systex | ed8ead0d1a5ed0d29b7ca5bc363cc20b82ff6f378ac5dffec3fa12742b84153f

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 10:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_ed5021daf447d6e62b8e4861a8a268ed_amadey_darkgate_elex_smoke-loader_stop.exe
Size 384KB
Sample260718-l6bc1aa18z
SHA256 ed8ead0d1a5ed0d29b7ca5bc363cc20b82ff6f378ac5dffec3fa12742b84153f
MD5 ed5021daf447d6e62b8e4861a8a268ed
SHA1 229642961b0c6895d1c3fca9b4c988e58e157a55
SHA512 71b0f44695235873fdbd58b434ff6bff1d922aa320cdd42c41ac94a6ddad67a053976649e8439f3a914fa7e995596fcfd624c5d74aadff64bc58e5ce78f35330
SSDEEP 3072:p89ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9u:octFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T14C847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
1840	usmkecxurmkecwus.exe
2592	usmkecxurmkecwus.sys
2196	CreateProcess.exe
2468	zusmkecwup.exe
5128	CreateProcess.exe
2424	CreateProcess.exe
1332	i_zusmkecwup.exe
2880	gezwromgez.sys
5364	CreateProcess.exe
4516	bwurmjeczu.exe
5136	CreateProcess.exe
5456	CreateProcess.exe
1512	i_bwurmjeczu.exe
1288	ebztromgeu.sys
1420	CreateProcess.exe
5356	wtrljgbztr.exe
5336	CreateProcess.exe
2076	CreateProcess.exe
2916	i_wtrljgbztr.exe
4904	wqoigbytrl.sys
5392	CreateProcess.exe
4444	qljdbwtjdb.exe
3100	CreateProcess.exe
3156	CreateProcess.exe
1332	i_qljdbwtjdb.exe
5840	igaytqlidb.sys
1408	CreateProcess.exe
3408	dyvtnligay.exe
2272	CreateProcess.exe
5832	CreateProcess.exe
688	i_dyvtnligay.exe
1728	vsnlidavsn.sys
5828	CreateProcess.exe
3664	snkidxvsnl.exe
2028	CreateProcess.exe
4904	CreateProcess.exe
3976	i_snkidxvsnl.exe
5972	vtnlfdxnhf.sys
1544	CreateProcess.exe
4828	pnkfdxusqn.exe
4816	CreateProcess.exe
1652	CreateProcess.exe
1704	i_pnkfdxusqn.exe
4600	usnkfcxvpn.sys
5652	CreateProcess.exe
5856	smkicausmc.exe
5896	CreateProcess.exe
1332	CreateProcess.exe
3612	i_smkicausmc.exe
4648	mkhczurpkh.sys
4972	CreateProcess.exe
5372	ecwuspkhcz.exe
6124	CreateProcess.exe
5868	CreateProcess.exe
3344	i_ecwuspkhcz.exe
1608	zxrpmhezxr.sys
1480	CreateProcess.exe
3452	xuomhezxrp.exe
1196	CreateProcess.exe
1812	CreateProcess.exe
1376	i_xuomhezxrp.exe
1524	wurmjecztj.sys
4320	CreateProcess.exe
4556	omjhbzwqol.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5660_1200614269\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5660_335983763\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5660_335983763\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5660_359878062\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5660_359878062\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5660_462365890\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5660_1200614269\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5660_359878062\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5660_359878062\office_endpoints_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zusmkecwup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dyvtnligay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnkfdxusqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omjhbzwqol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlfdxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smkicausmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omjhbzwqol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnkfdxusqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwuspkhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdavtnlgdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	daysnlidav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpkhcxupn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urljheywro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-18_ed5021daf447d6e62b8e4861a8a268ed_amadey_darkgate_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtrljgbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snkidxvsnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtolgeywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdavtnlgdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmkecxurmkecwus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dyvtnligay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cxvpnhfzxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpkhcxupn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zusmkecwup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtrljgbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snkidxvsnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwuspkhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomhezwrpm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwurmjeczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qljdbwtjdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkicausmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xuomhezxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xuomhezxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtolgeywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlfdxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxvpnhfzxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwurmjeczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qljdbwtjdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_daysnlidav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomhezwrpm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urljheywro.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5076	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1076	ipconfig.exe
2992	ipconfig.exe
3284	ipconfig.exe
4732	ipconfig.exe
1684	ipconfig.exe
5988	ipconfig.exe
704	ipconfig.exe
5376	ipconfig.exe
4452	ipconfig.exe
2960	ipconfig.exe
1708	ipconfig.exe
2572	ipconfig.exe
1272	ipconfig.exe
3308	ipconfig.exe
3424	ipconfig.exe
2760	ipconfig.exe
5528	ipconfig.exe
1728	ipconfig.exe
2592	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134288429074188866"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{F6EFA33E-5444-4DF9-AFA6-AB145ABB8A84}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4544	2026-07-18_ed5021daf447d6e62b8e4861a8a268ed_amadey_darkgate_elex_smoke-loader_stop.exe
4544	2026-07-18_ed5021daf447d6e62b8e4861a8a268ed_amadey_darkgate_elex_smoke-loader_stop.exe
4544	2026-07-18_ed5021daf447d6e62b8e4861a8a268ed_amadey_darkgate_elex_smoke-loader_stop.exe
4544	2026-07-18_ed5021daf447d6e62b8e4861a8a268ed_amadey_darkgate_elex_smoke-loader_stop.exe
4544	2026-07-18_ed5021daf447d6e62b8e4861a8a268ed_amadey_darkgate_elex_smoke-loader_stop.exe
4544	2026-07-18_ed5021daf447d6e62b8e4861a8a268ed_amadey_darkgate_elex_smoke-loader_stop.exe
4544	2026-07-18_ed5021daf447d6e62b8e4861a8a268ed_amadey_darkgate_elex_smoke-loader_stop.exe
4544	2026-07-18_ed5021daf447d6e62b8e4861a8a268ed_amadey_darkgate_elex_smoke-loader_stop.exe
4544	2026-07-18_ed5021daf447d6e62b8e4861a8a268ed_amadey_darkgate_elex_smoke-loader_stop.exe
4544	2026-07-18_ed5021daf447d6e62b8e4861a8a268ed_amadey_darkgate_elex_smoke-loader_stop.exe
4544	2026-07-18_ed5021daf447d6e62b8e4861a8a268ed_amadey_darkgate_elex_smoke-loader_stop.exe
4544	2026-07-18_ed5021daf447d6e62b8e4861a8a268ed_amadey_darkgate_elex_smoke-loader_stop.exe
4544	2026-07-18_ed5021daf447d6e62b8e4861a8a268ed_amadey_darkgate_elex_smoke-loader_stop.exe
4544	2026-07-18_ed5021daf447d6e62b8e4861a8a268ed_amadey_darkgate_elex_smoke-loader_stop.exe
4544	2026-07-18_ed5021daf447d6e62b8e4861a8a268ed_amadey_darkgate_elex_smoke-loader_stop.exe
4544	2026-07-18_ed5021daf447d6e62b8e4861a8a268ed_amadey_darkgate_elex_smoke-loader_stop.exe
4544	2026-07-18_ed5021daf447d6e62b8e4861a8a268ed_amadey_darkgate_elex_smoke-loader_stop.exe
4544	2026-07-18_ed5021daf447d6e62b8e4861a8a268ed_amadey_darkgate_elex_smoke-loader_stop.exe
4544	2026-07-18_ed5021daf447d6e62b8e4861a8a268ed_amadey_darkgate_elex_smoke-loader_stop.exe
4544	2026-07-18_ed5021daf447d6e62b8e4861a8a268ed_amadey_darkgate_elex_smoke-loader_stop.exe
4544	2026-07-18_ed5021daf447d6e62b8e4861a8a268ed_amadey_darkgate_elex_smoke-loader_stop.exe
4544	2026-07-18_ed5021daf447d6e62b8e4861a8a268ed_amadey_darkgate_elex_smoke-loader_stop.exe
4544	2026-07-18_ed5021daf447d6e62b8e4861a8a268ed_amadey_darkgate_elex_smoke-loader_stop.exe
4544	2026-07-18_ed5021daf447d6e62b8e4861a8a268ed_amadey_darkgate_elex_smoke-loader_stop.exe
4544	2026-07-18_ed5021daf447d6e62b8e4861a8a268ed_amadey_darkgate_elex_smoke-loader_stop.exe
4544	2026-07-18_ed5021daf447d6e62b8e4861a8a268ed_amadey_darkgate_elex_smoke-loader_stop.exe
4544	2026-07-18_ed5021daf447d6e62b8e4861a8a268ed_amadey_darkgate_elex_smoke-loader_stop.exe
4544	2026-07-18_ed5021daf447d6e62b8e4861a8a268ed_amadey_darkgate_elex_smoke-loader_stop.exe
4544	2026-07-18_ed5021daf447d6e62b8e4861a8a268ed_amadey_darkgate_elex_smoke-loader_stop.exe
4544	2026-07-18_ed5021daf447d6e62b8e4861a8a268ed_amadey_darkgate_elex_smoke-loader_stop.exe
4544	2026-07-18_ed5021daf447d6e62b8e4861a8a268ed_amadey_darkgate_elex_smoke-loader_stop.exe
4544	2026-07-18_ed5021daf447d6e62b8e4861a8a268ed_amadey_darkgate_elex_smoke-loader_stop.exe
4544	2026-07-18_ed5021daf447d6e62b8e4861a8a268ed_amadey_darkgate_elex_smoke-loader_stop.exe
4544	2026-07-18_ed5021daf447d6e62b8e4861a8a268ed_amadey_darkgate_elex_smoke-loader_stop.exe
4544	2026-07-18_ed5021daf447d6e62b8e4861a8a268ed_amadey_darkgate_elex_smoke-loader_stop.exe
4544	2026-07-18_ed5021daf447d6e62b8e4861a8a268ed_amadey_darkgate_elex_smoke-loader_stop.exe
4544	2026-07-18_ed5021daf447d6e62b8e4861a8a268ed_amadey_darkgate_elex_smoke-loader_stop.exe
4544	2026-07-18_ed5021daf447d6e62b8e4861a8a268ed_amadey_darkgate_elex_smoke-loader_stop.exe
4544	2026-07-18_ed5021daf447d6e62b8e4861a8a268ed_amadey_darkgate_elex_smoke-loader_stop.exe
4544	2026-07-18_ed5021daf447d6e62b8e4861a8a268ed_amadey_darkgate_elex_smoke-loader_stop.exe
4544	2026-07-18_ed5021daf447d6e62b8e4861a8a268ed_amadey_darkgate_elex_smoke-loader_stop.exe
4544	2026-07-18_ed5021daf447d6e62b8e4861a8a268ed_amadey_darkgate_elex_smoke-loader_stop.exe
4544	2026-07-18_ed5021daf447d6e62b8e4861a8a268ed_amadey_darkgate_elex_smoke-loader_stop.exe
4544	2026-07-18_ed5021daf447d6e62b8e4861a8a268ed_amadey_darkgate_elex_smoke-loader_stop.exe
4544	2026-07-18_ed5021daf447d6e62b8e4861a8a268ed_amadey_darkgate_elex_smoke-loader_stop.exe
4544	2026-07-18_ed5021daf447d6e62b8e4861a8a268ed_amadey_darkgate_elex_smoke-loader_stop.exe
4544	2026-07-18_ed5021daf447d6e62b8e4861a8a268ed_amadey_darkgate_elex_smoke-loader_stop.exe
4544	2026-07-18_ed5021daf447d6e62b8e4861a8a268ed_amadey_darkgate_elex_smoke-loader_stop.exe
4544	2026-07-18_ed5021daf447d6e62b8e4861a8a268ed_amadey_darkgate_elex_smoke-loader_stop.exe
4544	2026-07-18_ed5021daf447d6e62b8e4861a8a268ed_amadey_darkgate_elex_smoke-loader_stop.exe
4544	2026-07-18_ed5021daf447d6e62b8e4861a8a268ed_amadey_darkgate_elex_smoke-loader_stop.exe
4544	2026-07-18_ed5021daf447d6e62b8e4861a8a268ed_amadey_darkgate_elex_smoke-loader_stop.exe
4544	2026-07-18_ed5021daf447d6e62b8e4861a8a268ed_amadey_darkgate_elex_smoke-loader_stop.exe
4544	2026-07-18_ed5021daf447d6e62b8e4861a8a268ed_amadey_darkgate_elex_smoke-loader_stop.exe
4544	2026-07-18_ed5021daf447d6e62b8e4861a8a268ed_amadey_darkgate_elex_smoke-loader_stop.exe
4544	2026-07-18_ed5021daf447d6e62b8e4861a8a268ed_amadey_darkgate_elex_smoke-loader_stop.exe
1840	usmkecxurmkecwus.exe
1840	usmkecxurmkecwus.exe
1840	usmkecxurmkecwus.exe
1840	usmkecxurmkecwus.exe
1840	usmkecxurmkecwus.exe
1840	usmkecxurmkecwus.exe
1840	usmkecxurmkecwus.exe
1840	usmkecxurmkecwus.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5660	msedge.exe
5660	msedge.exe
5660	msedge.exe
5660	msedge.exe
5660	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	1332	i_zusmkecwup.exe
Token: SeDebugPrivilege	1512	i_bwurmjeczu.exe
Token: SeDebugPrivilege	2916	i_wtrljgbztr.exe
Token: SeDebugPrivilege	1332	i_qljdbwtjdb.exe
Token: SeDebugPrivilege	688	i_dyvtnligay.exe
Token: SeDebugPrivilege	3976	i_snkidxvsnl.exe
Token: SeDebugPrivilege	1704	i_pnkfdxusqn.exe
Token: SeDebugPrivilege	3612	i_smkicausmc.exe
Token: SeDebugPrivilege	3344	i_ecwuspkhcz.exe
Token: SeDebugPrivilege	1376	i_xuomhezxrp.exe
Token: SeDebugPrivilege	5804	i_omjhbzwqol.exe
Token: SeDebugPrivilege	4896	i_wtolgeywqo.exe
Token: SeDebugPrivilege	6136	i_jdavtnlgdy.exe
Token: SeDebugPrivilege	5812	i_daysnlidav.exe
Token: SeDebugPrivilege	2404	i_nlfdxvpnhf.exe
Token: SeDebugPrivilege	2100	i_cxvpnhfzxu.exe
Token: SeDebugPrivilege	1728	i_xrpkhcxupn.exe
Token: SeDebugPrivilege	4340	i_uomhezwrpm.exe
Token: SeDebugPrivilege	5920	i_urljheywro.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5660	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4544 wrote to memory of 1840	4544	2026-07-18_ed5021daf447d6e62b8e4861a8a268ed_amadey_darkgate_elex_smoke-loader_stop.exe	89
PID 4544 wrote to memory of 1492	4544	2026-07-18_ed5021daf447d6e62b8e4861a8a268ed_amadey_darkgate_elex_smoke-loader_stop.exe	90
PID 1492 wrote to memory of 5660	1492	iexplore.exe	91
PID 5660 wrote to memory of 2596	5660	msedge.exe	92
PID 5660 wrote to memory of 948	5660	msedge.exe	93
PID 5660 wrote to memory of 5076	5660	msedge.exe	94
PID 5660 wrote to memory of 948	5660	msedge.exe	93
PID 5660 wrote to memory of 948	5660	msedge.exe	93
PID 5660 wrote to memory of 2884	5660	msedge.exe	95
PID 5660 wrote to memory of 2884	5660	msedge.exe	95
PID 5660 wrote to memory of 3448	5660	msedge.exe	96
PID 5660 wrote to memory of 3448	5660	msedge.exe	96
PID 5660 wrote to memory of 3448	5660	msedge.exe	96
PID 5660 wrote to memory of 1192	5660	msedge.exe	97
PID 5660 wrote to memory of 1192	5660	msedge.exe	97
PID 5660 wrote to memory of 1192	5660	msedge.exe	97
PID 5660 wrote to memory of 4532	5660	msedge.exe	99
PID 5660 wrote to memory of 4332	5660	msedge.exe	100
PID 5660 wrote to memory of 4532	5660	msedge.exe	99
PID 5660 wrote to memory of 4532	5660	msedge.exe	99
PID 5660 wrote to memory of 4332	5660	msedge.exe	100
PID 5660 wrote to memory of 4332	5660	msedge.exe	100
PID 5660 wrote to memory of 5920	5660	msedge.exe	102
PID 5660 wrote to memory of 5920	5660	msedge.exe	102
PID 5660 wrote to memory of 2096	5660	msedge.exe	105
PID 5660 wrote to memory of 2096	5660	msedge.exe	105
PID 5660 wrote to memory of 4876	5660	msedge.exe	106
PID 5660 wrote to memory of 4876	5660	msedge.exe	106
PID 1840 wrote to memory of 2196	1840	usmkecxurmkecwus.exe	107
PID 2468 wrote to memory of 5128	2468	zusmkecwup.exe	110
PID 5660 wrote to memory of 4480	5660	msedge.exe	114
PID 5660 wrote to memory of 2916	5660	msedge.exe	115
PID 5660 wrote to memory of 2916	5660	msedge.exe	115
PID 5660 wrote to memory of 4172	5660	msedge.exe	118
PID 5660 wrote to memory of 4172	5660	msedge.exe	118
PID 1840 wrote to memory of 2424	1840	usmkecxurmkecwus.exe	119
PID 1840 wrote to memory of 5364	1840	usmkecxurmkecwus.exe	123
PID 4516 wrote to memory of 5136	4516	bwurmjeczu.exe	125
PID 1840 wrote to memory of 5456	1840	usmkecxurmkecwus.exe	128
PID 1840 wrote to memory of 1420	1840	usmkecxurmkecwus.exe	132
PID 5356 wrote to memory of 5336	5356	wtrljgbztr.exe	134
PID 1840 wrote to memory of 2076	1840	usmkecxurmkecwus.exe	137
PID 1840 wrote to memory of 5392	1840	usmkecxurmkecwus.exe	142
PID 4444 wrote to memory of 3100	4444	qljdbwtjdb.exe	144
PID 1840 wrote to memory of 3156	1840	usmkecxurmkecwus.exe	147
PID 5660 wrote to memory of 3112	5660	msedge.exe	149
PID 5660 wrote to memory of 2140	5660	msedge.exe	150
PID 5660 wrote to memory of 2628	5660	msedge.exe	151
PID 1840 wrote to memory of 1408	1840	usmkecxurmkecwus.exe	154
PID 3408 wrote to memory of 2272	3408	dyvtnligay.exe	156
PID 1840 wrote to memory of 5832	1840	usmkecxurmkecwus.exe	159
PID 1840 wrote to memory of 5828	1840	usmkecxurmkecwus.exe	163
PID 3664 wrote to memory of 2028	3664	snkidxvsnl.exe	165
PID 1840 wrote to memory of 4904	1840	usmkecxurmkecwus.exe	168
PID 1840 wrote to memory of 1544	1840	usmkecxurmkecwus.exe	172
PID 4828 wrote to memory of 4816	4828	pnkfdxusqn.exe	174
PID 1840 wrote to memory of 1652	1840	usmkecxurmkecwus.exe	177
PID 1840 wrote to memory of 5652	1840	usmkecxurmkecwus.exe	181
PID 5856 wrote to memory of 5896	5856	smkicausmc.exe	183
PID 1840 wrote to memory of 1332	1840	usmkecxurmkecwus.exe	186
PID 5660 wrote to memory of 1204	5660	msedge.exe	188
PID 5660 wrote to memory of 1204	5660	msedge.exe	188
PID 1840 wrote to memory of 4972	1840	usmkecxurmkecwus.exe	194
PID 5372 wrote to memory of 6124	5372	ecwuspkhcz.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-07-18_ed5021daf447d6e62b8e4861a8a268ed_amadey_darkgate_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_ed5021daf447d6e62b8e4861a8a268ed_amadey_darkgate_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4544
- C:\Temp\usmkecxurmkecwus.exe
  C:\Temp\usmkecxurmkecwus.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1840
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zusmkecwup.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2196
  - - C:\Temp\zusmkecwup.exe
      C:\Temp\zusmkecwup.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2468
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5128
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2760
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zusmkecwup.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2424
  - - C:\Temp\i_zusmkecwup.exe
      C:\Temp\i_zusmkecwup.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1332
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bwurmjeczu.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5364
  - - C:\Temp\bwurmjeczu.exe
      C:\Temp\bwurmjeczu.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4516
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5136
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5988
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bwurmjeczu.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5456
  - - C:\Temp\i_bwurmjeczu.exe
      C:\Temp\i_bwurmjeczu.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1512
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wtrljgbztr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1420
  - - C:\Temp\wtrljgbztr.exe
      C:\Temp\wtrljgbztr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5356
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5336
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4452
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wtrljgbztr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2076
  - - C:\Temp\i_wtrljgbztr.exe
      C:\Temp\i_wtrljgbztr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2916
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qljdbwtjdb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5392
  - - C:\Temp\qljdbwtjdb.exe
      C:\Temp\qljdbwtjdb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4444
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3100
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2960
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qljdbwtjdb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3156
  - - C:\Temp\i_qljdbwtjdb.exe
      C:\Temp\i_qljdbwtjdb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1332
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dyvtnligay.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1408
  - - C:\Temp\dyvtnligay.exe
      C:\Temp\dyvtnligay.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3408
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2272
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1076
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dyvtnligay.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5832
  - - C:\Temp\i_dyvtnligay.exe
      C:\Temp\i_dyvtnligay.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:688
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\snkidxvsnl.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5828
  - - C:\Temp\snkidxvsnl.exe
      C:\Temp\snkidxvsnl.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3664
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2028
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1708
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_snkidxvsnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4904
  - - C:\Temp\i_snkidxvsnl.exe
      C:\Temp\i_snkidxvsnl.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3976
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pnkfdxusqn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1544
  - - C:\Temp\pnkfdxusqn.exe
      C:\Temp\pnkfdxusqn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4828
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4816
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2992
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pnkfdxusqn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1652
  - - C:\Temp\i_pnkfdxusqn.exe
      C:\Temp\i_pnkfdxusqn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1704
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\smkicausmc.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5652
  - - C:\Temp\smkicausmc.exe
      C:\Temp\smkicausmc.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5856
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5896
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:704
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_smkicausmc.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1332
  - - C:\Temp\i_smkicausmc.exe
      C:\Temp\i_smkicausmc.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3612
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ecwuspkhcz.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4972
  - - C:\Temp\ecwuspkhcz.exe
      C:\Temp\ecwuspkhcz.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5372
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6124
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3284
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ecwuspkhcz.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5868
  - - C:\Temp\i_ecwuspkhcz.exe
      C:\Temp\i_ecwuspkhcz.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3344
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xuomhezxrp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1480
  - - C:\Temp\xuomhezxrp.exe
      C:\Temp\xuomhezxrp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3452
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1196
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2572
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xuomhezxrp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1812
  - - C:\Temp\i_xuomhezxrp.exe
      C:\Temp\i_xuomhezxrp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1376
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\omjhbzwqol.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4320
  - - C:\Temp\omjhbzwqol.exe
      C:\Temp\omjhbzwqol.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4556
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1512
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4732
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_omjhbzwqol.exe ups_ins
    3⤵
    PID:5636
  - - C:\Temp\i_omjhbzwqol.exe
      C:\Temp\i_omjhbzwqol.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5804
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wtolgeywqo.exe ups_run
    3⤵
    PID:5544
  - - C:\Temp\wtolgeywqo.exe
      C:\Temp\wtolgeywqo.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2268
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3344
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5528
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wtolgeywqo.exe ups_ins
    3⤵
    PID:2848
  - - C:\Temp\i_wtolgeywqo.exe
      C:\Temp\i_wtolgeywqo.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4896
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jdavtnlgdy.exe ups_run
    3⤵
    PID:704
  - - C:\Temp\jdavtnlgdy.exe
      C:\Temp\jdavtnlgdy.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1560
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:552
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5376
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jdavtnlgdy.exe ups_ins
    3⤵
    PID:2852
  - - C:\Temp\i_jdavtnlgdy.exe
      C:\Temp\i_jdavtnlgdy.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6136
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\daysnlidav.exe ups_run
    3⤵
    PID:3324
  - - C:\Temp\daysnlidav.exe
      C:\Temp\daysnlidav.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5804
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6012
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1728
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_daysnlidav.exe ups_ins
    3⤵
    PID:5260
  - - C:\Temp\i_daysnlidav.exe
      C:\Temp\i_daysnlidav.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5812
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nlfdxvpnhf.exe ups_run
    3⤵
    PID:4220
  - - C:\Temp\nlfdxvpnhf.exe
      C:\Temp\nlfdxvpnhf.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4172
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1424
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1272
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nlfdxvpnhf.exe ups_ins
    3⤵
    PID:4680
  - - C:\Temp\i_nlfdxvpnhf.exe
      C:\Temp\i_nlfdxvpnhf.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2404
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cxvpnhfzxu.exe ups_run
    3⤵
    PID:2556
  - - C:\Temp\cxvpnhfzxu.exe
      C:\Temp\cxvpnhfzxu.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3292
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2064
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2592
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cxvpnhfzxu.exe ups_ins
    3⤵
    PID:1072
  - - C:\Temp\i_cxvpnhfzxu.exe
      C:\Temp\i_cxvpnhfzxu.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2100
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xrpkhcxupn.exe ups_run
    3⤵
    PID:2040
  - - C:\Temp\xrpkhcxupn.exe
      C:\Temp\xrpkhcxupn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5088
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5164
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3308
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xrpkhcxupn.exe ups_ins
    3⤵
    PID:6112
  - - C:\Temp\i_xrpkhcxupn.exe
      C:\Temp\i_xrpkhcxupn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1728
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\uomhezwrpm.exe ups_run
    3⤵
    PID:2072
  - - C:\Temp\uomhezwrpm.exe
      C:\Temp\uomhezwrpm.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2972
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3104
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1684
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_uomhezwrpm.exe ups_ins
    3⤵
    PID:5528
  - - C:\Temp\i_uomhezwrpm.exe
      C:\Temp\i_uomhezwrpm.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4340
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\urljheywro.exe ups_run
    3⤵
    PID:2720
  - - C:\Temp\urljheywro.exe
      C:\Temp\urljheywro.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4568
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:200
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3424
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_urljheywro.exe ups_ins
    3⤵
    PID:3376
  - - C:\Temp\i_urljheywro.exe
      C:\Temp\i_urljheywro.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5920
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f8,0x2fc,0x300,0x2f4,0x308,0x7ffd1902c188,0x7ffd1902c194,0x7ffd1902c1a0
      4⤵
      PID:2596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,13654549957631823283,14925457738081890708,262144 --field-trial-handle=2640,i,9615268090024241100,7417029843768565415,262144 --variations-seed-version --mojo-platform-channel-handle=2636 /prefetch:2
      4⤵
      PID:948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1920,i,1187194618343043658,15641510530082379672,524288 --field-trial-handle=2640,i,9615268090024241100,7417029843768565415,262144 --variations-seed-version --mojo-platform-channel-handle=3120 /prefetch:11
      4⤵
      System Time Discovery
      PID:5076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2296,i,13120193139933646203,14560342114396650081,524288 --field-trial-handle=2640,i,9615268090024241100,7417029843768565415,262144 --variations-seed-version --mojo-platform-channel-handle=3244 /prefetch:13
      4⤵
      PID:2884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3572,i,6532541440271951284,6418513705363762193,2097152 --field-trial-handle=2640,i,9615268090024241100,7417029843768565415,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
      4⤵
      PID:3448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3580,i,6151225503017432978,5682936721053137893,2097152 --field-trial-handle=2640,i,9615268090024241100,7417029843768565415,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
      4⤵
      PID:1192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4312,i,728428432401692886,11692567699295728822,2097152 --field-trial-handle=2640,i,9615268090024241100,7417029843768565415,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:1
      4⤵
      PID:4532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4316,i,15301639999424670298,1470803356111329368,2097152 --field-trial-handle=2640,i,9615268090024241100,7417029843768565415,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:9
      4⤵
      PID:4332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,15780995871643152437,6418460584404251954,524288 --field-trial-handle=2640,i,9615268090024241100,7417029843768565415,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:14
      4⤵
      PID:5920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,13955381025133384063,3792559231029691165,524288 --field-trial-handle=2640,i,9615268090024241100,7417029843768565415,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:14
      4⤵
      PID:2096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,12105899833224449399,17352958093596344575,524288 --field-trial-handle=2640,i,9615268090024241100,7417029843768565415,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:14
      4⤵
      PID:4876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,16938842659126318480,1495875703199827957,524288 --field-trial-handle=2640,i,9615268090024241100,7417029843768565415,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
      4⤵
      PID:2344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,16938842659126318480,1495875703199827957,524288 --field-trial-handle=2640,i,9615268090024241100,7417029843768565415,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
      4⤵
      PID:4480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,14411605743703613500,6363824759596533852,524288 --field-trial-handle=2640,i,9615268090024241100,7417029843768565415,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
      4⤵
      PID:2916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,17624550253948197098,14338692378000790254,524288 --field-trial-handle=2640,i,9615268090024241100,7417029843768565415,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:14
      4⤵
      PID:4172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4316,i,9563939857810787580,11331309435250418241,524288 --field-trial-handle=2640,i,9615268090024241100,7417029843768565415,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:14
      4⤵
      PID:3112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,11348791495842835615,6314983866765631756,524288 --field-trial-handle=2640,i,9615268090024241100,7417029843768565415,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:14
      4⤵
      PID:2140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4440,i,6574802407071215721,12270844679662419752,524288 --field-trial-handle=2640,i,9615268090024241100,7417029843768565415,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14
      4⤵
      PID:2628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1940,i,6725122560890086625,10961541392496468644,524288 --field-trial-handle=2640,i,9615268090024241100,7417029843768565415,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:14
      4⤵
      PID:1204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,8760349857920458435,6703176675782471458,524288 --field-trial-handle=2640,i,9615268090024241100,7417029843768565415,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:14
      4⤵
      PID:1880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,13626695273297355618,7812049335804185681,524288 --field-trial-handle=2640,i,9615268090024241100,7417029843768565415,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:14
      4⤵
      PID:1172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,7797775113402665971,9430043867191497581,524288 --field-trial-handle=2640,i,9615268090024241100,7417029843768565415,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:14
      4⤵
      PID:4896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6056,i,17820994384742565667,16673090976414228871,262144 --field-trial-handle=2640,i,9615268090024241100,7417029843768565415,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:10
      4⤵
      PID:2620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,1654085754918176201,4531382744050663965,524288 --field-trial-handle=2640,i,9615268090024241100,7417029843768565415,262144 --variations-seed-version --mojo-platform-channel-handle=3880 /prefetch:14
      4⤵
      PID:3320

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5972

C:\Temp\usmkecxurmkecwus.sys
C:\Temp\usmkecxurmkecwus.sys
1⤵
- Executes dropped EXE
PID:2592

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:364

C:\Temp\gezwromgez.sys
C:\Temp\gezwromgez.sys
1⤵
- Executes dropped EXE
PID:2880

C:\Temp\ebztromgeu.sys
C:\Temp\ebztromgeu.sys
1⤵
- Executes dropped EXE
PID:1288

C:\Temp\wqoigbytrl.sys
C:\Temp\wqoigbytrl.sys
1⤵
- Executes dropped EXE
PID:4904

C:\Temp\igaytqlidb.sys
C:\Temp\igaytqlidb.sys
1⤵
- Executes dropped EXE
PID:5840

C:\Temp\vsnlidavsn.sys
C:\Temp\vsnlidavsn.sys
1⤵
- Executes dropped EXE
PID:1728

C:\Temp\vtnlfdxnhf.sys
C:\Temp\vtnlfdxnhf.sys
1⤵
- Executes dropped EXE
PID:5972

C:\Temp\usnkfcxvpn.sys
C:\Temp\usnkfcxvpn.sys
1⤵
- Executes dropped EXE
PID:4600

C:\Temp\mkhczurpkh.sys
C:\Temp\mkhczurpkh.sys
1⤵
- Executes dropped EXE
PID:4648

C:\Temp\zxrpmhezxr.sys
C:\Temp\zxrpmhezxr.sys
1⤵
- Executes dropped EXE
PID:1608

C:\Temp\wurmjecztj.sys
C:\Temp\wurmjecztj.sys
1⤵
- Executes dropped EXE
PID:1524

C:\Temp\ywromgeywt.sys
C:\Temp\ywromgeywt.sys
1⤵
PID:1728

C:\Temp\rljdbvtnlg.sys
C:\Temp\rljdbvtnlg.sys
1⤵
PID:4308

C:\Temp\fdyvqoifdy.sys
C:\Temp\fdyvqoifdy.sys
1⤵
PID:5996

C:\Temp\snlfdxvsqn.sys
C:\Temp\snlfdxvsqn.sys
1⤵
PID:3504

C:\Temp\nkfcxvsnkf.sys
C:\Temp\nkfcxvsnkf.sys
1⤵
PID:2892

C:\Temp\czusmkecxu.sys
C:\Temp\czusmkecxu.sys
1⤵
PID:4616

C:\Temp\xrpmhfzxrp.sys
C:\Temp\xrpmhfzxrp.sys
1⤵
PID:3048

C:\Temp\rmjhbzwrom.sys
C:\Temp\rmjhbzwrom.sys
1⤵
PID:3340

C:\Temp\bwtomjhezw.sys
C:\Temp\bwtomjhezw.sys
1⤵
PID:1548

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bwurmjeczu.exe

Path C:\Temp\bwurmjeczu.exe
Size 384KB
SHA256 31300aa872e3170c5111e01d07aab9f0d613ab769c942c4949876b78d13bc581
MD5 eb2cd56821037f495163169dd201db5e
SHA1 8e23ffedea11625045e9e2136ce85841147e14b9
SHA512 ae5537452cfceab063fccfa33b25b3e9f99435bcc8e140a19b93580d59ef007f8aedc66ecd468b4435a48c0211e87fa2ec903acd877b4654ec4b720a424e3f90
SSDEEP 3072:H9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:dctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T123847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dyvtnligay.exe

Path C:\Temp\dyvtnligay.exe
Size 384KB
SHA256 c9a648a6aca398c40302b96bcfbd4664997dd9dd615132c3e59876e2a2cdf356
MD5 75d43317ade3d80800cbd8b6c458ce8e
SHA1 23421783ea587840ade23b2a9daa69b638d046cf
SHA512 d934564a600a5ff9b019c79ab2030aeec3f234ff2c851cfbd7bb0cab5d39dacad4b0564945aae154ce53fb0d3a61a4cb59f3b5f7c4ecd200b6f9d0e9b313a4cc
SSDEEP 3072:H9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:dctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T131847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ebztromgeu.sys

Path C:\Temp\ebztromgeu.sys
Size 293KB
SHA256 00b6be77804bc42ba5b5b1a216cc5ab66f66eb7de1752cb646a1067a76a4ede1
MD5 db405b200875c3e5a5dd17d8107a9a0c
SHA1 d66e14fa145df906c6f96f2e8e90a9b5e6c45c9f
SHA512 32bc4b2a2d0780d6b831dbaa3a85c06ad50a3610a6852a4b1399a4fed53fd711a0c0f2fd366d59e6ebc90b4b55d4c8db8a8fb9cf8de06146fa2a35f90cfdc8ec
SSDEEP 3072:HtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:HIJjiJcbI03GBc3ucY5DCSj
TLSH
T1CF545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gezwromgez.sys

Path C:\Temp\gezwromgez.sys
Size 293KB
SHA256 9dc9b7c1cc7a20393fe57f40d2f654e10ac3fa70f36fff3151d62d2d328dba71
MD5 cefe20ab2e85b8665186121d92b30c90
SHA1 04d4d80aa252a65ac5b51bbc2b0ab5a8623d8ff2
SHA512 d29e9713978d99cad1865a5e9cdd3e297f9dcac4b70834eb57cf1ec4f26a20ad6426d760f6be221d01cbe5d52ef71e40ec4589d2c52b6d9986df53606b2a82b1
SSDEEP 3072:LtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:LIJjiJcbI03GBc3ucY5DCSj
TLSH
T14C545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bwurmjeczu.exe

Path C:\Temp\i_bwurmjeczu.exe
Size 384KB
SHA256 a2bf256a86c19bf4f4465743a147ebf2324dd2f53eeb74bd90dbe8b610597ec9
MD5 11d249556b6291cf910b983b293d0fe8
SHA1 4ada2ca2bafdda3d5d03afbc7575169b998811b8
SHA512 e9223eb3d8129bdc3d6289bd35fd91218c131778c03c6dd83df9e320ed812bb7ecc981d62f60a30366871b5b2d2095c0d00b3b033483aea94f2270935f364271
SSDEEP 3072:79ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:pctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T139847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dyvtnligay.exe

Path C:\Temp\i_dyvtnligay.exe
Size 384KB
SHA256 85bf7018c1c137db481cf67faa4601e509c4c8fa8f28da187d2424d6110547d1
MD5 81e26256e1d3d17bd0270d2bd582774b
SHA1 47d0302cc8c21a3b2fc92e730068812b0ddcb8b2
SHA512 4f2c2112e5eb4738eb687092c0980d748c90b526fea9c06054addb0fa9be70387f9ca9f3336b5727bef79cf614832df27f356c5a878bcda5a05e903114d690eb
SSDEEP 3072:39ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:NctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T17F847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qljdbwtjdb.exe

Path C:\Temp\i_qljdbwtjdb.exe
Size 384KB
SHA256 c3d8e256a1c34b866eaa23d53d8aae6e894b6193003c97be93cefdabe2ba3d83
MD5 b27998ff46b29bc31210307d40db6f46
SHA1 306283c3783757133f723bd5a66cdd5128a32cd8
SHA512 ad8d0e9c3c97304327fb0bf5906f430d17f5f94a9d2edc647a668761659121d6fcaa76dce4c42bdacae183373a04d5bf05afa6e1cd690a9a9128d5d55481fc5c
SSDEEP 3072:b9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:JctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1AF847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wtrljgbztr.exe

Path C:\Temp\i_wtrljgbztr.exe
Size 384KB
SHA256 5910e385564549f8210aa01309cf56dced706afdd2facdcdd778ee210a340ce1
MD5 d55646aa56b41ddca0d8126efc3919a8
SHA1 d1536b333f3f1a84f33b92dd2b739cc3d2a757b9
SHA512 3ee3923bbeb85df848c774bdcfebfc98248b9d8be974ee3d753e82a501197b82f0097d1844a59e2f7bc027553759185f596d229a472408c4c16284b4618cb30a
SSDEEP 3072:e9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:8ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T18E847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zusmkecwup.exe

Path C:\Temp\i_zusmkecwup.exe
Size 384KB
SHA256 1bbe895dbab081485bc956d1a8d0d953e471c4512d1f34c53f503ab37eca5957
MD5 a808da73124c1bdbe99fd44561ffaf47
SHA1 797fd25af5d8cf6c1b2b273ff9b3a3808e2add75
SHA512 1e24bd0ef445e74c4d0e3f0f0e0ec7fcd1cb62db2759b6bafb33ce03810637105f526a5d0133742b83d998fb99b1f07024cca0ec4201e15fa522d6db6acef176
SSDEEP 3072:99ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:PctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T13C847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igaytqlidb.sys

Path C:\Temp\igaytqlidb.sys
Size 293KB
SHA256 ede5c300ed1dcd28318f18b11a4d4981c94a9ed26673c28be0b5e6f01cd73475
MD5 ff9aae5152404370f8f037ac9c8c85d1
SHA1 669ef866a8ca446edf36e64c4233d90b6f089f45
SHA512 e47c456018407e914b21252f74f3e6efc413c50f512a504f6d7b15274867708a732a3a4071fb9a88670c86ff77291af5ea165a94afa3681bfe90925fb7de018b
SSDEEP 3072:XtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:XIJjiJcbI03GBc3ucY5DCSj
TLSH
T1C2545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qljdbwtjdb.exe

Path C:\Temp\qljdbwtjdb.exe
Size 384KB
SHA256 09613ecb849f9d1f4168256159d0e609ec90b5196c8658f10ebea4b935338dfa
MD5 9746ff7bc4101e114d936a2c7685495d
SHA1 a2055473930ba2323838812197a80de1260abd43
SHA512 fb5cd306c1c751170c1f407dfeb60bb66bfe3811a4b34d6ea25527b9ff3c14d618783fdef521c44274f164f93ae6e6049ac5e6e80eef268022ca408d0d82df6a
SSDEEP 3072:E9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:ectFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T115847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snkidxvsnl.exe

Path C:\Temp\snkidxvsnl.exe
Size 384KB
SHA256 799bf8e57c77b56067d62798acb2a387758c0f3b73f07039233ef94f683f5878
MD5 dbc0aac45d171a1e9283c00548220ff2
SHA1 ecf811e2507c26cc3bd5b451b553460f3dcdadd2
SHA512 0eb20b974e09b12bc310aabed7fad71ed086c0ab8bc3381a4a26e48105db96a71465da70a25da98ff9f90cee40e5b0acb545908baa7bf1f3ce5572ead3398386
SSDEEP 3072:29ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:kctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T17C846B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usmkecxurmkecwus.exe

Path C:\Temp\usmkecxurmkecwus.exe
Size 384KB
SHA256 aefa6b820545cd0c27d215b3229c3bf91dd648156967841f44d025c14154122f
MD5 33bf8cb516b1a8baab9c2725295061c2
SHA1 17d31383ac069894e46e0d00a32285f4abb17ea8
SHA512 fe49618d17bd54bbbf318609e3858bc24b50837937b728be7458a8a35121143627e8e4351650d30befeb746a496ea077234cf0e714b458a7ff064a2048d80336
SSDEEP 3072:A9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:SctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1BB847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usmkecxurmkecwus.sys

Path C:\Temp\usmkecxurmkecwus.sys
Size 293KB
SHA256 3f0ab2edda9f1174481d5325c11dda4f1464fbe93f4c36f6aef5eff00aa436f7
MD5 9c0738992fe308a9bf97a905d01addcd
SHA1 4d70e655a6f86ca29e78e15b372a1803b7eafa8b
SHA512 d431711d6d5244b3fe1d13e0fadd63a39cc3af203cae5239fb8cf02ff35d07733b862d653d5aa1ae492f79eb0ef0d6b3ae7311e07a21febdd33a01fa8bccb1a8
SSDEEP 3072:XtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:XIJjiJcbI03GBc3ucY5DCSj
TLSH
T188545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vsnlidavsn.sys

Path C:\Temp\vsnlidavsn.sys
Size 293KB
SHA256 2d5c1de18d79f8e253a4f2e0f193ca4b349e8a584a8b75492d0c907c498c09d6
MD5 04def1748b7bb8759baa3435a461104f
SHA1 3da19d9f7747c21cb7e98e5759f1a3c1cc5db002
SHA512 3ad1a67e52642b9c5e2acf949c00857a5b3637c9fa2d05b01d471bfd97cfbce79b50f7a453edfbb214c3467049e35f53c8c0b5e25ad19f922014443b52fe5980
SSDEEP 3072:ytKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:yIJjiJcbI03GBc3ucY5DCSj
TLSH
T115545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wqoigbytrl.sys

Path C:\Temp\wqoigbytrl.sys
Size 293KB
SHA256 ce39004bf835f24cae7c199c533d06f9278761fac9077492bf3d26756d25f470
MD5 14294fe77ce9b21ad795592b0b427766
SHA1 f9bd55122f00e8429afe9c40b2feeb6c795ad071
SHA512 22aee15bd72e6640633825afe7998800f6a4cbcee811aad7e683853cb4ffc07720d546cda58d7798ce3c94a61e2e48cf63b82ed000769d12bc50dec039df8001
SSDEEP 3072:btKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:bIJjiJcbI03GBc3ucY5DCSj
TLSH
T1C4545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wtrljgbztr.exe

Path C:\Temp\wtrljgbztr.exe
Size 384KB
SHA256 493a960d32521939738de3c94289b55d460c0b7581528d8723d74ca7176d55d2
MD5 e2a7f4729746f9c5c9452a6be6abe618
SHA1 c72c052e17d14926fa257109f3622c931d7a2356
SHA512 f273a23b15261031ac6e41c7c348cc15a8fab227e57347f3984eaaf64186f6880a7757477c8c5694805471cc23dcdfa5405cf6b90e9a661ed76e7f32a88eccc0
SSDEEP 3072:+9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:cctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1DF847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zusmkecwup.exe

Path C:\Temp\zusmkecwup.exe
Size 384KB
SHA256 f1f001b6add3d56b4a9777f952ff89906dc1949eb5c56f57195909cb5e53f087
MD5 4f2c242e376afa608c109a5ceecdb23c
SHA1 d46ee01fdef526cdd4681d8a4554b35f5db74eba
SHA512 b9001c0d1b5598611667d6b1a15087385344800f140fe8105b6680f4fbeb30d6163a658abcf926ac69953378c0b4e9a5e1122ef9516e71d2439d1e706ff1d857
SSDEEP 3072:o9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:qctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A5847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 46b2e90eaa3c186bcaf7b0c2e6c3bd6994d0e757a7e3addffffa865dabf522f5
MD5 696c49fe27a4b7bd663c05fc3d35945e
SHA1 62608bb59c2ad363f12f29c6780a642a4e07b9fa
SHA512 9d6634f78435cb308eb48e32141173d28146acd97dca331a7550f600006b075002335e4ae1e5f08564aacb298e83cbcb657d6f2f336dbc272d5d35d511817a66
TLSH
T1CE61309B935109DEDB258E7852D0F44E3BF8E47D8717AE1461E76DB0940AFC4D2D002B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe596a0b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe596a0b.TMP
Size 3KB
SHA256 bf7175d2c132e478d8935ac7902537d839967cd51173c61f80aafae5e5c6b669
MD5 ea0af8436ad08851465d28f56e6d4d8d
SHA1 0357f604797074702557d52d187564a31f21dcd0
SHA512 ec14770f63162fb435e87b40b60cec082ba542eb851aa033f7c8611d90197dbd86f7dd820ca66755b587c85d00c9466dc39dee252679770558867b493337e291
TLSH
T10761429B935109DEDB258E7852D0F44E3BF8E47D8717AE1461E75DB0940AFC4D2D002B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

04e54dd5-22ed-4b12-a64b-210a7db79abb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\04e54dd5-22ed-4b12-a64b-210a7db79abb.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 02bbac5517dce3fc798b039f43de9364e6de1b9d73cc37097cafab86c1d85c03
MD5 754ccacb34a3ec606535c1a85ac11adf
SHA1 89199b075bfc193733794ad086b2d9bd9ffbb7a1
SHA512 b4f5e262bb9c80fc496fdebe03890d0f51fd95095153f0530699a4d0a77f6e5f3fb6072e61f914f97f64236664f4681e7fcd78661f937407e614a473bae76edd
TLSH
T1FE41BBF3C3E9866E890156F0AB187E1BCE2C0914832C3D5AC9E4AF5BA3E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 46338255de450b0d0da93f8045da04de921f3042df8ed9343c6d21080c79c5bf
MD5 5e8ce5d1f13c7a673664aa38bc834cb7
SHA1 076549c54cda8ed21b455f73c5ab4801464227ea
SHA512 4379d03468dcc2af58616a3a975e9435347ee331d00bdc08f0ad78769b67b092867f508b1e855a55f2b359d7be2934336e56d3f2b5f9e6dc9b846a4f87717ec1
SSDEEP 192:sxRbRtC//fpshybwGxzoA8p9a/g6+WNC16/YoaCYGGwIgtJ:sxRbO//fpshybpsE/5R/Zl3
TLSH
T1FF3295166A68993B5CC7E21DBB65BF93E6F91032A1D42E48B7FC860C04E76DD620740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 414caf0d25c8eac68a2fecc207531791bc628e8eac1b788d0f8f0a3840337454
MD5 4b336d09b298c08c54200104c52bebc1
SHA1 a7472c6825920061d624c2fc61bdb29b5ccaf16f
SHA512 f2d779bd2fb47fa71ee77cf1b6893dad7263ebc5a28c10e6a17dac790e120f20da058d0f48deca749b5745eec9e21c2f01da2e5fa92884924263918200c8dd5c
SSDEEP 192:sxRoRtC//fpsRybwGxzoA8p9a/g6+WNC16/YoaCYGGwIgDOJ:sxRoO//fpsRybpsE/5R/Zle
TLSH
T10E42A4166A689D3B5CC6E21DBB65BF93E2F91032A1D42E48A7FC870C04E77DD620740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 c2c3e70f3b5f42de8b5a55661e700005244632fd6a783eacc28dc52dea40cf24
MD5 20f437703f718eda3668a1c96ab3ffda
SHA1 c1d8e0b0cfbdb161113db74f6486297d61a6cca4
SHA512 cc69e84e48a4d84b6cc3cd358d8cc10ffab643068269936f4ea0e692e2063bd599ddd5bb9f180f66fd071a4be789d0f7cdc63f93bc3d44773bddb095ad3a6405
SSDEEP 192:sxRoRtC//fpsRyuOZDAWzoA8p9a/g6+WNC16/YoMCYGGwIgDAJ:sxRoO//fpsRyuosE/5R/bl4
TLSH
T1E742B5166D689D3B5CC7D20DBB55BF93E6F95032A1952E48A7FC8B0C00E76DD620740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 50e05fc652a6351a951e5239750d8058c46988b3bde072a36454c8921bff4f2c
MD5 c4551cc6d7de8d1d8493038591830062
SHA1 d03c91349a57ba55442f3895e2c9905940b6628a
SHA512 244497c6984e179afb04866c14f862eae0ece6e50301beec426e547aefa4af47c09bbee895481cd595d207db16f781a80225aeed2e236544428a76e94d980817
SSDEEP 768:j26HRo7pLuL7MRWgs2f028F1+UoAYDCx9Tuqh0VfUC9xbog/OV8mBVuw0ro9Ge0g:j26HRUE7MRWgs2f02u1ja/mB4wfh7
TLSH
T1F4D2DB7B740DCA7E4F804ADDEC29BE9F6D6802CB9698CD8047FD851C02C6BEA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a0502.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a0502.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 462a19e6b1d3d68b0298b484e6c1a8d7f95361e0de1540c7026189836e84dd14
MD5 99ef100b700154e10c004804e708bc61
SHA1 d7fd3f35e37c3ccb4ee4bd155a7644773d0957af
SHA512 a6f70a8eae8030049fec509e46b1f91c05395d57589acb9a75673658ad7a806fe1349304ebd2f8e46ef09a9d70dee17b393de1da0004a7c69c77862703250afa
SSDEEP 768:hrv+4UNbdz3kz/TBOWsLpONXyer1IRCzniBseVH1SK7:hbsbV3gQpSIqnvEH1l
TLSH
T1CC03BE36E4A8DE378CE2A3C5B14B72437FB8605BD68407A0D9DE1F4E069B59D130B917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 0bd6a06bc4485e81a1e4a1fda58eee95680b342c3449de7f38a1e65b21c49d95
MD5 a2625ac10c81d2f2858c5488434585d3
SHA1 752f47adc16df7bf809c3231964152ab51e489f6
SHA512 059b86a732c10d50a7ff1c0ad78ef8a9d1d25a67bc88097cb1ac676c687eaa15fc65a0896694eff048c20a5e77f2a1742cf9cd775a8f5a0255f254980f5510b6
SSDEEP 768:hrv+4UNbd43DHC/TBOWsLQjt0ONXyer1IRCzni9keVH1SK3:hbsbm3DiQZSIqnHEH1R
TLSH
T11513BF31E4A8DE334CE2A396B0477393BFF8205785840B90EAEA1F4E059759E170F91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 737fbe1d324af4365b63daf8246f9eb599bc78244e2a0ca45227ca3f874648b9
MD5 497ad49cec9c360b5c2e89471ffcde4e
SHA1 6f09f22c72785ba0e169b5fefc50daf4f31d8525
SHA512 9ecc11f586d2dca4b1bac990eaee1075a2cbb4a93a0156709619df34d5ea43025dbfccf3b290645508c81e1133d52b484f1eaf379227d9caab680eecb8ca8faf
SSDEEP 768:WF1j+9I39wgz0hpsOWsLQjtmONXyer1IRCzni9kb9MY:j9I3/WFVSIqnHb+Y
TLSH
T13C1328F694D78A37D89E4387B33D2E56AABCD067B5884980BBD51E4DCC8217FC306806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 2f436d6bfba1214629712f5fa7f7fae07325a2aa46146f7fdc14f035299b9d00
MD5 93a4e002aeb90d68e897f36342637a48
SHA1 885fbc3f5335a1fa2511c98eebbd6b3aa43b3ef7
SHA512 256c034710ec9b3365b2d2e92c7e54c0f58ac792a4a5e4f9348cc1398838daaca87b8a0278b0e90898265b16932353f0428865168a7a7589360125bc396b6779
SSDEEP 768:Yj+9i3p8C/TBOWsLQjtBONXyer1IRCzni9kb9MY:H9i3ppQWSIqnHb+Y
TLSH
T118F2AE35E496DE234CE2A3D6B2463797FFF4206BC6854A40EAEA6F0E058365D170B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

d0285144-a319-42ea-a680-0e4f66a41a97.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d0285144-a319-42ea-a680-0e4f66a41a97.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5660_2004453655\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 d079e30ae6015cc0c91c09462078d0348d6beb9db5d41d572799a82aad43ab04
MD5 291eb7575f10854392641344c60f0edf
SHA1 cf4b7be61eb698d8e17c09584533cf754f68d08b
SHA512 4c61ee9f180ed813ea768a739811b52a3a67939a4b445ccc1ce2406602d69f03851b0bd5ce8d712257f375774c425ad75f13c1f00c99b5e304e0372550f4c320
TLSH
T10C7100835AA8D9F2C19A9BF002C35248F1FF22384723307547555546AA30A7A58B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1288-230-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1524-363-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1548-486-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1608-334-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1728-383-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1728-303-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1840-386-0x0000000000A60000-0x0000000000AC0000-memory.dmp

Download

memory/2592-61-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2880-183-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2892-439-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3048-483-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3048-464-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3340-468-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3504-428-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4308-404-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4600-315-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4616-444-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4648-330-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4904-258-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5840-274-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5972-311-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5996-408-0x0000000000010000-0x00000000000AB000-memory.dmp

Download