094e8278cf8404f2cbfceb1f614
MD5 d8c4015dfb6f9343dcafb9d0bda1aae8
SHA1 20da6ddc5a60751341c50b319a0d64428664147c
SHA512 3f12664c155f1851ad62de50d9d3aa90abdbe5af54d301f6003cbfd3b3416478b5ba895002925d46cc98606bdfb4e2c96c7128a386ccadedd5cf6cf7c219e4bf
SSDEEP 768:dofAqj7pLuL7AxWgg+fJJ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVKsK131grol2C:dofAqVE7AxWgg+fJJu1jaBsKl1rlP
TLSH
T1F0D2DA7B640CCB7E4F804ADDEC19BA9F6DA802CB9698C94047FE941C03C6BEB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 72fbda6cdf19311f92d60cbbd0de3d77c9460b515e706922379688c3f29891fd
MD5 37b40954f66797ec6f844c907ab73832
SHA1 f5ae416f240dad8b786a05bf96887b21ae10808b
SHA512 ebb2bb345704f131fcba561a1211584cd0d0d345635fedd29f42a3b7f2b0996023e69c06e8b70be5a4d436b412d0946cfe8b547bd64de598f1ca6404dbe4d318
SSDEEP 96:KRFSr/VPTXWbAOgHXK42gZXc9lYrj8Hzc5t7xxNWlqggVNK4sg7NcD7SFoFMh1H0:CFSr/VPTmbAvHN2gZM9lYrj8Hzc5t7xm
TLSH
T1DB912081353A0280393F6A1C91F4A91E86C2B863715DE67B7FA811A14F27E02DDFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59fbdb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59fbdb.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 b190722c398a4d5a488d142fd3c6b1e14dfad598a02adb0b51a246299c15939d
MD5 7cac8ab6e700e1ed8611d52549f789d1
SHA1 187cdd22b41f22427b40710cd2fd145f99dba1a2
SHA512 3f4f0edede1e81f395dc0e63e2051b302fd9bdf9ff9a87409b6d511fab507a94b9b8ab7c822b24fc26bdbe552e006d768eb4b922520fbc6d5b66f10b08f48561
SSDEEP 768:4FQb3OwgBAUcmh5+1NHXmTWTbc+HEMgbzf:bb3qrweWn1kMgbzf
TLSH
T18C1328F198E79637D9AE4B87573E6E059EBCC153B4881484BBC86D4DCC861BFC306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 0c6dd8b8299f4cbb0ff99c7cd18459ee12edec4516b25299dc1d3125294c3ce4
MD5 23e98a90fefb39f9129da6477ecfe4fe
SHA1 fe3c77506bf40b7fa63d03600126f45b0f95edc3
SHA512 5e9812ebf1e6fe652901b5de3d7d1293c05744ec242df39c53706d7441cea539b12a43fcc7d663034afb97fa2c3beee55ed5d19999eb9732fa4b9e35744c0894
SSDEEP 384:nDZcIn38NnjXG6OdqSGzRfY9bY/h5+4QPlLJQXmIkdP9IimIMWEfMbc+HEla+VYY:bn3spBiJmh5+TNHXmTWTbc+HEMgbzf
TLSH
T152F2AEB1ACF55A779DEB9FC5AA0BAB066EF8416381C82994CDD8BB0D018755D0307C3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 b7c1dd6a074816937db1458b786b8864216cc0af91fead2c6618a1db858c7925
MD5 4103bf3886f650c333c9225ca5c46d7b
SHA1 02d5b3c364a753b09c4a2aceb577f527386429cd
SHA512 61a34de3359518c485721a4f7a96377d769bf211efc94c46a37a9c00eef5bf0e8239d6997542f447bd1c1b72311843d519f3d10024dc17609c4072f3131b3cbf
SSDEEP 384:neZcIn38NngXG6OdqSGzRfY9bY/h5+4QPlLJQXmIkdP9IimIMWEfMbc+HEla+VYY:cn39pBiJmh5+TNHXmTWTbc+HEMgbzf
TLSH
T1B3F2AEB1ACF55A779DEB9FC5AA0BAB066EF8416381C82984CDD87B0D018755D0317C3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 037602c88baf2263d0060adc8174d36f2b4ae9038b3b89b6483583ed7a3710f8
MD5 248b08b7f0222cb0f88b16f21cb7ed6c
SHA1 6209d09758289d3b268c9a32692bab44d0eaefaa
SHA512 556e8483fff62b294ecb6f744057731f5ee6a9f384762508b8262479d9c43fcab1e43e899d7ca829d25afb532e821c74aa4e50cc4aa4b5edf686a0d92ea6e457
SSDEEP 768:arv+4UNbdM3IBYiJmh5GNHXmTWTbc+/KeVH1SvyZ:absb+3r7r6eWn1iEH1dZ
TLSH
T17203C071DCA98A379DE69B88744BBA573EF8116385C40B84C8D97F4D428748D170BD3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 c8d1d2fa52522e17d703065de138f9de37d45bd90630718cadff23d25d01ff25
MD5 c980e5f65cb649830a3e1153e6830d8d
SHA1 eab0178c8476b8b284017ccb45f01fb6d46beb18
SHA512 653aac22f032b208a92120a904a24fee6e0344704d80a987d883e1fe93bf5e5aa1ac8ec1c9b4acc1c6335abce1a7a2d47eb5bf30363e821dd8c9f2ed73b8e525
SSDEEP 768:Arv+4UNbd43ipBiJmh5+TNHXmTWTbc+HEMgbKA:AbsbS347rseWn1kMgbKA
TLSH
T16F03BF71ACA99A379EE74FC5A50BBA177FF8119384C81694CDD96B8D018B09D030BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 f1f1a5ec3d9e334277758c5c1c37faeaa3707a93d987aa21301707f38f24e5e7
MD5 ebeaedfd1533d73b97923f87790e5350
SHA1 85a9cf206945084cd0f8d42227dce79f175b1193
SHA512 eb31d2aac1e977ceb626611eda99525129a1a65ee26cd6c64254e16591ce99b5c636bde52f15c2c2d158fac5fc28f9e8b787d37d2129c24463705bdd54459ac2
SSDEEP 768:4rv+4UNbdM3qbTiJmh5+VNHXmTWTbc+eEeVH1SvyZ:4bsb+3M7r4eWn1fEH1dZ
TLSH
T1DD03BF719CA95A37AEE69F85A44BBA073FF8515385C80A94CCD96F4D028B49D030BD3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

a50ea992-eb15-41dc-a2e6-0189d34d9bf1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a50ea992-eb15-41dc-a2e6-0189d34d9bf1.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2720_2143845967\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 2102c22881c07b4aa995a23f6b255f2c46cc3c066476902ad6abba4bd83f61f0
MD5 ffa993131dbf3fdea111c591f0d92504
SHA1 071a5662efcfd90f89ea3ee64a5c139c851e8129
SHA512 6b3507320cbfdca7221f56128a0d8f414d3a20b7c10f1492d4cf87b3e548607da4f57e06a9a5b44212489ad2c8937b318e2300709db15f9c4a946fac520ec374
TLSH
T18D71008356B9CAB2C1DA5BF002935648F5BB237C076330214BA25546AA30A7A54B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/8-439-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/296-466-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1036-271-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1036-303-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1328-461-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1876-330-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2028-311-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2304-284-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2316-234-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2456-259-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2800-483-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3296-408-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3360-334-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4504-383-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4504-404-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4604-187-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4604-315-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4960-363-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5176-487-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5224-441-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5224-428-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5356-61-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6008-403-0x0000000000010000-0x00000000000AB000-memory.dmp

Download