systex | 8ac404b28d9f562216badba49edcce4e16fc7c3b511f98429fbece6345af4d31

Analysis

max time kernel
149s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 17:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_85217d283ef9e46b044d5ccdfe017407_amadey_darkgate_elex_smoke-loader_stop.exe
Size 384KB
Sample260709-vj2fcad17p
SHA256 8ac404b28d9f562216badba49edcce4e16fc7c3b511f98429fbece6345af4d31
MD5 85217d283ef9e46b044d5ccdfe017407
SHA1 69b0d8295710ca8d0b7ed8f48485d6bd3e3565d2
SHA512 5af56a07e9881223540e1d423160e2043b66ae6463eee30beee32fd2336f24700853449dbc82302068cdb094e69a57496e06464d2c257ede826c2f40f322cafd
SSDEEP 3072:ubtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:ubtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T128847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC3F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
5980	mjecwuomjhczurmj.exe
3168	mjecwuomjhczurmj.sys
4356	CreateProcess.exe
3676	pjhezwromh.exe
4892	CreateProcess.exe
2864	CreateProcess.exe
2800	i_pjhezwromh.exe
256	jhbztrljhb.sys
2688	CreateProcess.exe
4700	wtomgeytrl.exe
3388	CreateProcess.exe
1636	CreateProcess.exe
4532	i_wtomgeytrl.exe
2680	wtolgeywqo.sys
5316	CreateProcess.exe
3580	mgdywqoigb.exe
3436	CreateProcess.exe
5956	CreateProcess.exe
5168	i_mgdywqoigb.exe
1252	gayvtnljdb.sys
5260	CreateProcess.exe
1248	bvtnlgdbvt.exe
5640	CreateProcess.exe
5104	CreateProcess.exe
700	i_bvtnlgdbvt.exe
1564	lfdxvpnifd.sys
3868	CreateProcess.exe
2856	dxvqkidavt.exe
2168	CreateProcess.exe
1644	CreateProcess.exe
4536	i_dxvqkidavt.exe
912	qkifaysqki.sys
4416	CreateProcess.exe
2844	kicaxsqkic.exe
1336	CreateProcess.exe
2600	CreateProcess.exe
5416	i_kicaxsqkic.exe
4228	pkifzxvsqk.sys
2384	CreateProcess.exe
5080	usmcausmke.exe
4468	CreateProcess.exe
5064	CreateProcess.exe
5112	i_usmcausmke.exe
2088	pmkecausmk.sys
1112	CreateProcess.exe
2800	pnhfzxrpkh.exe
4704	CreateProcess.exe
3140	CreateProcess.exe
2704	i_pnhfzxrpkh.exe
2568	hezxrpjhcz.sys
4940	CreateProcess.exe
2892	bzxrpjgezw.exe
1492	CreateProcess.exe
4320	CreateProcess.exe
3048	i_bzxrpjgezw.exe
5488	hbzwjhbztr.sys
4124	CreateProcess.exe
2900	zwqojgbztr.exe
5172	CreateProcess.exe
2300	CreateProcess.exe
4444	i_zwqojgbztr.exe
5552	bztrljebzt.sys
3560	CreateProcess.exe
3456	ywtrljytqo.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1232_1883975312\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1232_1170931745\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1232_1170931745\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1232_1294846778\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1232_1883975312\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1232_1294846778\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1232_1294846778\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1232_1294846778\smart_switch_list.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1232_1808027710\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgdywqoigb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxvqkidavt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmcausmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgdywqoigb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dxvqkidavt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicaxsqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxvpmkifax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hcausmkecx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwuomheczw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomgezwro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhezwromh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtomgeytrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvtnlgdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lfdxvpnhfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgeywtroig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhfzxrpkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzxrpjgezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bzxrpjgezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnlfdxvqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhezwromh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmcausmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwqojgbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cxvpmkifax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgeywtroig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjecwuomjhczurmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtomgeytrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kicaxsqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywtrljytqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdyvqoigdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnlfdxvqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hcausmkecx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwuomheczw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-09_85217d283ef9e46b044d5ccdfe017407_amadey_darkgate_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtnlgdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhfzxrpkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwqojgbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywtrljytqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdyvqoigdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lfdxvpnhfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomgezwro.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5140	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5064	ipconfig.exe
4708	ipconfig.exe
4324	ipconfig.exe
800	ipconfig.exe
3196	ipconfig.exe
1944	ipconfig.exe
5044	ipconfig.exe
1408	ipconfig.exe
3896	ipconfig.exe
3748	ipconfig.exe
1400	ipconfig.exe
2092	ipconfig.exe
3424	ipconfig.exe
3524	ipconfig.exe
2768	ipconfig.exe
3272	ipconfig.exe
5200	ipconfig.exe
1564	ipconfig.exe
4188	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280901279582361"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2532687178-1633831978-1202193935-1000\{140BE7F8-F615-4506-8997-134A5E3E1BD0}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
428	2026-07-09_85217d283ef9e46b044d5ccdfe017407_amadey_darkgate_elex_smoke-loader_stop.exe
428	2026-07-09_85217d283ef9e46b044d5ccdfe017407_amadey_darkgate_elex_smoke-loader_stop.exe
428	2026-07-09_85217d283ef9e46b044d5ccdfe017407_amadey_darkgate_elex_smoke-loader_stop.exe
428	2026-07-09_85217d283ef9e46b044d5ccdfe017407_amadey_darkgate_elex_smoke-loader_stop.exe
428	2026-07-09_85217d283ef9e46b044d5ccdfe017407_amadey_darkgate_elex_smoke-loader_stop.exe
428	2026-07-09_85217d283ef9e46b044d5ccdfe017407_amadey_darkgate_elex_smoke-loader_stop.exe
428	2026-07-09_85217d283ef9e46b044d5ccdfe017407_amadey_darkgate_elex_smoke-loader_stop.exe
428	2026-07-09_85217d283ef9e46b044d5ccdfe017407_amadey_darkgate_elex_smoke-loader_stop.exe
428	2026-07-09_85217d283ef9e46b044d5ccdfe017407_amadey_darkgate_elex_smoke-loader_stop.exe
428	2026-07-09_85217d283ef9e46b044d5ccdfe017407_amadey_darkgate_elex_smoke-loader_stop.exe
428	2026-07-09_85217d283ef9e46b044d5ccdfe017407_amadey_darkgate_elex_smoke-loader_stop.exe
428	2026-07-09_85217d283ef9e46b044d5ccdfe017407_amadey_darkgate_elex_smoke-loader_stop.exe
428	2026-07-09_85217d283ef9e46b044d5ccdfe017407_amadey_darkgate_elex_smoke-loader_stop.exe
428	2026-07-09_85217d283ef9e46b044d5ccdfe017407_amadey_darkgate_elex_smoke-loader_stop.exe
428	2026-07-09_85217d283ef9e46b044d5ccdfe017407_amadey_darkgate_elex_smoke-loader_stop.exe
428	2026-07-09_85217d283ef9e46b044d5ccdfe017407_amadey_darkgate_elex_smoke-loader_stop.exe
428	2026-07-09_85217d283ef9e46b044d5ccdfe017407_amadey_darkgate_elex_smoke-loader_stop.exe
428	2026-07-09_85217d283ef9e46b044d5ccdfe017407_amadey_darkgate_elex_smoke-loader_stop.exe
428	2026-07-09_85217d283ef9e46b044d5ccdfe017407_amadey_darkgate_elex_smoke-loader_stop.exe
428	2026-07-09_85217d283ef9e46b044d5ccdfe017407_amadey_darkgate_elex_smoke-loader_stop.exe
428	2026-07-09_85217d283ef9e46b044d5ccdfe017407_amadey_darkgate_elex_smoke-loader_stop.exe
428	2026-07-09_85217d283ef9e46b044d5ccdfe017407_amadey_darkgate_elex_smoke-loader_stop.exe
428	2026-07-09_85217d283ef9e46b044d5ccdfe017407_amadey_darkgate_elex_smoke-loader_stop.exe
428	2026-07-09_85217d283ef9e46b044d5ccdfe017407_amadey_darkgate_elex_smoke-loader_stop.exe
428	2026-07-09_85217d283ef9e46b044d5ccdfe017407_amadey_darkgate_elex_smoke-loader_stop.exe
428	2026-07-09_85217d283ef9e46b044d5ccdfe017407_amadey_darkgate_elex_smoke-loader_stop.exe
428	2026-07-09_85217d283ef9e46b044d5ccdfe017407_amadey_darkgate_elex_smoke-loader_stop.exe
428	2026-07-09_85217d283ef9e46b044d5ccdfe017407_amadey_darkgate_elex_smoke-loader_stop.exe
428	2026-07-09_85217d283ef9e46b044d5ccdfe017407_amadey_darkgate_elex_smoke-loader_stop.exe
428	2026-07-09_85217d283ef9e46b044d5ccdfe017407_amadey_darkgate_elex_smoke-loader_stop.exe
428	2026-07-09_85217d283ef9e46b044d5ccdfe017407_amadey_darkgate_elex_smoke-loader_stop.exe
428	2026-07-09_85217d283ef9e46b044d5ccdfe017407_amadey_darkgate_elex_smoke-loader_stop.exe
428	2026-07-09_85217d283ef9e46b044d5ccdfe017407_amadey_darkgate_elex_smoke-loader_stop.exe
428	2026-07-09_85217d283ef9e46b044d5ccdfe017407_amadey_darkgate_elex_smoke-loader_stop.exe
428	2026-07-09_85217d283ef9e46b044d5ccdfe017407_amadey_darkgate_elex_smoke-loader_stop.exe
428	2026-07-09_85217d283ef9e46b044d5ccdfe017407_amadey_darkgate_elex_smoke-loader_stop.exe
428	2026-07-09_85217d283ef9e46b044d5ccdfe017407_amadey_darkgate_elex_smoke-loader_stop.exe
428	2026-07-09_85217d283ef9e46b044d5ccdfe017407_amadey_darkgate_elex_smoke-loader_stop.exe
428	2026-07-09_85217d283ef9e46b044d5ccdfe017407_amadey_darkgate_elex_smoke-loader_stop.exe
428	2026-07-09_85217d283ef9e46b044d5ccdfe017407_amadey_darkgate_elex_smoke-loader_stop.exe
428	2026-07-09_85217d283ef9e46b044d5ccdfe017407_amadey_darkgate_elex_smoke-loader_stop.exe
428	2026-07-09_85217d283ef9e46b044d5ccdfe017407_amadey_darkgate_elex_smoke-loader_stop.exe
428	2026-07-09_85217d283ef9e46b044d5ccdfe017407_amadey_darkgate_elex_smoke-loader_stop.exe
428	2026-07-09_85217d283ef9e46b044d5ccdfe017407_amadey_darkgate_elex_smoke-loader_stop.exe
428	2026-07-09_85217d283ef9e46b044d5ccdfe017407_amadey_darkgate_elex_smoke-loader_stop.exe
428	2026-07-09_85217d283ef9e46b044d5ccdfe017407_amadey_darkgate_elex_smoke-loader_stop.exe
428	2026-07-09_85217d283ef9e46b044d5ccdfe017407_amadey_darkgate_elex_smoke-loader_stop.exe
428	2026-07-09_85217d283ef9e46b044d5ccdfe017407_amadey_darkgate_elex_smoke-loader_stop.exe
428	2026-07-09_85217d283ef9e46b044d5ccdfe017407_amadey_darkgate_elex_smoke-loader_stop.exe
428	2026-07-09_85217d283ef9e46b044d5ccdfe017407_amadey_darkgate_elex_smoke-loader_stop.exe
428	2026-07-09_85217d283ef9e46b044d5ccdfe017407_amadey_darkgate_elex_smoke-loader_stop.exe
428	2026-07-09_85217d283ef9e46b044d5ccdfe017407_amadey_darkgate_elex_smoke-loader_stop.exe
428	2026-07-09_85217d283ef9e46b044d5ccdfe017407_amadey_darkgate_elex_smoke-loader_stop.exe
428	2026-07-09_85217d283ef9e46b044d5ccdfe017407_amadey_darkgate_elex_smoke-loader_stop.exe
428	2026-07-09_85217d283ef9e46b044d5ccdfe017407_amadey_darkgate_elex_smoke-loader_stop.exe
428	2026-07-09_85217d283ef9e46b044d5ccdfe017407_amadey_darkgate_elex_smoke-loader_stop.exe
5980	mjecwuomjhczurmj.exe
5980	mjecwuomjhczurmj.exe
5980	mjecwuomjhczurmj.exe
5980	mjecwuomjhczurmj.exe
5980	mjecwuomjhczurmj.exe
5980	mjecwuomjhczurmj.exe
5980	mjecwuomjhczurmj.exe
5980	mjecwuomjhczurmj.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe
1232	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	2800	i_pjhezwromh.exe
Token: SeDebugPrivilege	4532	i_wtomgeytrl.exe
Token: SeDebugPrivilege	5168	i_mgdywqoigb.exe
Token: SeDebugPrivilege	700	i_bvtnlgdbvt.exe
Token: SeDebugPrivilege	4536	i_dxvqkidavt.exe
Token: SeDebugPrivilege	5416	i_kicaxsqkic.exe
Token: SeDebugPrivilege	5112	i_usmcausmke.exe
Token: SeDebugPrivilege	2704	i_pnhfzxrpkh.exe
Token: SeDebugPrivilege	3048	i_bzxrpjgezw.exe
Token: SeDebugPrivilege	4444	i_zwqojgbztr.exe
Token: SeDebugPrivilege	3472	i_ywtrljytqo.exe
Token: SeDebugPrivilege	1448	i_gdyvqoigdy.exe
Token: SeDebugPrivilege	5740	i_qnlfdxvqni.exe
Token: SeDebugPrivilege	3796	i_lfdxvpnhfd.exe
Token: SeDebugPrivilege	1448	i_cxvpmkifax.exe
Token: SeDebugPrivilege	244	i_hcausmkecx.exe
Token: SeDebugPrivilege	4360	i_zwuomheczw.exe
Token: SeDebugPrivilege	3012	i_wuomgezwro.exe
Token: SeDebugPrivilege	1136	i_mgeywtroig.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1232	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 428 wrote to memory of 5980	428	2026-07-09_85217d283ef9e46b044d5ccdfe017407_amadey_darkgate_elex_smoke-loader_stop.exe	88
PID 428 wrote to memory of 2288	428	2026-07-09_85217d283ef9e46b044d5ccdfe017407_amadey_darkgate_elex_smoke-loader_stop.exe	89
PID 2288 wrote to memory of 1232	2288	iexplore.exe	90
PID 1232 wrote to memory of 5532	1232	msedge.exe	91
PID 1232 wrote to memory of 1544	1232	msedge.exe	92
PID 1232 wrote to memory of 5140	1232	msedge.exe	94
PID 1232 wrote to memory of 1544	1232	msedge.exe	92
PID 1232 wrote to memory of 1544	1232	msedge.exe	92
PID 1232 wrote to memory of 5872	1232	msedge.exe	95
PID 1232 wrote to memory of 5872	1232	msedge.exe	95
PID 1232 wrote to memory of 6120	1232	msedge.exe	96
PID 1232 wrote to memory of 6120	1232	msedge.exe	96
PID 1232 wrote to memory of 6120	1232	msedge.exe	96
PID 1232 wrote to memory of 1908	1232	msedge.exe	97
PID 1232 wrote to memory of 1908	1232	msedge.exe	97
PID 1232 wrote to memory of 1908	1232	msedge.exe	97
PID 1232 wrote to memory of 6020	1232	msedge.exe	98
PID 1232 wrote to memory of 764	1232	msedge.exe	99
PID 1232 wrote to memory of 6020	1232	msedge.exe	98
PID 1232 wrote to memory of 6020	1232	msedge.exe	98
PID 1232 wrote to memory of 764	1232	msedge.exe	99
PID 1232 wrote to memory of 764	1232	msedge.exe	99
PID 5980 wrote to memory of 4356	5980	mjecwuomjhczurmj.exe	103
PID 3676 wrote to memory of 4892	3676	pjhezwromh.exe	106
PID 1232 wrote to memory of 3816	1232	msedge.exe	109
PID 1232 wrote to memory of 3816	1232	msedge.exe	109
PID 1232 wrote to memory of 2216	1232	msedge.exe	110
PID 1232 wrote to memory of 2216	1232	msedge.exe	110
PID 1232 wrote to memory of 4472	1232	msedge.exe	112
PID 5980 wrote to memory of 2864	5980	mjecwuomjhczurmj.exe	115
PID 1232 wrote to memory of 4908	1232	msedge.exe	117
PID 1232 wrote to memory of 4908	1232	msedge.exe	117
PID 1232 wrote to memory of 3704	1232	msedge.exe	118
PID 1232 wrote to memory of 3704	1232	msedge.exe	118
PID 1232 wrote to memory of 476	1232	msedge.exe	119
PID 1232 wrote to memory of 476	1232	msedge.exe	119
PID 5980 wrote to memory of 2688	5980	mjecwuomjhczurmj.exe	122
PID 4700 wrote to memory of 3388	4700	wtomgeytrl.exe	124
PID 5980 wrote to memory of 1636	5980	mjecwuomjhczurmj.exe	127
PID 5980 wrote to memory of 5316	5980	mjecwuomjhczurmj.exe	131
PID 3580 wrote to memory of 3436	3580	mgdywqoigb.exe	133
PID 5980 wrote to memory of 5956	5980	mjecwuomjhczurmj.exe	136
PID 1232 wrote to memory of 2520	1232	msedge.exe	138
PID 1232 wrote to memory of 2520	1232	msedge.exe	138
PID 1232 wrote to memory of 2520	1232	msedge.exe	138
PID 1232 wrote to memory of 548	1232	msedge.exe	139
PID 1232 wrote to memory of 548	1232	msedge.exe	139
PID 1232 wrote to memory of 548	1232	msedge.exe	139
PID 5980 wrote to memory of 5260	5980	mjecwuomjhczurmj.exe	143
PID 1248 wrote to memory of 5640	1248	bvtnlgdbvt.exe	145
PID 5980 wrote to memory of 5104	5980	mjecwuomjhczurmj.exe	148
PID 1232 wrote to memory of 6044	1232	msedge.exe	149
PID 1232 wrote to memory of 2800	1232	msedge.exe	150
PID 1232 wrote to memory of 4724	1232	msedge.exe	151
PID 5980 wrote to memory of 3868	5980	mjecwuomjhczurmj.exe	155
PID 2856 wrote to memory of 2168	2856	dxvqkidavt.exe	157
PID 5980 wrote to memory of 1644	5980	mjecwuomjhczurmj.exe	160
PID 5980 wrote to memory of 4416	5980	mjecwuomjhczurmj.exe	164
PID 2844 wrote to memory of 1336	2844	kicaxsqkic.exe	166
PID 5980 wrote to memory of 2600	5980	mjecwuomjhczurmj.exe	169
PID 5980 wrote to memory of 2384	5980	mjecwuomjhczurmj.exe	173
PID 5080 wrote to memory of 4468	5080	usmcausmke.exe	175
PID 5980 wrote to memory of 5064	5980	mjecwuomjhczurmj.exe	178
PID 5980 wrote to memory of 1112	5980	mjecwuomjhczurmj.exe	182

C:\Users\Admin\AppData\Local\Temp\2026-07-09_85217d283ef9e46b044d5ccdfe017407_amadey_darkgate_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_85217d283ef9e46b044d5ccdfe017407_amadey_darkgate_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:428
- C:\Temp\mjecwuomjhczurmj.exe
  C:\Temp\mjecwuomjhczurmj.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5980
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pjhezwromh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4356
  - - C:\Temp\pjhezwromh.exe
      C:\Temp\pjhezwromh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3676
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4892
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3524
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pjhezwromh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2864
  - - C:\Temp\i_pjhezwromh.exe
      C:\Temp\i_pjhezwromh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2800
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wtomgeytrl.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2688
  - - C:\Temp\wtomgeytrl.exe
      C:\Temp\wtomgeytrl.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4700
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3388
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2768
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wtomgeytrl.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1636
  - - C:\Temp\i_wtomgeytrl.exe
      C:\Temp\i_wtomgeytrl.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4532
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mgdywqoigb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5316
  - - C:\Temp\mgdywqoigb.exe
      C:\Temp\mgdywqoigb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3580
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3436
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1400
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mgdywqoigb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5956
  - - C:\Temp\i_mgdywqoigb.exe
      C:\Temp\i_mgdywqoigb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5168
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bvtnlgdbvt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5260
  - - C:\Temp\bvtnlgdbvt.exe
      C:\Temp\bvtnlgdbvt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1248
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5640
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5064
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bvtnlgdbvt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5104
  - - C:\Temp\i_bvtnlgdbvt.exe
      C:\Temp\i_bvtnlgdbvt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:700
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dxvqkidavt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3868
  - - C:\Temp\dxvqkidavt.exe
      C:\Temp\dxvqkidavt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2856
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2168
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:800
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dxvqkidavt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1644
  - - C:\Temp\i_dxvqkidavt.exe
      C:\Temp\i_dxvqkidavt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4536
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kicaxsqkic.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4416
  - - C:\Temp\kicaxsqkic.exe
      C:\Temp\kicaxsqkic.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2844
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1336
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3196
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kicaxsqkic.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2600
  - - C:\Temp\i_kicaxsqkic.exe
      C:\Temp\i_kicaxsqkic.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5416
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\usmcausmke.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2384
  - - C:\Temp\usmcausmke.exe
      C:\Temp\usmcausmke.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5080
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4468
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3272
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_usmcausmke.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5064
  - - C:\Temp\i_usmcausmke.exe
      C:\Temp\i_usmcausmke.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5112
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pnhfzxrpkh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1112
  - - C:\Temp\pnhfzxrpkh.exe
      C:\Temp\pnhfzxrpkh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2800
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4704
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4708
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pnhfzxrpkh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3140
  - - C:\Temp\i_pnhfzxrpkh.exe
      C:\Temp\i_pnhfzxrpkh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2704
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bzxrpjgezw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4940
  - - C:\Temp\bzxrpjgezw.exe
      C:\Temp\bzxrpjgezw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2892
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1492
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4324
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bzxrpjgezw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4320
  - - C:\Temp\i_bzxrpjgezw.exe
      C:\Temp\i_bzxrpjgezw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3048
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zwqojgbztr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4124
  - - C:\Temp\zwqojgbztr.exe
      C:\Temp\zwqojgbztr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2900
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5172
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5200
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zwqojgbztr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2300
  - - C:\Temp\i_zwqojgbztr.exe
      C:\Temp\i_zwqojgbztr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4444
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ywtrljytqo.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3560
  - - C:\Temp\ywtrljytqo.exe
      C:\Temp\ywtrljytqo.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3456
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:760
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1564
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ywtrljytqo.exe ups_ins
    3⤵
    PID:2704
  - - C:\Temp\i_ywtrljytqo.exe
      C:\Temp\i_ywtrljytqo.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3472
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gdyvqoigdy.exe ups_run
    3⤵
    PID:4808
  - - C:\Temp\gdyvqoigdy.exe
      C:\Temp\gdyvqoigdy.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3700
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5628
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2092
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gdyvqoigdy.exe ups_ins
    3⤵
    PID:2788
  - - C:\Temp\i_gdyvqoigdy.exe
      C:\Temp\i_gdyvqoigdy.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1448
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qnlfdxvqni.exe ups_run
    3⤵
    PID:4908
  - - C:\Temp\qnlfdxvqni.exe
      C:\Temp\qnlfdxvqni.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4488
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5936
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1944
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qnlfdxvqni.exe ups_ins
    3⤵
    PID:2984
  - - C:\Temp\i_qnlfdxvqni.exe
      C:\Temp\i_qnlfdxvqni.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5740
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lfdxvpnhfd.exe ups_run
    3⤵
    PID:4572
  - - C:\Temp\lfdxvpnhfd.exe
      C:\Temp\lfdxvpnhfd.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4664
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1564
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3424
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lfdxvpnhfd.exe ups_ins
    3⤵
    PID:5768
  - - C:\Temp\i_lfdxvpnhfd.exe
      C:\Temp\i_lfdxvpnhfd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3796
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cxvpmkifax.exe ups_run
    3⤵
    PID:976
  - - C:\Temp\cxvpmkifax.exe
      C:\Temp\cxvpmkifax.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1684
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5884
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5044
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cxvpmkifax.exe ups_ins
    3⤵
    PID:3196
  - - C:\Temp\i_cxvpmkifax.exe
      C:\Temp\i_cxvpmkifax.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1448
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hcausmkecx.exe ups_run
    3⤵
    PID:4996
  - - C:\Temp\hcausmkecx.exe
      C:\Temp\hcausmkecx.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2292
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5200
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4188
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hcausmkecx.exe ups_ins
    3⤵
    PID:2476
  - - C:\Temp\i_hcausmkecx.exe
      C:\Temp\i_hcausmkecx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:244
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zwuomheczw.exe ups_run
    3⤵
    PID:5916
  - - C:\Temp\zwuomheczw.exe
      C:\Temp\zwuomheczw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3968
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2740
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1408
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zwuomheczw.exe ups_ins
    3⤵
    PID:5440
  - - C:\Temp\i_zwuomheczw.exe
      C:\Temp\i_zwuomheczw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4360
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wuomgezwro.exe ups_run
    3⤵
    PID:5896
  - - C:\Temp\wuomgezwro.exe
      C:\Temp\wuomgezwro.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2732
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5560
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3896
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wuomgezwro.exe ups_ins
    3⤵
    PID:2744
  - - C:\Temp\i_wuomgezwro.exe
      C:\Temp\i_wuomgezwro.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3012
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mgeywtroig.exe ups_run
    3⤵
    PID:3228
  - - C:\Temp\mgeywtroig.exe
      C:\Temp\mgeywtroig.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2388
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5912
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3748
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mgeywtroig.exe ups_ins
    3⤵
    PID:3944
  - - C:\Temp\i_mgeywtroig.exe
      C:\Temp\i_mgeywtroig.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1136
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x19c,0x1a0,0x2f8,0x198,0x304,0x7ffc0e35c188,0x7ffc0e35c194,0x7ffc0e35c1a0
      4⤵
      PID:5532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1696,i,3708356313058838180,11938531948079642634,262144 --field-trial-handle=2352,i,17117249599855814114,12650657117372995352,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:2
      4⤵
      PID:1544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1924,i,17031727015182051343,15702502803657952684,524288 --field-trial-handle=2352,i,17117249599855814114,12650657117372995352,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:11
      4⤵
      System Time Discovery
      PID:5140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2432,i,2975893045197516327,15864826152039330999,524288 --field-trial-handle=2352,i,17117249599855814114,12650657117372995352,262144 --variations-seed-version --mojo-platform-channel-handle=3196 /prefetch:13
      4⤵
      PID:5872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3592,i,6377889304380519683,8693192840816564078,2097152 --field-trial-handle=2352,i,17117249599855814114,12650657117372995352,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
      4⤵
      PID:6120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3596,i,2154782203399407025,11240117194368434001,2097152 --field-trial-handle=2352,i,17117249599855814114,12650657117372995352,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
      4⤵
      PID:1908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,14887713336269739063,12947014238151901697,2097152 --field-trial-handle=2352,i,17117249599855814114,12650657117372995352,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:1
      4⤵
      PID:6020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,14011583374524622213,15766339334839634810,2097152 --field-trial-handle=2352,i,17117249599855814114,12650657117372995352,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:9
      4⤵
      PID:764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,6081573494669150109,17493373172747730214,524288 --field-trial-handle=2352,i,17117249599855814114,12650657117372995352,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:14
      4⤵
      PID:3816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5456,i,9987092269174094975,1164110465431075376,524288 --field-trial-handle=2352,i,17117249599855814114,12650657117372995352,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:14
      4⤵
      PID:2216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,9800324547834475313,14543154875363960573,524288 --field-trial-handle=2352,i,17117249599855814114,12650657117372995352,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:14
      4⤵
      PID:3644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,9800324547834475313,14543154875363960573,524288 --field-trial-handle=2352,i,17117249599855814114,12650657117372995352,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:14
      4⤵
      PID:4472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,13769632687907440329,10395478102898467952,524288 --field-trial-handle=2352,i,17117249599855814114,12650657117372995352,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:14
      4⤵
      PID:4908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6636,i,14776916020892189450,13714975902496930068,524288 --field-trial-handle=2352,i,17117249599855814114,12650657117372995352,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:14
      4⤵
      PID:3704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6660,i,1838791085154357618,10521958210997723622,524288 --field-trial-handle=2352,i,17117249599855814114,12650657117372995352,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:14
      4⤵
      PID:476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6192,i,6185177545153623073,14081306932485173604,2097152 --field-trial-handle=2352,i,17117249599855814114,12650657117372995352,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:1
      4⤵
      PID:2520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3676,i,4950480903196408095,2150489955576189725,2097152 --field-trial-handle=2352,i,17117249599855814114,12650657117372995352,262144 --variations-seed-version --mojo-platform-channel-handle=3896 /prefetch:1
      4⤵
      PID:548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4240,i,2276866410715055000,14726316750220748060,524288 --field-trial-handle=2352,i,17117249599855814114,12650657117372995352,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:14
      4⤵
      PID:6044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6764,i,13351305789819813192,10998600835987413509,524288 --field-trial-handle=2352,i,17117249599855814114,12650657117372995352,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:14
      4⤵
      PID:2800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6700,i,8195229730978587307,17575941798959447545,524288 --field-trial-handle=2352,i,17117249599855814114,12650657117372995352,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:14
      4⤵
      PID:4724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5652,i,11712669458005640801,6122987944190144754,524288 --field-trial-handle=2352,i,17117249599855814114,12650657117372995352,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:14
      4⤵
      PID:2156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,13262618661765274042,17376294286735042510,524288 --field-trial-handle=2352,i,17117249599855814114,12650657117372995352,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:14
      4⤵
      PID:1836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,2310106407834404973,15575715711387353491,524288 --field-trial-handle=2352,i,17117249599855814114,12650657117372995352,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:14
      4⤵
      PID:5912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,6907610285346868508,13472965382557343300,524288 --field-trial-handle=2352,i,17117249599855814114,12650657117372995352,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:14
      4⤵
      PID:4208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4816,i,6938566036291250453,919579118485689285,262144 --field-trial-handle=2352,i,17117249599855814114,12650657117372995352,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:10
      4⤵
      PID:2196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6440,i,10503480500402511092,7501479688783274989,524288 --field-trial-handle=2352,i,17117249599855814114,12650657117372995352,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:14
      4⤵
      PID:3796

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1112

C:\Temp\mjecwuomjhczurmj.sys
C:\Temp\mjecwuomjhczurmj.sys
1⤵
- Executes dropped EXE
PID:3168

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5460

C:\Temp\jhbztrljhb.sys
C:\Temp\jhbztrljhb.sys
1⤵
- Executes dropped EXE
PID:256

C:\Temp\wtolgeywqo.sys
C:\Temp\wtolgeywqo.sys
1⤵
- Executes dropped EXE
PID:2680

C:\Temp\gayvtnljdb.sys
C:\Temp\gayvtnljdb.sys
1⤵
- Executes dropped EXE
PID:1252

C:\Temp\lfdxvpnifd.sys
C:\Temp\lfdxvpnifd.sys
1⤵
- Executes dropped EXE
PID:1564

C:\Temp\qkifaysqki.sys
C:\Temp\qkifaysqki.sys
1⤵
- Executes dropped EXE
PID:912

C:\Temp\pkifzxvsqk.sys
C:\Temp\pkifzxvsqk.sys
1⤵
- Executes dropped EXE
PID:4228

C:\Temp\pmkecausmk.sys
C:\Temp\pmkecausmk.sys
1⤵
- Executes dropped EXE
PID:2088

C:\Temp\hezxrpjhcz.sys
C:\Temp\hezxrpjhcz.sys
1⤵
- Executes dropped EXE
PID:2568

C:\Temp\hbzwjhbztr.sys
C:\Temp\hbzwjhbztr.sys
1⤵
- Executes dropped EXE
PID:5488

C:\Temp\bztrljebzt.sys
C:\Temp\bztrljebzt.sys
1⤵
- Executes dropped EXE
PID:5552

C:\Temp\bywqoigayt.sys
C:\Temp\bywqoigayt.sys
1⤵
PID:2756

C:\Temp\tqlidxvqnl.sys
C:\Temp\tqlidxvqnl.sys
1⤵
PID:2968

C:\Temp\nlfdxvqnif.sys
C:\Temp\nlfdxvqnif.sys
1⤵
PID:4736

C:\Temp\kfdxvsnkif.sys
C:\Temp\kfdxvsnkif.sys
1⤵
PID:912

C:\Temp\fcxusmkecx.sys
C:\Temp\fcxusmkecx.sys
1⤵
PID:2680

C:\Temp\cwuomhezxu.sys
C:\Temp\cwuomhezxu.sys
1⤵
PID:4436

C:\Temp\zwuomgeywr.sys
C:\Temp\zwuomgeywr.sys
1⤵
PID:2832

C:\Temp\bwuomgezwr.sys
C:\Temp\bwuomgezwr.sys
1⤵
PID:5484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bvtnlgdbvt.exe

Path C:\Temp\bvtnlgdbvt.exe
Size 384KB
SHA256 1350f3134d790e69a03be19886d9ff4f2a93743c571ba16688041139a6d5198d
MD5 36d7e6540fee4dbb5488fa02863f4b1e
SHA1 e879694e9e30075309c617834f0acfec2c47e045
SHA512 944077cbeb40b26b13d70f6cc0fe42beb1628efc3b3c424e165829f10e471b0249ce1f87e3fca89b282c40001b17119aa0fb9d9e40786f89d6b310df6389baf0
SSDEEP 3072:jbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:jbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T151847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxvqkidavt.exe

Path C:\Temp\dxvqkidavt.exe
Size 384KB
SHA256 57b94f4069ee42c62b32c3f2a9036be06e7327ad83d2ba6be2b75251d8109a6a
MD5 3f2e52a120805f22153b53f61425f7ac
SHA1 256f84b6149ad51d292fd8893e54d533d942b8d4
SHA512 dd939e1bf7ded171199c89486730a662443abda39cc1464fc152f22be02d08b313d6c892482b3ae7a29557b0710e8d1d17d3f3e7b47a79073f9c55b10d47f5b9
SSDEEP 3072:ebtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:ebtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B9847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gayvtnljdb.sys

Path C:\Temp\gayvtnljdb.sys
Size 293KB
SHA256 adcdd09b059e245f0503cca62ec4c912740af680467c645d63b13406456fdfa1
MD5 58226481c43a31e89e7bbdf60d6e1321
SHA1 8709831134d9e76fb689037e91d39326274e0ab7
SHA512 5075cdc011d0582ff006d5b4bba7670560e16c5183ba88b5b405450ef5200f1716b8fe5ffd04f69ddca71d3dda3de7180c53c8a60ddc698614278b5f439e9a16
SSDEEP 3072:vtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:vIJjiJcbI03GBc3ucY5DCSj
TLSH
T16A545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bvtnlgdbvt.exe

Path C:\Temp\i_bvtnlgdbvt.exe
Size 384KB
SHA256 5460daf78985b95155ec4b7d676e14f569df2e58b953ea2ea58fdeb693b7dd6e
MD5 ee9b21cf83a667a27b1d34f0d03353cf
SHA1 15ec7a77565ce1ec25bf77921e885e382a20c7dd
SHA512 b4bc3c155a22175fd6078855eb136d0d1aae69643b4439c70d5674cfe9f9df4ef085bd16235cea00565d89010e6bed45a67632734ebec9f480bc8192c69dc0c0
SSDEEP 3072:ybtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:ybtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C4847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dxvqkidavt.exe

Path C:\Temp\i_dxvqkidavt.exe
Size 384KB
SHA256 814f6e024131d1cc0e36be164f444f9b6d20447c328a1de6a40a52cdb0a0a204
MD5 96b4c50abaad3916f1152a48aa287dff
SHA1 3453590df254b0dc70f203325744fb02fcf1d1d6
SHA512 a8a3eaca59efc15991e8cdcc4bdaf619e5ea7801d2b2fe04b01e3a26b169868a2924fbf7f11c8fbc7e8b08c6347647388b0e3e5b47423780e4ad069ab2c2c8b2
SSDEEP 3072:dbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:dbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C8847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mgdywqoigb.exe

Path C:\Temp\i_mgdywqoigb.exe
Size 384KB
SHA256 b399bc979d6234f96279b090cca8124b9b29e8d8c0b865c1385526374e47254f
MD5 f913b35e11bff94f67f2c03eb4109726
SHA1 2fe92e55a2918e53f878ec6ee3d534bd993725d8
SHA512 785d70fbf514ad1baef3f1e2c19ae4e38c582707fc33a0477e053689f5596dda88a06421adf2d7acf3e3a26b8e91d47d92c4846c703165afa5a10a4ee4af938b
SSDEEP 3072:rbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:rbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T114847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pjhezwromh.exe

Path C:\Temp\i_pjhezwromh.exe
Size 384KB
SHA256 86fcfea9586a500c59d15d498f62fa9ce776a1bb86859b4a518f2ec8c85eb5e2
MD5 187cf8c7b48486ab14b4ff448981aa1f
SHA1 11bbbe4b546bc234cd89fc896f1b656f057f1360
SHA512 85cf04a2f7ddc59ef2173611e0119d03cd411784f8954742b2a62bfd2f58724475de3d331f940c099f160fb3851d0d88ddd45245c768fbbce9ca08d4b304b16b
SSDEEP 3072:3btF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:3btt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1DF847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wtomgeytrl.exe

Path C:\Temp\i_wtomgeytrl.exe
Size 384KB
SHA256 97d2994bc866b18cac0ea6dbfe9eb5753ad491dc91a37eacee3daf98b733a219
MD5 6b90115ba3c5145e226bb88476ef17a9
SHA1 c34fe425ede4efce7ce6a5993f07eb4b4e5e4c4f
SHA512 04f12c1583c1d6556091bc9bf85991c41b1a7db7a6b6113046c37efd98985ba2ce55217860bb76076c52b6e23511e33801f0a0d24f9c5cbf90ae4e51a49b5617
SSDEEP 3072:KbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:Kbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T141847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC3F754CE5D9A517C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhbztrljhb.sys

Path C:\Temp\jhbztrljhb.sys
Size 293KB
SHA256 05b5091a92eb85b69b8ac77e4238003c548eae69b15d2ca396511ba984beed13
MD5 53ee7723cc396ec106163ee0d9042d1d
SHA1 2b2b20c7293e8b38afaad93980f2432434550de3
SHA512 716b4e978358bbfdf1a61be6965bee6d3d4d44e845e00e5d5aee8cb517334d89548394af2e22fd67053efd54ffc72ee3ddabd141aceb03d45dd0fac226b1098d
SSDEEP 3072:2tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:2IJjiJcbI03GBc3ucY5DCSj
TLSH
T191545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kicaxsqkic.exe

Path C:\Temp\kicaxsqkic.exe
Size 384KB
SHA256 695a4f404538c0c776b85257f0c5a05f99d3df424756d01905bb51bdf776db21
MD5 cee133fa5ab4a88b97eddcd3a647dbb6
SHA1 0e15836414979fee22ebb4a657f0b6ac4261a245
SHA512 6e6373d4b523c4e797a5f408654b4112e00165321e80e4a5b5b24380f500b2d74f8eda2eadae2f6c1862b973fd61debe772c15dc671a58cba2e177e5747802c5
SSDEEP 3072:wbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:wbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1DF847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lfdxvpnifd.sys

Path C:\Temp\lfdxvpnifd.sys
Size 293KB
SHA256 8ef365d8c0398f0514525f39375e16d266259cf1e7a5397bf2164cae5ddf1cab
MD5 c50337a906ab39cc25e52b4a78d8756c
SHA1 7eba0e2459678cfc6e9144210b35334294abfef0
SHA512 9bb6425375bbfeba74e91e32ca2264d3d3cad91abb58f8fe9ce378ac8dc58984e38b82ad57530b7570ff67a3d1068089aa371ddd3903ff1652630294df9b897a
SSDEEP 3072:3tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:3IJjiJcbI03GBc3ucY5DCSj
TLSH
T17C545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mgdywqoigb.exe

Path C:\Temp\mgdywqoigb.exe
Size 384KB
SHA256 3bb006a28f008c16c60a5b35e9d5a5ed973c8490dc5fe32af584048700b40298
MD5 3ded965f430337faa09ead2307808840
SHA1 7887da8ffa5a28d9f343c938aff91c6afac04dba
SHA512 5cce09a76f1d8b1bb1365d7737f3b53e6fb92958dd83335221d5cb2deb5f7757f29d2425104db2852f37a08b896f50ebc3ab18e8b8713ce43994aa3af7b0633e
SSDEEP 3072:tbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:tbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T176847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F354CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mjecwuomjhczurmj.exe

Path C:\Temp\mjecwuomjhczurmj.exe
Size 384KB
SHA256 77b0de4697ee2225677ceba30a844c729ebbf377c779623709e91d9a62903edc
MD5 aa7f800d88ae97da96fd9e445317b6ea
SHA1 468118300e895f59ed33739a80ef1040fa79cb78
SHA512 6da95ca7bc2bc08695e0df34c1b3a6091f9aa29c395796a062c67fb6e96ac295c8212cd19f716927bbc510d7a6b5313b446635e51ff1fc505a3e5b11ab8f2776
SSDEEP 3072:CbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:Cbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T104847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mjecwuomjhczurmj.sys

Path C:\Temp\mjecwuomjhczurmj.sys
Size 293KB
SHA256 68097c523b4710142c2931c746569d6b178aa7c3523b1c22233f63d20ef0fbf6
MD5 061cf850831af1305821cfec820649e1
SHA1 53ba8cc479654e1d6df7e5c8c4fe35f9e69f182c
SHA512 01b2e98671f00010ecaaf74afa3eb4b0f161b8d3964dfdae3d089473b34cf3609790dba2598ca3c119df06d188a8623f24623c0a7633e37e035f9849ecf40947
SSDEEP 3072:CtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:CIJjiJcbI03GBc3ucY5DCSj
TLSH
T1C2545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pjhezwromh.exe

Path C:\Temp\pjhezwromh.exe
Size 384KB
SHA256 3b85f3a628b6d7156822dbd01a828e1e3286f5f70eee5d8c2f2576b155dc9cd2
MD5 a8ac3006f034978d64724866f3c1e600
SHA1 d73d7c4e26d8841712d4668903054f61bdd07f2b
SHA512 1f14e9ff14999fe5b79c08229f2ea5a78390e3cd2da183ffa419c5557d13b802031a054d56b009f27253e97e5a60c95dc9992cf98bf2d63d1276b39138938642
SSDEEP 3072:lbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:lbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T195847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F354CE5D9A517C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qkifaysqki.sys

Path C:\Temp\qkifaysqki.sys
Size 293KB
SHA256 31377cc516142b5e025f5ae9bb2737d162cea328490a78c62c63196344b73149
MD5 f7c435e92dac083ba3454d70587a390c
SHA1 b66dfeda54f0d38c795b509dde30935dcedc899e
SHA512 fb7e99df8b405c47fda29c3065463ed2b575990efea08e6c2b8da3ed2b576c45e40ff3a91ea48d4a928eb085053302c116e2f200f0be3f7d1b6231e24c94758b
SSDEEP 3072:BtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:BIJjiJcbI03GBc3ucY5DCSj
TLSH
T169545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wtolgeywqo.sys

Path C:\Temp\wtolgeywqo.sys
Size 293KB
SHA256 d3ecd39530af67de39adde52a522c1e640bc50ee467066d84624a0af11575b83
MD5 47986d2bfe9a21d089500eb29b407b22
SHA1 19756456c5fdfc07e3d119b7ca63692d7e62c7bd
SHA512 b9633ec56d3ede81f272171243932871e272e9b2ab9637421cff018d95850de519d7a307a1a45939e4e2c8b300b45d33d25b63878057f004c6188f5932f9e3f3
SSDEEP 3072:CtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:CIJjiJcbI03GBc3ucY5DCSj
TLSH
T1FF545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wtomgeytrl.exe

Path C:\Temp\wtomgeytrl.exe
Size 384KB
SHA256 7e6e2484a8c102636d05d09b295623cced1b88bf3615eaea9d4f011a51789be6
MD5 a8e65eebdb245f6eef1515d42abf9014
SHA1 cc471337a54bafae9ddfa44486e97e2bd62aafc6
SHA512 b4329189566fa8d20b0e7ae15b0e2e2053a9e4d9a2f7b7f4eab3472bd04674f91d5d0747dcc974bd01b1ac52c1e45346fd8280bc998a1d670a3cfe5724c7c87a
SSDEEP 3072:ibtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:ibtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T165847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f2f36159b1a73a0ea0e59f51f1f373932375016885fcf17933887e7d1b2c3016
MD5 2dd00ee0ca93975f2038728e856681d5
SHA1 24fcfdb6befe18bca66bab129cd0fba4ad709e15
SHA512 d734e4919f2bc11b3e1a733c99b812ac0c7d2d76c45401d957b2b60a896b0bfc172f211ec13501d83d82cd3445e59aa5e9e4a25b2d71ff9d2f99bdb12460b4e4
TLSH
T10FD09BE56640D94DC58020721593D555F5705931D40553C85101B43DDC952C703574DB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 99348710dfa24f06e3cc9e5d66d99b450d2606932193b821d1cccbb1b0382494
MD5 99dd082560f2d99883b896493c6f1a16
SHA1 8c1328ed9b1727d8e368914ffd96b9d8d9882e17
SHA512 2eac54e4bf6c56c6a86be1ac66b75e47cf5afa02dca24674366691d2eae08e023308cf9c0e790eecff6d37160a3b4bc6aa0d7b2cbe2bf4b7074898f149ff8bfb
TLSH
T11DD09BE56640D94DC58020721593D555F5705931D80553C85001743DDC952C703574EF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4db1caa6e9ce38249057ccf1d927c6fab3e3028358cf9cff4cfdc0745a7cebc4
MD5 19c23b3cb3a981d58c7b5e77663bdeac
SHA1 99003ab628f9591053692a8f3f56d0d32deebcb9
SHA512 776bc0217ef3af818512ca35b4270b0f6d149582d4cef8be382fbd4fd42af705b6b3360ad509fdce97b17b4595e1664225315ab6490ab7e959fc2f6426533b43
TLSH
T12F615D7683754BF2CB95EE7D0DE10489BAB3881622037E125DB8A3748C7E7449083730
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe598330.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe598330.TMP
Size 3KB
SHA256 5d64ddbbfdb9cfe557f077a69564d318873c742fd8e3ef76e5559c4b171f53fd
MD5 917dd8da0190f4cbcdaa88b143ca143a
SHA1 c0bdf72f8631fb608fbfa2ca6e5aef4429227af5
SHA512 c7f3b2ef50b28b47576f828f14f6db3154308295e6d9dbcf71ec7d411ca22489a10ed5decfa32b54e8635404565a6a9de14c7ef786921b056c69104655778c2b
TLSH
T110613D7683754BF2CB95EE7D0DF10489BAB2885622037E125CB8A3748C7E7449493730
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 537f222adc5f5cda80eeb4273f6a2dbf0cb6e389f37cdfd6ec955dc164a00c51
MD5 885d75c8229b2f2e77f4cc34c92353e2
SHA1 c018a85403ab8c81b210c3cba6a182b489306b96
SHA512 2d9110047954556261635b102a20ce01c4041a7dc93abd8495d9862d948c2460bd3c42504f529070219d7f0d4c61c3e79be80383f5ce18d39d81c661a50ef0ba
TLSH
T12B51DFF3C3E4866DC91186F0BA187E2BCE2D0915432C3D5AC9E4AF1B93E2871E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 c5f5883bc71aa93965de95bf9d8018388832457394e4944b828c26caaf1750a8
MD5 c6f77214b733309b67f40345ecea0369
SHA1 a4618f2d3be3a1c3361c959688be116901297191
SHA512 6e507c0d95897e9902db94099b69419aac90e8eeb0d1b76ea25081bd44386e54b2eb2e3fddb5d0b060a35804a08257b9f6673ce1cde6eec3105e3925ea4c3c70
SSDEEP 192:sxRyR8yM/jK1Ml8wCx/fQsgLupioMhzoA8pi/g6+WNIYPhdl/G2IgtJ:sxRya8x/fQsgyUnci/5IGV3
TLSH
T10752CA156A34997B8CDBD20DFA51BF53D6F81563A2901E44AAFCCB0C01E76DD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 8c894fde7606e875790b14903f160afb64fa54131cb1935e9a39e65d5d237aad
MD5 9e563763abb777e8f6da8fe12b72fb34
SHA1 500b48fd382a4be8472be3317f977cd16418617a
SHA512 1603f09e389bd6a239b95d6d9ff639ba1e100bacfc0a43f976140ee70872af04e01b16e6bd64ff82b4563d1f7f847e07624b13e625a8eab6b8612d7bf92edd5a
SSDEEP 192:sxRNR8yM/jK1Ml8wCx/fQsSLupioMhzoA8pi/g6+WNIYPhdl/G2IgDSJ:sxRNa8x/fQsSyUnci/5IGVK
TLSH
T13362BA166A34997BCCDBD20DFA51BB53D6F81563A2901E44AAFC8B0C05E76DD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 8f7540a0a72ea114498db2f3ef410925d53cbfd90115c6c4332c96de6c5883a0
MD5 ad05c6d059e1d592e337103dc71b4d21
SHA1 fa085eb40d3f53fa9d96e5e5c111ca867cfe3caf
SHA512 22b341921f80b592f3807d9e5281c0237050c1f7e5cb9151d4dcf532884e5e84b9f4a5d7c63cb3bd7d0b08a3f1a7e3623178b9609d6779eb0a91ec82dc712a3d
SSDEEP 192:sxRNR8yM/jK1Ml8wCx/fQsSLbmZFszoA8p9c/g6+WNCmGi/YPmGdl/G2IgDEJ:sxRNS8x/fQsSXQFd2/5VD/xcVU
TLSH
T1C162D916AA24997B8CDBD20DFA51BB53D6F85573A2501E44AAFCCB0C01F76DD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 a8ea44591bf9eb6cba04f901c8fd0b99272f9d9fcb45bb2c283ec2ea2e0acaff
MD5 31e89d85ab630c51cabcf4fd31088148
SHA1 a7ad8453dcae92bc37b0741f381988380858696c
SHA512 67aecc7ffc57bf528527448829a6f667b1e87299cbd8541e729f13aa718d8079e53d18eb5d911dfb817510799001fd8809a62f7986d02fdc485860ca760ce8d9
SSDEEP 192:sxRNR8yM/jK1Ml8UQMCx/fQsSLbmZFszoA8prc/g6+WNCmGi/YPmGdl/G2IgDEJ:sxRNSqrx/fQsSXQFdI/5VD/xcVU
TLSH
T1C362D916AA24997B9CDBD20DFA51BB53D6F85573A2901E04AAFCCB0C01F76DD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 4be147d5bd20a44b6a09640065fbccfa2658496ca38494871f2ba3e30f464563
MD5 3837be47b1f37ba9ebe368ffd1e1a1ee
SHA1 432aa73edc19b137899bb16fea27bf74ab5113fa
SHA512 4d033979956f9aa451c8e479ec5968636451aefd05ccfc3caea5c1c22a01387b06b5913314e6c3adf2b6e48b9ac1a4bb06fe5a5e4fa92a2ad39509efcca9d22e
SSDEEP 768:5+McBM7pLuL7MpWgFZfsl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEofj/eMroVX8y:5+McBwE7MpWgFZfslu1jajofTeXVXt
TLSH
T1B6E2EC3B680CCB7F4F804ADCEC29B99A6DD801CF9698C95447FA841C03C66EB56175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a1f80.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a1f80.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 8f65366a334cc6af6666bb52b1c0034f7730f67579eaead9445947255f7f130a
MD5 2a529d36d74d9eb12d1eaf7c28e777ed
SHA1 a7b52320bb8dd3380f22167c8d3d6dd5719b8447
SHA512 60f1537c3687b2adeb56d4b1a75a5d1ddb06f9ee2570902143d3be141e5ab8c3a30ba6fc423b61ff775dc94dcdebce2a7d353274a65222aad65f29573898455a
SSDEEP 768:EYrv+4UNbdq3UrTJGkMf5eSC5sy5WFbxsz56f0+ynob7Uixo:EYbsbs35flCyy5WkQ5HUt
TLSH
T18713C031A8298DB35EF7D648F24776837FB825A3D5C10E98C9ED670C499749E270B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 942fb745e76c081db4240053c54c8c5eb7c4205465db04c61f68db4b0b0f814f
MD5 33098716d705b44b27086995bb854d1f
SHA1 7bbf5341e436c0823bc6d48425655e76e1762f15
SHA512 7501b1aafdc92157fe0480c31f837a0cbfc43d05fa5cac955ff280acbae06d5dd9a78c4239e00411d8570845cb14bfae7088bec57a1f905328cf11cd2bacbf4d
SSDEEP 768:E9rv+4UNbdq3oLTJGkMf5eSC5sC5WFbxsz56f0+ynob7Uixo:E9bsbs3VflCyC5WkQ5HUt
TLSH
T13A13C031A8698DB34EF7D548F2477683BFB815A3D5C10E98C6ED670C098749E270B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 4e6e860eefb178c5d1d2a53ff3a9c5eb78814db62a9a2a8b6611518e36a71646
MD5 202c168327ed3cba31e9dba865677296
SHA1 0b7155601dc524bb53f6ced432371e20bdfacce5
SHA512 6cbd8f1324ba77003b4e3ce0fb7e6561f0f3eaea1f02a3fd21c85abd5d1a22f5d245ab741d72c7a16d4fccb5750a897e68992091b339289da9c3db64e5a529e4
SSDEEP 768:27FKj+953Ywg7Jmif5eSC5sl5WFbxsz56f0+ynob7b9MrT:27953KflCyl5WkQ5Hb+rT
TLSH
T1D61339F598D389B7D9AE8787A33E6E469EBCC163B5841884B7D85D0CCC825BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 c07ecb048903cedcb7dd5b42316d7746d5e62fea3398347176857c4d8bed60bf
MD5 993001c10233d89f0a275d07aa647ac9
SHA1 6815714e4493c67114508523f72c0a0d2464c8cd
SHA512 a96c47805154127e3ec233de911d3dba25f57f245ae07ef13f7ebe57cacfa8c7c6f7d6298d39daa2aebbd6781ef3cbb79deddc2ed6265ce1b01f88c3dcf4cc03
SSDEEP 768:uOj+9o3wLTJGkMf5eSC5sC5WFbxsz56f0+ynob7b9MrT:ut9o3tflCyC5WkQ5Hb+rT
TLSH
T1C9F2CF31AC168DA34DE7DA98F2573B87AFF415A7D6C00D88D6EDAB0C0983A9D5307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 c0037e85177272942b202210d83199d2fb8e57fecdc81b27ef525effbd2d32ca
MD5 33361db1ba7c71a4eaa3e6ffe5d0f756
SHA1 3f1995b65823d9095150dadb4ec995ee324e034c
SHA512 03cab3507b5d603ffaee77a3225f46d491ad6a38c5df5d1516fcec7857f7d53561243e8c3128da4ed9494be4de5deab37eec784ef8700c11da0e6262190b219a
SSDEEP 768:Dirv+4UNbdl3DvXvJGkMf5g5WFbxsz56f0+ynobbUixK:Dibsbr3b0fe5WkQ5nUX
TLSH
T12C03CF36E86489B78EF7D689B24B76477FB81163D6C10E84C9ED3B0C469B49D2307863
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

468227de-2351-4cad-b9a8-fcd934932f12.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\468227de-2351-4cad-b9a8-fcd934932f12.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1232_1902760138\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 f6a3b504c84c837e6db5f92a16f8b673aa77ed21b90203f5830dcf079bcc5db2
MD5 88cccb1012fe0baf90977a60db36c934
SHA1 4f344e5465241bab86b5b5f89abaef7538880c22
SHA512 9228d8783b43a5fbd7f53df6a61aed8d341888b1d5442d2964a92a02afefe56418bf17db1147a34f245a614d04c5d04bb82da9087bfffb9d5e840f19eba17d6a
TLSH
T11971238357B9CAB3C1DA5BF102835248F1FF22384B6330240B955597AB30B7E58B8F08
MD5 SHA1 SHA512 TLSH

Submit Download

memory/256-192-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/912-313-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/912-445-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1252-267-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1564-291-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2088-333-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2568-350-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2680-456-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2680-231-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2756-403-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2756-421-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2832-481-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2968-420-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3168-61-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4228-329-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4436-477-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4736-441-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5484-506-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5488-370-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5552-383-0x0000000000010000-0x00000000000AB000-memory.dmp

Download