systex | 6a9476225689b11f5b4589c71bf125ea469b248cdd2796473e158993dff50678

Analysis

max time kernel
149s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 09:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-30_99ca93a73511230623b8957ab03ff8e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Size 389KB
Sample260930-lbb12swblh
SHA256 6a9476225689b11f5b4589c71bf125ea469b248cdd2796473e158993dff50678
MD5 99ca93a73511230623b8957ab03ff8e8
SHA1 3e6a49c1251b373b30f8869aba2f49314ecf9e0f
SHA512 d3a1562a06c2f71b21c44aba13d8bda9bd15789a2e5d5c101ea463a7e1533bc76af6d2cc605f7bb8934357337e0681ec95291ee8ac382c4b3862e4faeb9321fd
SSDEEP 3072:fuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:fuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T15F847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
8	xrpkhcausmkecxus.exe
6060	xrpkhcausmkecxus.sys
4228	CreateProcess.exe
2728	fzxrpkhzxu.exe
2752	CreateProcess.exe
4132	CreateProcess.exe
2636	i_fzxrpkhzxu.exe
4880	kecwusmkhc.sys
4136	CreateProcess.exe
2560	eczusmjhfz.exe
2448	CreateProcess.exe
4216	CreateProcess.exe
3120	i_eczusmjhfz.exe
5844	zwrpmgecwu.sys
3124	CreateProcess.exe
1380	zwuomjebwu.exe
5840	CreateProcess.exe
5024	CreateProcess.exe
4900	i_zwuomjebwu.exe
1288	ywromjeuom.sys
2956	CreateProcess.exe
5828	trljdbwtol.exe
4104	CreateProcess.exe
816	CreateProcess.exe
5804	i_trljdbwtol.exe
5096	trljgbytro.sys
2884	CreateProcess.exe
3872	wtrljdbvtj.exe
1416	CreateProcess.exe
5460	CreateProcess.exe
2912	i_wtrljdbvtj.exe
4908	oigdbvtnli.sys
3640	CreateProcess.exe
3476	oigbyvqolg.exe
5888	CreateProcess.exe
2520	CreateProcess.exe
5732	i_oigbyvqolg.exe
2556	lfdxvqnifd.sys
1900	CreateProcess.exe
4280	fdxvqnlfda.exe
124	CreateProcess.exe
4692	CreateProcess.exe
4976	i_fdxvqnlfda.exe
5928	kidavsqkif.sys
800	CreateProcess.exe
3884	caxvsnkfcx.exe
1748	CreateProcess.exe
6112	CreateProcess.exe
5940	i_caxvsnkfcx.exe
1172	qkicausnkf.sys
5380	CreateProcess.exe
3708	fzxspkiczx.exe
1232	CreateProcess.exe
2156	CreateProcess.exe
5588	i_fzxspkiczx.exe
4460	pnkecwupmk.sys
4720	CreateProcess.exe
4140	mkeczusmke.exe
6012	CreateProcess.exe
5392	CreateProcess.exe
2564	i_mkeczusmke.exe
1728	rojhezxrpj.sys
5740	CreateProcess.exe
3088	omhezxromh.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_56257867\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_1095367570\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_1095367570\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_1095367570\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_1095367570\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_1073224279\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_1073224279\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_111641609\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_111641609\nav_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omhezxromh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxrpkhzxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eczusmjhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwuomjebwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	caxvsnkfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_toljdbywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqnlidbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spnhfdxvsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxspkiczx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlicavsnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-30_99ca93a73511230623b8957ab03ff8e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtrljdbvtj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxspkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvqnlfda.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qojgbzwqoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spnhfdxvsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwurmjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwurmjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omhezxromh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywuoljhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpkhcausmkecxus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxvqnlfda.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_caxvsnkfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkeczusmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqnlidbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxrpkhzxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eczusmjhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljdbwtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljdbwtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtrljdbvtj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigbyvqolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigbyvqolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkeczusmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxspkiczx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywuoljhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	toljdbywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxspkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgeywrojhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwuomjebwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qojgbzwqoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlicavsnkf.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2108	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4316	ipconfig.exe
4768	ipconfig.exe
4636	ipconfig.exe
5784	ipconfig.exe
2364	ipconfig.exe
5688	ipconfig.exe
2620	ipconfig.exe
5920	ipconfig.exe
2216	ipconfig.exe
5952	ipconfig.exe
1840	ipconfig.exe
5760	ipconfig.exe
4860	ipconfig.exe
2152	ipconfig.exe
4960	ipconfig.exe
4316	ipconfig.exe
5516	ipconfig.exe
4828	ipconfig.exe
804	ipconfig.exe
1204	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4057491610-3392471755-192832105-1000\{37AE62F7-17F4-4120-AD59-2A415809CC60}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4304	2026-09-30_99ca93a73511230623b8957ab03ff8e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4304	2026-09-30_99ca93a73511230623b8957ab03ff8e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4304	2026-09-30_99ca93a73511230623b8957ab03ff8e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4304	2026-09-30_99ca93a73511230623b8957ab03ff8e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4304	2026-09-30_99ca93a73511230623b8957ab03ff8e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4304	2026-09-30_99ca93a73511230623b8957ab03ff8e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4304	2026-09-30_99ca93a73511230623b8957ab03ff8e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4304	2026-09-30_99ca93a73511230623b8957ab03ff8e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4304	2026-09-30_99ca93a73511230623b8957ab03ff8e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4304	2026-09-30_99ca93a73511230623b8957ab03ff8e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4304	2026-09-30_99ca93a73511230623b8957ab03ff8e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4304	2026-09-30_99ca93a73511230623b8957ab03ff8e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4304	2026-09-30_99ca93a73511230623b8957ab03ff8e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4304	2026-09-30_99ca93a73511230623b8957ab03ff8e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4304	2026-09-30_99ca93a73511230623b8957ab03ff8e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4304	2026-09-30_99ca93a73511230623b8957ab03ff8e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4304	2026-09-30_99ca93a73511230623b8957ab03ff8e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4304	2026-09-30_99ca93a73511230623b8957ab03ff8e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4304	2026-09-30_99ca93a73511230623b8957ab03ff8e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4304	2026-09-30_99ca93a73511230623b8957ab03ff8e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4304	2026-09-30_99ca93a73511230623b8957ab03ff8e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4304	2026-09-30_99ca93a73511230623b8957ab03ff8e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4304	2026-09-30_99ca93a73511230623b8957ab03ff8e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4304	2026-09-30_99ca93a73511230623b8957ab03ff8e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4304	2026-09-30_99ca93a73511230623b8957ab03ff8e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4304	2026-09-30_99ca93a73511230623b8957ab03ff8e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4304	2026-09-30_99ca93a73511230623b8957ab03ff8e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4304	2026-09-30_99ca93a73511230623b8957ab03ff8e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4304	2026-09-30_99ca93a73511230623b8957ab03ff8e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4304	2026-09-30_99ca93a73511230623b8957ab03ff8e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4304	2026-09-30_99ca93a73511230623b8957ab03ff8e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4304	2026-09-30_99ca93a73511230623b8957ab03ff8e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4304	2026-09-30_99ca93a73511230623b8957ab03ff8e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4304	2026-09-30_99ca93a73511230623b8957ab03ff8e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
8	xrpkhcausmkecxus.exe
8	xrpkhcausmkecxus.exe
4304	2026-09-30_99ca93a73511230623b8957ab03ff8e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4304	2026-09-30_99ca93a73511230623b8957ab03ff8e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
8	xrpkhcausmkecxus.exe
8	xrpkhcausmkecxus.exe
4304	2026-09-30_99ca93a73511230623b8957ab03ff8e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4304	2026-09-30_99ca93a73511230623b8957ab03ff8e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
8	xrpkhcausmkecxus.exe
8	xrpkhcausmkecxus.exe
4304	2026-09-30_99ca93a73511230623b8957ab03ff8e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4304	2026-09-30_99ca93a73511230623b8957ab03ff8e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
8	xrpkhcausmkecxus.exe
8	xrpkhcausmkecxus.exe
4304	2026-09-30_99ca93a73511230623b8957ab03ff8e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4304	2026-09-30_99ca93a73511230623b8957ab03ff8e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
8	xrpkhcausmkecxus.exe
8	xrpkhcausmkecxus.exe
4304	2026-09-30_99ca93a73511230623b8957ab03ff8e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
8	xrpkhcausmkecxus.exe
4304	2026-09-30_99ca93a73511230623b8957ab03ff8e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
8	xrpkhcausmkecxus.exe
4304	2026-09-30_99ca93a73511230623b8957ab03ff8e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4304	2026-09-30_99ca93a73511230623b8957ab03ff8e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
8	xrpkhcausmkecxus.exe
8	xrpkhcausmkecxus.exe
4304	2026-09-30_99ca93a73511230623b8957ab03ff8e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4304	2026-09-30_99ca93a73511230623b8957ab03ff8e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4304	2026-09-30_99ca93a73511230623b8957ab03ff8e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4304	2026-09-30_99ca93a73511230623b8957ab03ff8e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	2636	i_fzxrpkhzxu.exe
Token: SeDebugPrivilege	3120	i_eczusmjhfz.exe
Token: SeDebugPrivilege	4900	i_zwuomjebwu.exe
Token: SeDebugPrivilege	5804	i_trljdbwtol.exe
Token: SeDebugPrivilege	2912	i_wtrljdbvtj.exe
Token: SeDebugPrivilege	5732	i_oigbyvqolg.exe
Token: SeDebugPrivilege	4976	i_fdxvqnlfda.exe
Token: SeDebugPrivilege	5940	i_caxvsnkfcx.exe
Token: SeDebugPrivilege	5588	i_fzxspkiczx.exe
Token: SeDebugPrivilege	2564	i_mkeczusmke.exe
Token: SeDebugPrivilege	1088	i_omhezxromh.exe
Token: SeDebugPrivilege	4460	i_geywuoljhe.exe
Token: SeDebugPrivilege	6008	i_qojgbzwqoj.exe
Token: SeDebugPrivilege	1088	i_toljdbywqo.exe
Token: SeDebugPrivilege	1604	i_sqnlidbvtn.exe
Token: SeDebugPrivilege	696	i_nlicavsnkf.exe
Token: SeDebugPrivilege	5028	i_spnhfdxvsn.exe
Token: SeDebugPrivilege	4772	i_fzxspkicau.exe
Token: SeDebugPrivilege	2676	i_ecwurmjhbz.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4332	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4304 wrote to memory of 8	4304	2026-09-30_99ca93a73511230623b8957ab03ff8e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	90
PID 4304 wrote to memory of 2804	4304	2026-09-30_99ca93a73511230623b8957ab03ff8e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	91
PID 2804 wrote to memory of 4332	2804	iexplore.exe	92
PID 4332 wrote to memory of 4756	4332	msedge.exe	93
PID 4332 wrote to memory of 2108	4332	msedge.exe	94
PID 4332 wrote to memory of 5660	4332	msedge.exe	96
PID 4332 wrote to memory of 5660	4332	msedge.exe	96
PID 4332 wrote to memory of 5560	4332	msedge.exe	95
PID 4332 wrote to memory of 5560	4332	msedge.exe	95
PID 4332 wrote to memory of 5560	4332	msedge.exe	95
PID 4332 wrote to memory of 2300	4332	msedge.exe	98
PID 4332 wrote to memory of 3888	4332	msedge.exe	99
PID 4332 wrote to memory of 2300	4332	msedge.exe	98
PID 4332 wrote to memory of 2300	4332	msedge.exe	98
PID 4332 wrote to memory of 3888	4332	msedge.exe	99
PID 4332 wrote to memory of 3888	4332	msedge.exe	99
PID 4332 wrote to memory of 1124	4332	msedge.exe	100
PID 4332 wrote to memory of 896	4332	msedge.exe	101
PID 4332 wrote to memory of 1124	4332	msedge.exe	100
PID 4332 wrote to memory of 1124	4332	msedge.exe	100
PID 4332 wrote to memory of 896	4332	msedge.exe	101
PID 4332 wrote to memory of 896	4332	msedge.exe	101
PID 4332 wrote to memory of 1528	4332	msedge.exe	102
PID 4332 wrote to memory of 1528	4332	msedge.exe	102
PID 4332 wrote to memory of 2644	4332	msedge.exe	106
PID 4332 wrote to memory of 2644	4332	msedge.exe	106
PID 4332 wrote to memory of 3472	4332	msedge.exe	107
PID 4332 wrote to memory of 3472	4332	msedge.exe	107
PID 8 wrote to memory of 4228	8	xrpkhcausmkecxus.exe	108
PID 4332 wrote to memory of 3196	4332	msedge.exe	111
PID 2728 wrote to memory of 2752	2728	fzxrpkhzxu.exe	113
PID 4332 wrote to memory of 2432	4332	msedge.exe	116
PID 4332 wrote to memory of 2432	4332	msedge.exe	116
PID 4332 wrote to memory of 4364	4332	msedge.exe	117
PID 4332 wrote to memory of 4364	4332	msedge.exe	117
PID 8 wrote to memory of 4132	8	xrpkhcausmkecxus.exe	120
PID 8 wrote to memory of 4136	8	xrpkhcausmkecxus.exe	124
PID 2560 wrote to memory of 2448	2560	eczusmjhfz.exe	126
PID 8 wrote to memory of 4216	8	xrpkhcausmkecxus.exe	129
PID 8 wrote to memory of 3124	8	xrpkhcausmkecxus.exe	133
PID 1380 wrote to memory of 5840	1380	zwuomjebwu.exe	135
PID 8 wrote to memory of 5024	8	xrpkhcausmkecxus.exe	138
PID 8 wrote to memory of 2956	8	xrpkhcausmkecxus.exe	143
PID 5828 wrote to memory of 4104	5828	trljdbwtol.exe	145
PID 8 wrote to memory of 816	8	xrpkhcausmkecxus.exe	148
PID 4332 wrote to memory of 3752	4332	msedge.exe	150
PID 4332 wrote to memory of 3884	4332	msedge.exe	151
PID 4332 wrote to memory of 1612	4332	msedge.exe	152
PID 8 wrote to memory of 2884	8	xrpkhcausmkecxus.exe	155
PID 3872 wrote to memory of 1416	3872	wtrljdbvtj.exe	157
PID 8 wrote to memory of 5460	8	xrpkhcausmkecxus.exe	160
PID 8 wrote to memory of 3640	8	xrpkhcausmkecxus.exe	164
PID 3476 wrote to memory of 5888	3476	oigbyvqolg.exe	166
PID 8 wrote to memory of 2520	8	xrpkhcausmkecxus.exe	169
PID 8 wrote to memory of 1900	8	xrpkhcausmkecxus.exe	173
PID 4280 wrote to memory of 124	4280	fdxvqnlfda.exe	175
PID 8 wrote to memory of 4692	8	xrpkhcausmkecxus.exe	178
PID 8 wrote to memory of 800	8	xrpkhcausmkecxus.exe	182
PID 3884 wrote to memory of 1748	3884	caxvsnkfcx.exe	184
PID 8 wrote to memory of 6112	8	xrpkhcausmkecxus.exe	187
PID 4332 wrote to memory of 764	4332	msedge.exe	189
PID 4332 wrote to memory of 764	4332	msedge.exe	189
PID 8 wrote to memory of 5380	8	xrpkhcausmkecxus.exe	194
PID 3708 wrote to memory of 1232	3708	fzxspkiczx.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-09-30_99ca93a73511230623b8957ab03ff8e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_99ca93a73511230623b8957ab03ff8e8_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4304
- C:\Temp\xrpkhcausmkecxus.exe
  C:\Temp\xrpkhcausmkecxus.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:8
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fzxrpkhzxu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4228
  - - C:\Temp\fzxrpkhzxu.exe
      C:\Temp\fzxrpkhzxu.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2728
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2752
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5920
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fzxrpkhzxu.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4132
  - - C:\Temp\i_fzxrpkhzxu.exe
      C:\Temp\i_fzxrpkhzxu.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2636
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\eczusmjhfz.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4136
  - - C:\Temp\eczusmjhfz.exe
      C:\Temp\eczusmjhfz.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2560
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2448
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2216
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_eczusmjhfz.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4216
  - - C:\Temp\i_eczusmjhfz.exe
      C:\Temp\i_eczusmjhfz.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3120
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zwuomjebwu.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3124
  - - C:\Temp\zwuomjebwu.exe
      C:\Temp\zwuomjebwu.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1380
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5840
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1204
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zwuomjebwu.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5024
  - - C:\Temp\i_zwuomjebwu.exe
      C:\Temp\i_zwuomjebwu.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4900
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\trljdbwtol.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2956
  - - C:\Temp\trljdbwtol.exe
      C:\Temp\trljdbwtol.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5828
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4104
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4316
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_trljdbwtol.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:816
  - - C:\Temp\i_trljdbwtol.exe
      C:\Temp\i_trljdbwtol.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5804
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wtrljdbvtj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2884
  - - C:\Temp\wtrljdbvtj.exe
      C:\Temp\wtrljdbvtj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3872
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1416
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5952
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wtrljdbvtj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5460
  - - C:\Temp\i_wtrljdbvtj.exe
      C:\Temp\i_wtrljdbvtj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2912
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\oigbyvqolg.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3640
  - - C:\Temp\oigbyvqolg.exe
      C:\Temp\oigbyvqolg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3476
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5888
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4768
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_oigbyvqolg.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2520
  - - C:\Temp\i_oigbyvqolg.exe
      C:\Temp\i_oigbyvqolg.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5732
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fdxvqnlfda.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1900
  - - C:\Temp\fdxvqnlfda.exe
      C:\Temp\fdxvqnlfda.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4280
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:124
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4316
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fdxvqnlfda.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4692
  - - C:\Temp\i_fdxvqnlfda.exe
      C:\Temp\i_fdxvqnlfda.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4976
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\caxvsnkfcx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:800
  - - C:\Temp\caxvsnkfcx.exe
      C:\Temp\caxvsnkfcx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3884
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1748
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4636
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_caxvsnkfcx.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6112
  - - C:\Temp\i_caxvsnkfcx.exe
      C:\Temp\i_caxvsnkfcx.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5940
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fzxspkiczx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5380
  - - C:\Temp\fzxspkiczx.exe
      C:\Temp\fzxspkiczx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3708
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1232
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1840
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fzxspkiczx.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2156
  - - C:\Temp\i_fzxspkiczx.exe
      C:\Temp\i_fzxspkiczx.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5588
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mkeczusmke.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4720
  - - C:\Temp\mkeczusmke.exe
      C:\Temp\mkeczusmke.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4140
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6012
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5760
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mkeczusmke.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5392
  - - C:\Temp\i_mkeczusmke.exe
      C:\Temp\i_mkeczusmke.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2564
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\omhezxromh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5740
  - - C:\Temp\omhezxromh.exe
      C:\Temp\omhezxromh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3088
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3364
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5516
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_omhezxromh.exe ups_ins
    3⤵
    PID:2220
  - - C:\Temp\i_omhezxromh.exe
      C:\Temp\i_omhezxromh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1088
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\geywuoljhe.exe ups_run
    3⤵
    PID:1596
  - - C:\Temp\geywuoljhe.exe
      C:\Temp\geywuoljhe.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4492
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4516
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2364
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_geywuoljhe.exe ups_ins
    3⤵
    PID:2576
  - - C:\Temp\i_geywuoljhe.exe
      C:\Temp\i_geywuoljhe.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4460
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qojgbzwqoj.exe ups_run
    3⤵
    PID:1420
  - - C:\Temp\qojgbzwqoj.exe
      C:\Temp\qojgbzwqoj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5860
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5584
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4860
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qojgbzwqoj.exe ups_ins
    3⤵
    PID:3188
  - - C:\Temp\i_qojgbzwqoj.exe
      C:\Temp\i_qojgbzwqoj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6008
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\toljdbywqo.exe ups_run
    3⤵
    PID:1412
  - - C:\Temp\toljdbywqo.exe
      C:\Temp\toljdbywqo.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5940
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3116
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5688
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_toljdbywqo.exe ups_ins
    3⤵
    PID:2652
  - - C:\Temp\i_toljdbywqo.exe
      C:\Temp\i_toljdbywqo.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1088
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqnlidbvtn.exe ups_run
    3⤵
    PID:4148
  - - C:\Temp\sqnlidbvtn.exe
      C:\Temp\sqnlidbvtn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2000
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5844
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2152
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqnlidbvtn.exe ups_ins
    3⤵
    PID:3032
  - - C:\Temp\i_sqnlidbvtn.exe
      C:\Temp\i_sqnlidbvtn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1604
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nlicavsnkf.exe ups_run
    3⤵
    PID:908
  - - C:\Temp\nlicavsnkf.exe
      C:\Temp\nlicavsnkf.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3756
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4360
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5784
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nlicavsnkf.exe ups_ins
    3⤵
    PID:4292
  - - C:\Temp\i_nlicavsnkf.exe
      C:\Temp\i_nlicavsnkf.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:696
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\spnhfdxvsn.exe ups_run
    3⤵
    PID:2456
  - - C:\Temp\spnhfdxvsn.exe
      C:\Temp\spnhfdxvsn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1088
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5920
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2620
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_spnhfdxvsn.exe ups_ins
    3⤵
    PID:2544
  - - C:\Temp\i_spnhfdxvsn.exe
      C:\Temp\i_spnhfdxvsn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5028
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fzxspkicau.exe ups_run
    3⤵
    PID:2364
  - - C:\Temp\fzxspkicau.exe
      C:\Temp\fzxspkicau.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1752
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2800
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4828
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fzxspkicau.exe ups_ins
    3⤵
    PID:5272
  - - C:\Temp\i_fzxspkicau.exe
      C:\Temp\i_fzxspkicau.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4772
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ecwurmjhbz.exe ups_run
    3⤵
    PID:4384
  - - C:\Temp\ecwurmjhbz.exe
      C:\Temp\ecwurmjhbz.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2556
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4684
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4960
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ecwurmjhbz.exe ups_ins
    3⤵
    PID:4328
  - - C:\Temp\i_ecwurmjhbz.exe
      C:\Temp\i_ecwurmjhbz.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2676
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jgeywrojhb.exe ups_run
    3⤵
    PID:5580
  - - C:\Temp\jgeywrojhb.exe
      C:\Temp\jgeywrojhb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6076
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5756
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:804
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffd7f95c188,0x7ffd7f95c194,0x7ffd7f95c1a0
      4⤵
      PID:4756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,10094443333661768960,13940575739555302576,524288 --field-trial-handle=2344,i,6094024116621641228,2325596113636891623,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:11
      4⤵
      System Time Discovery
      PID:2108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,7288992746977233670,7761237465600867818,262144 --field-trial-handle=2344,i,6094024116621641228,2325596113636891623,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:2
      4⤵
      PID:5560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2476,i,809967181504199010,16327128934276014319,524288 --field-trial-handle=2344,i,6094024116621641228,2325596113636891623,262144 --variations-seed-version --mojo-platform-channel-handle=3088 /prefetch:13
      4⤵
      PID:5660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3616,i,13064862277615983595,14937212883452213247,2097152 --field-trial-handle=2344,i,6094024116621641228,2325596113636891623,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
      4⤵
      PID:2300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3608,i,16197321766661611017,8022064412810487794,2097152 --field-trial-handle=2344,i,6094024116621641228,2325596113636891623,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
      4⤵
      PID:3888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,2267617766664265063,7566512904020710375,2097152 --field-trial-handle=2344,i,6094024116621641228,2325596113636891623,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:9
      4⤵
      PID:1124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,7655970499665940906,3197277319963356939,2097152 --field-trial-handle=2344,i,6094024116621641228,2325596113636891623,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:1
      4⤵
      PID:896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3884,i,11272432056705271094,7265529585151823433,524288 --field-trial-handle=2344,i,6094024116621641228,2325596113636891623,262144 --variations-seed-version --mojo-platform-channel-handle=3844 /prefetch:14
      4⤵
      PID:1528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,13843253957379076320,12090409229705085281,524288 --field-trial-handle=2344,i,6094024116621641228,2325596113636891623,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
      4⤵
      PID:2644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,12535251580931707820,3089467582685495439,524288 --field-trial-handle=2344,i,6094024116621641228,2325596113636891623,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:14
      4⤵
      PID:3472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,9188401786795270769,10903969167950483857,524288 --field-trial-handle=2344,i,6094024116621641228,2325596113636891623,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:14
      4⤵
      PID:1264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,9188401786795270769,10903969167950483857,524288 --field-trial-handle=2344,i,6094024116621641228,2325596113636891623,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:14
      4⤵
      PID:3196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,1752281951444109909,4528145511097304045,524288 --field-trial-handle=2344,i,6094024116621641228,2325596113636891623,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:14
      4⤵
      PID:2432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6568,i,18189000631505974320,13253086635848873247,524288 --field-trial-handle=2344,i,6094024116621641228,2325596113636891623,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
      4⤵
      PID:4364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,10033946865264314232,1275822307123423080,524288 --field-trial-handle=2344,i,6094024116621641228,2325596113636891623,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:14
      4⤵
      PID:3752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,4804896035098809956,12061690830152096147,524288 --field-trial-handle=2344,i,6094024116621641228,2325596113636891623,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:14
      4⤵
      PID:3884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,3729125882556703165,389087520306606532,524288 --field-trial-handle=2344,i,6094024116621641228,2325596113636891623,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:14
      4⤵
      PID:1612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,9780037854420273210,14539225531395039658,524288 --field-trial-handle=2344,i,6094024116621641228,2325596113636891623,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:14
      4⤵
      PID:764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2812,i,8080509555922879110,7404891996651529367,524288 --field-trial-handle=2344,i,6094024116621641228,2325596113636891623,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:14
      4⤵
      PID:4524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=912,i,11984784881253984696,16411375158056184179,524288 --field-trial-handle=2344,i,6094024116621641228,2325596113636891623,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:14
      4⤵
      PID:4684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6756,i,12863244765527057108,12010669514742354714,524288 --field-trial-handle=2344,i,6094024116621641228,2325596113636891623,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:14
      4⤵
      PID:4364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6740,i,2045575381494407026,8138739300475444845,262144 --field-trial-handle=2344,i,6094024116621641228,2325596113636891623,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:10
      4⤵
      PID:428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3916,i,6166679106869534085,2003898212104726345,524288 --field-trial-handle=2344,i,6094024116621641228,2325596113636891623,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:14
      4⤵
      PID:5748

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4580

C:\Temp\xrpkhcausmkecxus.sys
C:\Temp\xrpkhcausmkecxus.sys
1⤵
- Executes dropped EXE
PID:6060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4316

C:\Temp\kecwusmkhc.sys
C:\Temp\kecwusmkhc.sys
1⤵
- Executes dropped EXE
PID:4880

C:\Temp\zwrpmgecwu.sys
C:\Temp\zwrpmgecwu.sys
1⤵
- Executes dropped EXE
PID:5844

C:\Temp\ywromjeuom.sys
C:\Temp\ywromjeuom.sys
1⤵
- Executes dropped EXE
PID:1288

C:\Temp\trljgbytro.sys
C:\Temp\trljgbytro.sys
1⤵
- Executes dropped EXE
PID:5096

C:\Temp\oigdbvtnli.sys
C:\Temp\oigdbvtnli.sys
1⤵
- Executes dropped EXE
PID:4908

C:\Temp\lfdxvqnifd.sys
C:\Temp\lfdxvqnifd.sys
1⤵
- Executes dropped EXE
PID:2556

C:\Temp\kidavsqkif.sys
C:\Temp\kidavsqkif.sys
1⤵
- Executes dropped EXE
PID:5928

C:\Temp\qkicausnkf.sys
C:\Temp\qkicausnkf.sys
1⤵
- Executes dropped EXE
PID:1172

C:\Temp\pnkecwupmk.sys
C:\Temp\pnkecwupmk.sys
1⤵
- Executes dropped EXE
PID:4460

C:\Temp\rojhezxrpj.sys
C:\Temp\rojhezxrpj.sys
1⤵
- Executes dropped EXE
PID:1728

C:\Temp\rpjhbzwuom.sys
C:\Temp\rpjhbzwuom.sys
1⤵
PID:4188

C:\Temp\trljgeywro.sys
C:\Temp\trljgeywro.sys
1⤵
PID:3276

C:\Temp\trljdbvtnl.sys
C:\Temp\trljdbvtnl.sys
1⤵
PID:3328

C:\Temp\tqkigayvtn.sys
C:\Temp\tqkigayvtn.sys
1⤵
PID:3704

C:\Temp\xvtnlfdxvq.sys
C:\Temp\xvtnlfdxvq.sys
1⤵
PID:5948

C:\Temp\sqkicaxspn.sys
C:\Temp\sqkicaxspn.sys
1⤵
PID:5632

C:\Temp\czxspkicau.sys
C:\Temp\czxspkicau.sys
1⤵
PID:4840

C:\Temp\ecwupmkecz.sys
C:\Temp\ecwupmkecz.sys
1⤵
PID:3620

C:\Temp\rpjhezwurm.sys
C:\Temp\rpjhezwurm.sys
1⤵
PID:3104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

eczusmjhfz.exe

Path C:\Temp\eczusmjhfz.exe
Size 389KB
SHA256 fe16d37ba6202849942020d1db20bff33dc3dfc7d232733d9fa0faaf0c33463b
MD5 b09a46f75f76559f695e2d65a306b5ec
SHA1 b1857da84ad30d07f1e7b494a4e78e8c4aa14461
SHA512 346d8027f964c0efd3281264f49e1a03904c483b15958ce5ad30fe6e144f33c01e46ee423d40d5a7a3de5096093dd3317012bfde2d9d7c7f3a4eacae9872df2b
SSDEEP 3072:uuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:uuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A1847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fzxrpkhzxu.exe

Path C:\Temp\fzxrpkhzxu.exe
Size 389KB
SHA256 f11215ebe3aba5426c8bc9c15ec625f8c50d38d581f3722d1fdb92a70356666a
MD5 a11a23cb31f5f67514e0b760e38cf876
SHA1 54649e9e2e509b145e641cf428d2f53d4382989e
SHA512 14d4aed9dfe967baf5e4af0a12f68d516df6ebc607090c88b6db889bdb7bf8f0c4df0c89f4823e1fd42669f634946753157e20cd9441dc3b28ced4dbbbd68742
SSDEEP 3072:Juxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:JuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T14F847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_eczusmjhfz.exe

Path C:\Temp\i_eczusmjhfz.exe
Size 389KB
SHA256 5256ad368eac7dbd88c282451cfc4f2804dde5b76dbeeb8e541e1d846fe305c1
MD5 8941d9e8ae5ccd1266b4a77d92a5e776
SHA1 3bdf0ef71477eb829599553e0ecd6ccc875333ce
SHA512 1e4fd2fb2fa0bf08e35169b95aafd53608cc0463482f03c7c15d79010e56d01f3413fb15cbc9cb0ad1fecd2dd76e8fe30b61d9234aca384b45dc02184bec5e18
SSDEEP 3072:Puxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:PuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D7847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fzxrpkhzxu.exe

Path C:\Temp\i_fzxrpkhzxu.exe
Size 389KB
SHA256 b3a351ad17781623802ae3d1c4878d760283f09e264b8742d1786d4f5628a01c
MD5 dcb1d990e6e4369d5aaf4961bf9b7040
SHA1 cff3917d283a6fdcea04a4fce18906cfd776ebc7
SHA512 98692e69f0fd932bdd7bdae281f613aacd73450bcad28d216741fdf4176d655b61d32da97b7c920668bcd94d81a3963af40201c8f0f05aa68cdd613ca9b01dc0
SSDEEP 3072:Ruxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:RuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1CA847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_trljdbwtol.exe

Path C:\Temp\i_trljdbwtol.exe
Size 389KB
SHA256 b2547e1d6fba540ba93b0dd4902efb0dba3ffd2a17e44edbe4fef82c107df120
MD5 a09a03722aee7afd34cbd784f2dee96d
SHA1 90b90a6c13c73ddd803560a26d051d20f3056288
SHA512 d4dbb3e916e256eb6c04ccc64501c869fb37be76862e33a498836a10c67f76bf0ef800dd6a4338b374896d40987b1405c8aabd8ca2da3c19993bcd45475c6d57
SSDEEP 3072:ruxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:ruxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E8847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wtrljdbvtj.exe

Path C:\Temp\i_wtrljdbvtj.exe
Size 389KB
SHA256 12b8e98aca9084ca307bfb9b6fe8add8b4fa70af9930fbc5d482c52cb427f4b4
MD5 ad6f8244c891305932597d5b60a8012e
SHA1 832e48542022c428c7008f5bed8b0f6e647db26d
SHA512 1cb2632212562f963f25918c47e8ad978af3c00fbbbf3ecf471824ff56c901b19b5ad4d40ada97c6480ed8ced29313b0300e9431216b0a51946e6c42508bee04
SSDEEP 3072:5uxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:5uxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1FF847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zwuomjebwu.exe

Path C:\Temp\i_zwuomjebwu.exe
Size 389KB
SHA256 282182cebdebc9a3ae34ce56e5741a2066f7366a16848241e98ced0fbaa76040
MD5 8e802c825c52d962274bf23294b00e0e
SHA1 ed26a872ec96819fc06dd24f67d676d13f3f4610
SHA512 026f6dbb4dc7053d1ef0dd417af3c35f7520e14959198b2b686552be9cb69b20d7b73616aaff34e905dcbbc97ffc781005bcc7742c094c6efcb9794e3aa1e3fb
SSDEEP 3072:ruxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:ruxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D1847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kecwusmkhc.sys

Path C:\Temp\kecwusmkhc.sys
Size 293KB
SHA256 7ed56825f299a99d2228cafc383505fd16874da1293362688fb6394c6f9748a7
MD5 084f28c10c3bd3b913fcfe1dde7be74c
SHA1 9fd891468e22f04c8ce9d2226c8e4cb25a2f7a68
SHA512 47eee06c510d6bc61569e703c08acd66ca0f930fd8111c7d91f16cce3f31fc77f580cec00b32d6bb43259269f8968917129278495b54362e4f6b4c70d890951c
SSDEEP 3072:otKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:oIJjiJcbI03GBc3ucY5DCSj
TLSH
T1FD545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oigbyvqolg.exe

Path C:\Temp\oigbyvqolg.exe
Size 389KB
SHA256 fecb4fcb1867e0d8c71be7d2dbc284ae9d5b335cd3a7da76dbe209ec3bda92fb
MD5 78bf7c49cac5829fcc4995eca5298e37
SHA1 d99c74c9c29f550a23941bdcb19eb760b486c7f8
SHA512 75b20bf4f0cc18f4b7ec195d3641a09d78a13665c2190f9eeb8e0710b02185dc1be07b213c8e310fed0b7805bdb43db375a6c023ee64c7bd4eb0851f44f025bb
SSDEEP 3072:/uxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:/uxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T13C847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oigdbvtnli.sys

Path C:\Temp\oigdbvtnli.sys
Size 293KB
SHA256 a9da12deb135ab123c7bbad5eca7ccfd3fdb0c29a394752872f93ba09f0aac2d
MD5 7059c4e3b1e4c1d80aa1f504f6145ed3
SHA1 6a37031f10dcc423d343e06fc157ff5965a743f0
SHA512 88d4827beae308f38a1db4979b92512baebab70250e2e4a11b4010801292ab86ce9bb7b34185513bb54165a3da01bc3cb9448bc79e67f486fe66b07f17452356
SSDEEP 3072:ItKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:IIJjiJcbI03GBc3ucY5DCSj
TLSH
T1DE545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trljdbwtol.exe

Path C:\Temp\trljdbwtol.exe
Size 389KB
SHA256 3f86da8841191de405207e809c2bb21b6beaf4fc751475e782aa1eb5c331c021
MD5 1bbb70e075c8d2e4fe35dd5fbb0712a2
SHA1 d37d1f1a8d14cd9c2e4bed78a948a232ea1129ae
SHA512 bb85c1300dd66ace8596cffe941c24982eda81ab22daf499e89df8273af57e3305281b0eee50b66b8fe6437743dfb962b9ef11755d867d759e3fd32472de29a5
SSDEEP 3072:Vuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:VuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T18F847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trljgbytro.sys

Path C:\Temp\trljgbytro.sys
Size 293KB
SHA256 494a96dcd0d4e6adf83aee8c83299d5ad77b3176152aeb4e2bbf134fc7295674
MD5 f5f77aaa6c0e2c998f2db5c45295b43c
SHA1 cda41331d48a192343cf217ec39e2a7a5828e8e8
SHA512 823599d4a61878719e0d2d1a0daea3105a4b28869b1ddda0b5700f2082083fa08bcc554fe4cd71ba0fdcafe7aac9d8dd95b41050d79894ca0e883c17d8956bed
SSDEEP 3072:5tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:5IJjiJcbI03GBc3ucY5DCSj
TLSH
T1EB545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wtrljdbvtj.exe

Path C:\Temp\wtrljdbvtj.exe
Size 389KB
SHA256 8337b6b4c588514df363edfa02a8532b4972a1b3e6e2546a592ed32c94950861
MD5 2733aa206407aff39b9a82448ea55880
SHA1 6c00570d4e88c86748228100bd665683cafeee79
SHA512 31a46405468bd0933a6b2741a184d2bce9ea765db553f1ea9ddb28f2938ce9dc923e0736dd0f2d06ecf786fa5cdbb962425db6ad30b1708cee71b9c4848bc464
SSDEEP 3072:buxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:buxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1ED847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xrpkhcausmkecxus.exe

Path C:\Temp\xrpkhcausmkecxus.exe
Size 389KB
SHA256 01ced1647bfdcb1712f5f2a034ea3fc375c44e3879bfa026ff44f5deee5d9f57
MD5 2d5672e58a992303e0e994d182631f9d
SHA1 81427f2793ef6bd6687bd8339b819500f30f9364
SHA512 19b6dec76565d56e1d48133833625145ab4934faf3a30797e2d1d123832a605bc29d2a122d0a7c5faec7613b6443214e13ac2e9d21754b3d914b8e06e003c2d7
SSDEEP 3072:Suxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:SuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T187847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xrpkhcausmkecxus.sys

Path C:\Temp\xrpkhcausmkecxus.sys
Size 293KB
SHA256 47a163d755f80b162c76b4cd544f66ec00897be9338eb3747b1c3b0d02ada568
MD5 024d3093684885f1f548d2af3bb5af6a
SHA1 768564ffc5da668c16faa1c363f4219eddbda70e
SHA512 19aad2bbb2387e0bc89f9b3937c06a3577ed0c891e16538f5166a0d630698bb7c8f4f9551f002d36935ba2f655042de1381d7cc86526df87bea9bd33259dca14
SSDEEP 3072:mtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:mIJjiJcbI03GBc3ucY5DCSj
TLSH
T1C3545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywromjeuom.sys

Path C:\Temp\ywromjeuom.sys
Size 293KB
SHA256 f59d90db60723d60c38d8fe5d0c722f2a645b825d66f55f755651c5bec96e97a
MD5 8538b3d62e3c87dc47e0cd7df4eb7ba4
SHA1 33363585c1f83770f9e2f65015b7d4e6b726de4a
SHA512 4af655353af6fa27dfb17b58d43ada094eb0d20b65307ca9016155d46dbb69b43a01ae6fb02d5886d09401cf82b2e1ccb61f69e549f85808e5409f1d28194cd2
SSDEEP 3072:vtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:vIJjiJcbI03GBc3ucY5DCSj
TLSH
T14E545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zwrpmgecwu.sys

Path C:\Temp\zwrpmgecwu.sys
Size 293KB
SHA256 a1de9fd26477c27cd7fa065120d8538b34593b25213128fdf9ac5db71fb78523
MD5 48a91adb2727333410ec624f6ee76be8
SHA1 a39784e938eb6957203d66e3e5cbdc218b2efe90
SHA512 9852cc45ef19f6c56ab502325940a2de029e9600fe5b5302621ce48101650ae7e544ecb5feace9900154b2ec58c65ea79a393608edacf5a75a4c982fe0b159c7
SSDEEP 3072:CtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:CIJjiJcbI03GBc3ucY5DCSj
TLSH
T1D8545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zwuomjebwu.exe

Path C:\Temp\zwuomjebwu.exe
Size 389KB
SHA256 e18c9d33a29fbe63c9cc7b83a42db67084691e223ac3881b7fd82e2e1632d1ba
MD5 5b69ba38f2ca71e3a502a8b9153ceddb
SHA1 d70988bd48e85a1b4e03b199f0f0b62b8ac0e902
SHA512 3f9378231a8a6f6d2c94faddc98aef71b47fddb461008b0033a42b169f8ede8a3ae92f957c552a2fe358eb75220435f40630fcf60601827eb249619b948ced8a
SSDEEP 3072:Luxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:LuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T115847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 63b3e051645c9957f53c538586c3b5463f3ba4412c230d66eb66f06ad6052604
MD5 0070abe22a07fb36149648973e990688
SHA1 c8a203457b36afa6d0ce9b56d26cb7817d832d37
SHA512 cda9b7179f6f997dac4ee0624ff9f92ed77b7c27218584fb07f6b2ebc24d10fc25d45c3d2781b766d834f82054e29ee150712e7ab7d7a11465c468d0f8a31fd1
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P79:fwUQC5VwBIiElEd2K57P79
TLSH
T175B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 54a604899198f01e1a2f5ec52bac53679a6d2775840ba8c81ab97c59f718adf8
MD5 b266cfe7dc8e59a4693bec2c7307d768
SHA1 0ff4c63ce201552fd340f72d3376df63989a21f9
SHA512 6832b9d56510cdd21708734b256b052e90f313f920ebc959b4845a1a4fc17cfbfe75dfa04c5252540531ead21e0662a341763e79030c36867f2823312c51c0f9
TLSH
T1C1D02BB8B77CC476E40210784043050052517004581704D10F05A2448984080804014E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fe09a9e94fbd795d6fab442dc426ef79e7bd47dbd80086b003cb1cd34d18db58
MD5 4da51a25f1a6b822ac642c6eae6f9a72
SHA1 9d4f1d1e83270c8d54d24725cd3d7f406de5967d
SHA512 c027a48a18b3b282e84d69320ca44ca416bceb43057eee8fcf4b2647669c307720f00240e17a22310df0488100938fd8b34a0660ca73adaa5f0433a1657b325a
TLSH
T16CD02BBCB76CC476E40210744042050052617004AC1704D10F0562448984080804114E
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 eab48f56d7fbb8973dbc02befccba0e53b7d8644ed31f31684f6b1bfdb62089e
MD5 a744c52d3cb4a7798a235bec1572f8b4
SHA1 5cd7036280a43ae4e2193e36b75df01c98da7128
SHA512 d88d3f6f9d19b5960e7783c9cc7a4c8661c8035ec801a6345bbaa43391647f5f3304bb7f51f5ae2e7d22de9261f21c46aed5fd35f454a99b759e93c8324f61c1
TLSH
T16A616FBA77EC8289FB6C6171D1D69CC736F04688F68F8F0112A9D4BAAC8732BD14C014
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe594f8d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe594f8d.TMP
Size 3KB
SHA256 1e7966677613c89ec119b2131c461c0fa93cc64fd1ac25519b9c3797fe0b6739
MD5 7fd2d202c8f2af6b88b24c2e818d4f05
SHA1 48e350cf6dcf8a583206e144dce76edf1064498f
SHA512 637b69003b730760401e8a6ba2cadbd7dbb7f08a6d526de7c7c7902b4f96e903ec72c2d79355d27b1ac31432091ec45b1f380b8d8dd668bfe8efaa50e6faa8ae
TLSH
T1E5616FBA77EC8289FB6C6171D1D69CC736F04688F68F8F0111A9D4BAAC8731BD14C014
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 45ae188c6727a72b4e4d060b89115085417e08e7f18001d67e34b0d6d8d0c4d5
MD5 9b6b04f50cf0fb77aa0ce89dffd463c5
SHA1 10d11a9c97ffe8143ca27e562fcddfab657e0548
SHA512 0339a3df82c936acdf94d0fc9eb7b183c8cd443db37c346bad8b98e5a5ebc3060de8a84445618436c2791921cfc06d617b9aac0839b8d4bea8b2eccb4fa4b4cc
TLSH
T11B51BEF3C7E8866D8D0156F4AB146E2BDE1D0925432C3D5AC8E49E1B93E34B1E18199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 8f5ad6ba4b2111ce4e9a9dfcb0ca1899678224df7506771794eb91643402d56f
MD5 e9f9fd5cc9dc6d08ddeb6430c8285336
SHA1 0cdfaca31139994f473358772aa446b3ead44213
SHA512 ae3590fb91660fbbad4d74cb5816ce73868b98c3876135cf3a680145cc907ec953e37367f3cd4abf8f54a9ff3ab43121e2c90462174710d0d89445cc8b4c9f5a
SSDEEP 192:sxRhkRjCx/fesWUZ/KVeazoA8p9v/g6+WNCoO/YU2T3TkGiIgVLJ:sxRhk8x/fesWqQeXt/5k/ZX
TLSH
T18542B619AE68A93F8CC7D21DBB55BF53E2F91132A0955E48A6FC861C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 64ef1f13df6f154287f2f3d117945220da74a779f25e70679fc128936cb66bc5
MD5 200c7498da5f0a8ae6d23d9c2a68fa7e
SHA1 78ec0f746508cf5e40419c5d8bc4d97f5d825835
SHA512 89c8b1d855966c5d62c61537cf671f6185a53ba65d0458790eb6a0273e711bd6662dba2e942864855f5878be578d6166d6ad0dc1ec324290af55619290b2f7e1
SSDEEP 192:sxR0kRjCx/fesQUZ/KVeazoA8p9v/g6+WNCoO/YU2TZTkGiIgDZLJ:sxR0k8x/fesQqQeXt/5k/df
TLSH
T1C542C619AE68A97F8CC7D609BB55BF53E2F91132A0955E48A7FC861C00E76DD2207C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 80614b1a47ff9269efca99c9f583f561482ded532a11d7568a0279dd4be0aef4
MD5 59ae72fa196a5af4747b2858c14e8d9d
SHA1 fd85a9756058d7cff369b9508e30bf5046c8b4de
SHA512 dbb7dd9bbd69d2744b886de3985c4fecc8e0cdf359c30748b9e469b2e82ad32655c1782c22e2aaf35e031163ea115f6b470bb4b2dbfa70d035217f3d11b9ca95
SSDEEP 192:sxR0kRjCx/fesNUZ/KVeazoA8p9v/g6+WNCoO/YU2T3TkGiIgDLLJ:sxR0k8x/fesNqQeXt/5k/Zl
TLSH
T12642C619AE78A93F8CC7D219BB55BF53E2F91132A0955E48A6FC861C04E76DD2207C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 5857b6aee83d181805cf1a8d0fa05b7b86c7025258af90f939fbbc7dde264729
MD5 e529fc848295571c709e58fc61052f68
SHA1 2350b1809bdc9888a818f371a893b1ab60082d55
SHA512 413f4b6f42d03c23da98c0e0dd6d39d71a8597fce2587a659113b4526b6da6f63924d4c25a728736b4f8595090c317bdbb83fdde11cf289bfb7824f6d5cc021e
SSDEEP 768:6Jajl+7pLuLb/KWgm0fsO7n8F1+UoAYDCx9Tuqh0VfUC9xbog/OV5QTomBLiroPx:6Jajl+Eb/KWgm0fbbu1jaKQThBl5
TLSH
T10BD2CA7B740CCB7F4F900ADD99197E9B6DA802CB9698CD8047FE941C02C67EB511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a2f06bfdb98cc9614669ee87f9ad75ef7fa73383262e3a7fab37f06177284f44
MD5 77c6a4cfafb190ca1e85b45e64a42e05
SHA1 1ecf7a96ad1925241b511666c61da805b3ec0483
SHA512 73ad79a15a14cd353247b8810718261de967c29290e99cd5f941a005b643748a1caa196a83f7928772e6a84a48ff32298f6bceee858ceff0455bc52a8447b2a0
SSDEEP 24:KGkvc4OItKshA1eSBKhyX9qN6YgIVKWhc1WS/UxZWFi/InKThm1wSUD3yXA3Qa:KgpItK6AQfyVnIVKAcwMyInK1m+3yY
TLSH
T1B6914211717B3681387E784890E4AB6E034332673125EA6B37EA14A34EA7E049DFDCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59eaf3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59eaf3.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 e5f61ca32fdba36041ad23b633ff7423fbd73baea798a45e712747eebb0db182
MD5 710a1e557ae25279ff76a55f2dbc9d2a
SHA1 89b3475513765bdaec18acfa70ede3523bfa8c76
SHA512 0d7c4fd5e115121c7f118d6e929e0bbe09207f72610ee7149b08d89ee490242fbe5ad969808ae31d19c304ad15dced5475927909b9c116fb5efedbee75025e28
SSDEEP 768:tCFQJ3UwgDu80NAfE57Y0GZxJsXBdK8Z4I2srS:tZJ3McA+70/JsXf7V2srS
TLSH
T1211329F194D3CA76E9AE8783673D6E429DBCC1A3B5888994B7D45E4CCC421BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 d3f484c0fb9f9fce9a4620fdc907e66e4464ea314d980de613f13a34144f8ee6
MD5 7a25a988dd78165f11dc514ab27684ae
SHA1 ae825ccb35b6fcf41975b75977dd3966f4bcc4f6
SHA512 31ecbd551688a0754b166d6e307b48fa5b8599e6668843681319c920bdd19f7f56fdbc418c824a576119f10e23d21040e517160af0a7775b41264d56f428f78a
SSDEEP 768:A/UxvxjgC+I3eEK+AE57Y0GZxJsXBdK8lrSHUPpMs:tZj3+I3D370/JsXf7RSfs
TLSH
T19C03C035ECA09D735DF7A390360D7397EEF446B3C5C54AA88AED5B0D028726D430781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 bb9e76424797ba0d2576441c9fc6d6d9b2f1cfc2d05e7a8ba13fc1bc7bb6480a
MD5 950e39df21d90f929f58b2adaf5cf6f4
SHA1 440dccfcf66abb6476ff42746530cf03d5bc83f3
SHA512 c9643ec5b4fadd4cfa6bd2bbb2b77a7736abf14280e90c0eb468caa4c9104268a750207e89d2696e99aaeb0876da063adf82679a55db609a7be20df3313ca625
SSDEEP 768:1G3uW8XK+AAE57Y0GZxJsXBdK8Z4I2srS:1G3uHA370/JsXf7V2srS
TLSH
T1F5F2BE30A8A1CEB35DFE9390760A7383AEB416B3D5C58E59D9E99B0C004719E174BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 e0f746da574a4e869e06d842ed870522840e0a2c889e4303876c6c44583f17ba
MD5 d7c9292826e11b8d46a5bcfcdc71e46b
SHA1 b0c07403eb4b82da15051372e4cb573060b76202
SHA512 60506f6662652d353dbc94e285136d0e0343c11cc0851b726a842d6ad9ac2be4293abae7cb114cfbba5ab4361e3c2e5697d25abfefb816b970642f339618dbc8
SSDEEP 768:cG3Zv8XK+AAE57Y0GZxJsXBdK8Z4I2srS:cG3Z4A370/JsXf7V2srS
TLSH
T1BDF2BF30E8A1CEB75DFE9390760A7383AEB416B3D5C58E49D9E99B0C004719E174BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

0869f3a3-1460-4528-8126-5b595a1ede6c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\0869f3a3-1460-4528-8126-5b595a1ede6c.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4332_1248332439\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 f0af0cd225e51957540e830ae1198d39ef0266bc0759536eda93c4eb090f98ff
MD5 5863a7dac5b378da8a52f3bf626eefcf
SHA1 b67a4fd003273e1f0cd71bac245bfcad5e842b6b
SHA512 412ea4fecde7d14761c820451d60c4441d80b4c5bdeab33dd7385caadfc5403ab385639aa791be4633b5ea8d84b0bd1c218afc8a1af851a34064602f099fb5ef
TLSH
T1CD71C08367ADD9F2C1DA5BF102835644F5BF22780B6370604B555586AB34A3A54B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1172-334-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1288-263-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1288-282-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1728-367-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2556-314-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3104-481-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3276-407-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3328-411-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3620-464-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3704-423-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4188-387-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4460-338-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4840-460-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4880-188-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4908-289-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4908-316-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5096-311-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5096-275-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5632-455-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5844-235-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5928-319-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5948-434-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6060-62-0x0000000000010000-0x00000000000AB000-memory.dmp

Download