systex | 848277a0eaef0ce96511ffa44ff742aa96ae18087c4ac6f5dc052a2facae0e96

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 16:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_fbf84aacb97c6738f6db430ebe9bf8b0_amadey_darkgate_elex_smoke-loader_stop.exe
Size 384KB
Sample260719-tts2aaes5m
SHA256 848277a0eaef0ce96511ffa44ff742aa96ae18087c4ac6f5dc052a2facae0e96
MD5 fbf84aacb97c6738f6db430ebe9bf8b0
SHA1 e30d4dbb3c037c81a9f5ccb51abf178b504e4b53
SHA512 ae1ae92783e3783da21126e89ae3ddf1d054d31db2455ff75d7b08c42fc09fc4b904c80421cafd2ae89c56c3c11801ff5fc74266bf7a7b579a400d4bf1ba2fcb
SSDEEP 3072:09ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:OctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T158847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
2716	mjebwuomjebztrmj.exe
1452	mjebwuomjebztrmj.sys
1208	CreateProcess.exe
4648	uomgbzurjb.exe
1136	CreateProcess.exe
4216	CreateProcess.exe
6040	i_uomgbzurjb.exe
2748	wtrlgeywqo.sys
4108	CreateProcess.exe
3040	qoigeywtom.exe
1452	CreateProcess.exe
3700	CreateProcess.exe
3356	i_qoigeywtom.exe
3840	aytqligdyw.sys
4356	CreateProcess.exe
5260	ysqolgaytq.exe
4260	CreateProcess.exe
5164	CreateProcess.exe
5700	i_ysqolgaytq.exe
1604	bvtqligays.sys
6068	CreateProcess.exe
4156	qkicavsnlf.exe
5732	CreateProcess.exe
5100	CreateProcess.exe
3028	i_qkicavsnlf.exe
1096	nifaysqkif.sys
6020	CreateProcess.exe
4616	ifaxvtnlfd.exe
2684	CreateProcess.exe
3520	CreateProcess.exe
3356	i_ifaxvtnlfd.exe
4476	uspnhfdxvp.sys
5240	CreateProcess.exe
4324	xvsnkfcxvp.exe
5252	CreateProcess.exe
2428	CreateProcess.exe
4104	i_xvsnkfcxvp.exe
5792	rpnhczxrpk.sys
5452	CreateProcess.exe
5952	smkecwupmh.exe
2984	CreateProcess.exe
892	CreateProcess.exe
932	i_smkecwupmh.exe
1804	rmkeczxupm.sys
1132	CreateProcess.exe
2840	jhezwuomjh.exe
2864	CreateProcess.exe
2492	CreateProcess.exe
1888	i_jhezwuomjh.exe
3716	uomkezwrom.sys
124	CreateProcess.exe
1500	gecwurmjec.exe
4908	CreateProcess.exe
5844	CreateProcess.exe
2444	i_gecwurmjec.exe
4848	bztrljhbzt.sys
5816	CreateProcess.exe
2608	wuoljdbywq.exe
2536	CreateProcess.exe
4540	CreateProcess.exe
1536	i_wuoljdbywq.exe
2800	qljdbytqoi.sys
5384	CreateProcess.exe
3120	olgdywtolg.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5548_670632467\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5548_670632467\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5548_1302153132\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5548_1754375812\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5548_1754375812\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5548_1754375812\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5548_216878281\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5548_216878281\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5548_351183345\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5548_1302153132\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5548_1754375812\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5548_216878281\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5548_216878281\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zurmcwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrmjdbzw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqolgaytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkicavsnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdbvtnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xspnlfdxvs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upmkecwurp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkicavsnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhezwuomjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbywqolgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_fbf84aacb97c6738f6db430ebe9bf8b0_amadey_darkgate_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvsnkfcxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smkecwupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuoljdbywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_olgdywtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hczuspkhca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbywqolgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomgbzurjb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigeywtom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifaxvtnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	olgdywtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xspnlfdxvs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjebwuomjebztrmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvsnkfcxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkecwupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuoljdbywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icausnkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_upmkecwurp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zurmcwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrmjdbzw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomgbzurjb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigeywtom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqolgaytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhezwuomjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gecwurmjec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gecwurmjec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdbvtnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifaxvtnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icausnkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hczuspkhca.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2564	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4220	ipconfig.exe
3036	ipconfig.exe
4540	ipconfig.exe
5600	ipconfig.exe
4360	ipconfig.exe
428	ipconfig.exe
696	ipconfig.exe
5880	ipconfig.exe
4316	ipconfig.exe
4588	ipconfig.exe
3128	ipconfig.exe
1356	ipconfig.exe
5740	ipconfig.exe
1124	ipconfig.exe
4952	ipconfig.exe
4360	ipconfig.exe
3296	ipconfig.exe
2272	ipconfig.exe
4804	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134289516910029931"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{89E0928B-3597-43F0-9FA3-E1980ACB0D7A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3556	2026-07-19_fbf84aacb97c6738f6db430ebe9bf8b0_amadey_darkgate_elex_smoke-loader_stop.exe
3556	2026-07-19_fbf84aacb97c6738f6db430ebe9bf8b0_amadey_darkgate_elex_smoke-loader_stop.exe
3556	2026-07-19_fbf84aacb97c6738f6db430ebe9bf8b0_amadey_darkgate_elex_smoke-loader_stop.exe
3556	2026-07-19_fbf84aacb97c6738f6db430ebe9bf8b0_amadey_darkgate_elex_smoke-loader_stop.exe
3556	2026-07-19_fbf84aacb97c6738f6db430ebe9bf8b0_amadey_darkgate_elex_smoke-loader_stop.exe
3556	2026-07-19_fbf84aacb97c6738f6db430ebe9bf8b0_amadey_darkgate_elex_smoke-loader_stop.exe
3556	2026-07-19_fbf84aacb97c6738f6db430ebe9bf8b0_amadey_darkgate_elex_smoke-loader_stop.exe
3556	2026-07-19_fbf84aacb97c6738f6db430ebe9bf8b0_amadey_darkgate_elex_smoke-loader_stop.exe
3556	2026-07-19_fbf84aacb97c6738f6db430ebe9bf8b0_amadey_darkgate_elex_smoke-loader_stop.exe
3556	2026-07-19_fbf84aacb97c6738f6db430ebe9bf8b0_amadey_darkgate_elex_smoke-loader_stop.exe
3556	2026-07-19_fbf84aacb97c6738f6db430ebe9bf8b0_amadey_darkgate_elex_smoke-loader_stop.exe
3556	2026-07-19_fbf84aacb97c6738f6db430ebe9bf8b0_amadey_darkgate_elex_smoke-loader_stop.exe
3556	2026-07-19_fbf84aacb97c6738f6db430ebe9bf8b0_amadey_darkgate_elex_smoke-loader_stop.exe
3556	2026-07-19_fbf84aacb97c6738f6db430ebe9bf8b0_amadey_darkgate_elex_smoke-loader_stop.exe
3556	2026-07-19_fbf84aacb97c6738f6db430ebe9bf8b0_amadey_darkgate_elex_smoke-loader_stop.exe
3556	2026-07-19_fbf84aacb97c6738f6db430ebe9bf8b0_amadey_darkgate_elex_smoke-loader_stop.exe
3556	2026-07-19_fbf84aacb97c6738f6db430ebe9bf8b0_amadey_darkgate_elex_smoke-loader_stop.exe
3556	2026-07-19_fbf84aacb97c6738f6db430ebe9bf8b0_amadey_darkgate_elex_smoke-loader_stop.exe
3556	2026-07-19_fbf84aacb97c6738f6db430ebe9bf8b0_amadey_darkgate_elex_smoke-loader_stop.exe
3556	2026-07-19_fbf84aacb97c6738f6db430ebe9bf8b0_amadey_darkgate_elex_smoke-loader_stop.exe
3556	2026-07-19_fbf84aacb97c6738f6db430ebe9bf8b0_amadey_darkgate_elex_smoke-loader_stop.exe
3556	2026-07-19_fbf84aacb97c6738f6db430ebe9bf8b0_amadey_darkgate_elex_smoke-loader_stop.exe
3556	2026-07-19_fbf84aacb97c6738f6db430ebe9bf8b0_amadey_darkgate_elex_smoke-loader_stop.exe
3556	2026-07-19_fbf84aacb97c6738f6db430ebe9bf8b0_amadey_darkgate_elex_smoke-loader_stop.exe
3556	2026-07-19_fbf84aacb97c6738f6db430ebe9bf8b0_amadey_darkgate_elex_smoke-loader_stop.exe
3556	2026-07-19_fbf84aacb97c6738f6db430ebe9bf8b0_amadey_darkgate_elex_smoke-loader_stop.exe
3556	2026-07-19_fbf84aacb97c6738f6db430ebe9bf8b0_amadey_darkgate_elex_smoke-loader_stop.exe
3556	2026-07-19_fbf84aacb97c6738f6db430ebe9bf8b0_amadey_darkgate_elex_smoke-loader_stop.exe
3556	2026-07-19_fbf84aacb97c6738f6db430ebe9bf8b0_amadey_darkgate_elex_smoke-loader_stop.exe
3556	2026-07-19_fbf84aacb97c6738f6db430ebe9bf8b0_amadey_darkgate_elex_smoke-loader_stop.exe
3556	2026-07-19_fbf84aacb97c6738f6db430ebe9bf8b0_amadey_darkgate_elex_smoke-loader_stop.exe
3556	2026-07-19_fbf84aacb97c6738f6db430ebe9bf8b0_amadey_darkgate_elex_smoke-loader_stop.exe
3556	2026-07-19_fbf84aacb97c6738f6db430ebe9bf8b0_amadey_darkgate_elex_smoke-loader_stop.exe
3556	2026-07-19_fbf84aacb97c6738f6db430ebe9bf8b0_amadey_darkgate_elex_smoke-loader_stop.exe
3556	2026-07-19_fbf84aacb97c6738f6db430ebe9bf8b0_amadey_darkgate_elex_smoke-loader_stop.exe
3556	2026-07-19_fbf84aacb97c6738f6db430ebe9bf8b0_amadey_darkgate_elex_smoke-loader_stop.exe
3556	2026-07-19_fbf84aacb97c6738f6db430ebe9bf8b0_amadey_darkgate_elex_smoke-loader_stop.exe
3556	2026-07-19_fbf84aacb97c6738f6db430ebe9bf8b0_amadey_darkgate_elex_smoke-loader_stop.exe
3556	2026-07-19_fbf84aacb97c6738f6db430ebe9bf8b0_amadey_darkgate_elex_smoke-loader_stop.exe
3556	2026-07-19_fbf84aacb97c6738f6db430ebe9bf8b0_amadey_darkgate_elex_smoke-loader_stop.exe
3556	2026-07-19_fbf84aacb97c6738f6db430ebe9bf8b0_amadey_darkgate_elex_smoke-loader_stop.exe
3556	2026-07-19_fbf84aacb97c6738f6db430ebe9bf8b0_amadey_darkgate_elex_smoke-loader_stop.exe
3556	2026-07-19_fbf84aacb97c6738f6db430ebe9bf8b0_amadey_darkgate_elex_smoke-loader_stop.exe
3556	2026-07-19_fbf84aacb97c6738f6db430ebe9bf8b0_amadey_darkgate_elex_smoke-loader_stop.exe
3556	2026-07-19_fbf84aacb97c6738f6db430ebe9bf8b0_amadey_darkgate_elex_smoke-loader_stop.exe
3556	2026-07-19_fbf84aacb97c6738f6db430ebe9bf8b0_amadey_darkgate_elex_smoke-loader_stop.exe
3556	2026-07-19_fbf84aacb97c6738f6db430ebe9bf8b0_amadey_darkgate_elex_smoke-loader_stop.exe
3556	2026-07-19_fbf84aacb97c6738f6db430ebe9bf8b0_amadey_darkgate_elex_smoke-loader_stop.exe
3556	2026-07-19_fbf84aacb97c6738f6db430ebe9bf8b0_amadey_darkgate_elex_smoke-loader_stop.exe
3556	2026-07-19_fbf84aacb97c6738f6db430ebe9bf8b0_amadey_darkgate_elex_smoke-loader_stop.exe
3556	2026-07-19_fbf84aacb97c6738f6db430ebe9bf8b0_amadey_darkgate_elex_smoke-loader_stop.exe
3556	2026-07-19_fbf84aacb97c6738f6db430ebe9bf8b0_amadey_darkgate_elex_smoke-loader_stop.exe
3556	2026-07-19_fbf84aacb97c6738f6db430ebe9bf8b0_amadey_darkgate_elex_smoke-loader_stop.exe
3556	2026-07-19_fbf84aacb97c6738f6db430ebe9bf8b0_amadey_darkgate_elex_smoke-loader_stop.exe
3556	2026-07-19_fbf84aacb97c6738f6db430ebe9bf8b0_amadey_darkgate_elex_smoke-loader_stop.exe
3556	2026-07-19_fbf84aacb97c6738f6db430ebe9bf8b0_amadey_darkgate_elex_smoke-loader_stop.exe
2716	mjebwuomjebztrmj.exe
2716	mjebwuomjebztrmj.exe
2716	mjebwuomjebztrmj.exe
2716	mjebwuomjebztrmj.exe
2716	mjebwuomjebztrmj.exe
2716	mjebwuomjebztrmj.exe
2716	mjebwuomjebztrmj.exe
2716	mjebwuomjebztrmj.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe
5548	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	6040	i_uomgbzurjb.exe
Token: SeDebugPrivilege	3356	i_qoigeywtom.exe
Token: SeDebugPrivilege	5700	i_ysqolgaytq.exe
Token: SeDebugPrivilege	3028	i_qkicavsnlf.exe
Token: SeDebugPrivilege	3356	i_ifaxvtnlfd.exe
Token: SeDebugPrivilege	4104	i_xvsnkfcxvp.exe
Token: SeDebugPrivilege	932	i_smkecwupmh.exe
Token: SeDebugPrivilege	1888	i_jhezwuomjh.exe
Token: SeDebugPrivilege	2444	i_gecwurmjec.exe
Token: SeDebugPrivilege	1536	i_wuoljdbywq.exe
Token: SeDebugPrivilege	3668	i_olgdywtolg.exe
Token: SeDebugPrivilege	4824	i_fdbvtnlfdx.exe
Token: SeDebugPrivilege	3960	i_xspnlfdxvs.exe
Token: SeDebugPrivilege	5880	i_icausnkica.exe
Token: SeDebugPrivilege	5632	i_hczuspkhca.exe
Token: SeDebugPrivilege	2072	i_upmkecwurp.exe
Token: SeDebugPrivilege	5112	i_zurmcwuomg.exe
Token: SeDebugPrivilege	5316	i_bztrmjdbzw.exe
Token: SeDebugPrivilege	4536	i_gbywqolgey.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5548	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3556 wrote to memory of 2716	3556	2026-07-19_fbf84aacb97c6738f6db430ebe9bf8b0_amadey_darkgate_elex_smoke-loader_stop.exe	89
PID 3556 wrote to memory of 5780	3556	2026-07-19_fbf84aacb97c6738f6db430ebe9bf8b0_amadey_darkgate_elex_smoke-loader_stop.exe	90
PID 5780 wrote to memory of 5548	5780	iexplore.exe	91
PID 5548 wrote to memory of 1572	5548	msedge.exe	92
PID 5548 wrote to memory of 2564	5548	msedge.exe	93
PID 5548 wrote to memory of 5292	5548	msedge.exe	94
PID 5548 wrote to memory of 5292	5548	msedge.exe	94
PID 5548 wrote to memory of 5292	5548	msedge.exe	94
PID 5548 wrote to memory of 1928	5548	msedge.exe	95
PID 5548 wrote to memory of 1928	5548	msedge.exe	95
PID 5548 wrote to memory of 6068	5548	msedge.exe	97
PID 5548 wrote to memory of 6068	5548	msedge.exe	97
PID 5548 wrote to memory of 6068	5548	msedge.exe	97
PID 5548 wrote to memory of 4624	5548	msedge.exe	98
PID 5548 wrote to memory of 4624	5548	msedge.exe	98
PID 5548 wrote to memory of 4624	5548	msedge.exe	98
PID 5548 wrote to memory of 3520	5548	msedge.exe	99
PID 5548 wrote to memory of 4940	5548	msedge.exe	100
PID 5548 wrote to memory of 3520	5548	msedge.exe	99
PID 5548 wrote to memory of 3520	5548	msedge.exe	99
PID 5548 wrote to memory of 4940	5548	msedge.exe	100
PID 5548 wrote to memory of 4940	5548	msedge.exe	100
PID 5548 wrote to memory of 8	5548	msedge.exe	101
PID 5548 wrote to memory of 8	5548	msedge.exe	101
PID 5548 wrote to memory of 4136	5548	msedge.exe	105
PID 5548 wrote to memory of 4136	5548	msedge.exe	105
PID 5548 wrote to memory of 5496	5548	msedge.exe	106
PID 5548 wrote to memory of 5496	5548	msedge.exe	106
PID 5548 wrote to memory of 1180	5548	msedge.exe	108
PID 2716 wrote to memory of 1208	2716	mjebwuomjebztrmj.exe	109
PID 5548 wrote to memory of 2120	5548	msedge.exe	111
PID 5548 wrote to memory of 2120	5548	msedge.exe	111
PID 4648 wrote to memory of 1136	4648	uomgbzurjb.exe	113
PID 5548 wrote to memory of 4364	5548	msedge.exe	118
PID 5548 wrote to memory of 4364	5548	msedge.exe	118
PID 2716 wrote to memory of 4216	2716	mjebwuomjebztrmj.exe	119
PID 2716 wrote to memory of 4108	2716	mjebwuomjebztrmj.exe	123
PID 3040 wrote to memory of 1452	3040	qoigeywtom.exe	125
PID 2716 wrote to memory of 3700	2716	mjebwuomjebztrmj.exe	128
PID 2716 wrote to memory of 4356	2716	mjebwuomjebztrmj.exe	132
PID 5260 wrote to memory of 4260	5260	ysqolgaytq.exe	134
PID 2716 wrote to memory of 5164	2716	mjebwuomjebztrmj.exe	137
PID 2716 wrote to memory of 6068	2716	mjebwuomjebztrmj.exe	142
PID 4156 wrote to memory of 5732	4156	qkicavsnlf.exe	144
PID 2716 wrote to memory of 5100	2716	mjebwuomjebztrmj.exe	147
PID 5548 wrote to memory of 5572	5548	msedge.exe	149
PID 5548 wrote to memory of 5600	5548	msedge.exe	150
PID 5548 wrote to memory of 1536	5548	msedge.exe	151
PID 2716 wrote to memory of 6020	2716	mjebwuomjebztrmj.exe	154
PID 4616 wrote to memory of 2684	4616	ifaxvtnlfd.exe	156
PID 2716 wrote to memory of 3520	2716	mjebwuomjebztrmj.exe	159
PID 2716 wrote to memory of 5240	2716	mjebwuomjebztrmj.exe	163
PID 4324 wrote to memory of 5252	4324	xvsnkfcxvp.exe	165
PID 2716 wrote to memory of 2428	2716	mjebwuomjebztrmj.exe	168
PID 2716 wrote to memory of 5452	2716	mjebwuomjebztrmj.exe	172
PID 5952 wrote to memory of 2984	5952	smkecwupmh.exe	174
PID 2716 wrote to memory of 892	2716	mjebwuomjebztrmj.exe	177
PID 2716 wrote to memory of 1132	2716	mjebwuomjebztrmj.exe	181
PID 2840 wrote to memory of 2864	2840	jhezwuomjh.exe	183
PID 2716 wrote to memory of 2492	2716	mjebwuomjebztrmj.exe	186
PID 5548 wrote to memory of 5248	5548	msedge.exe	188
PID 5548 wrote to memory of 5248	5548	msedge.exe	188
PID 2716 wrote to memory of 124	2716	mjebwuomjebztrmj.exe	194
PID 1500 wrote to memory of 4908	1500	gecwurmjec.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-07-19_fbf84aacb97c6738f6db430ebe9bf8b0_amadey_darkgate_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_fbf84aacb97c6738f6db430ebe9bf8b0_amadey_darkgate_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3556
- C:\Temp\mjebwuomjebztrmj.exe
  C:\Temp\mjebwuomjebztrmj.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2716
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\uomgbzurjb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1208
  - - C:\Temp\uomgbzurjb.exe
      C:\Temp\uomgbzurjb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4648
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1136
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3296
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_uomgbzurjb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4216
  - - C:\Temp\i_uomgbzurjb.exe
      C:\Temp\i_uomgbzurjb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6040
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qoigeywtom.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4108
  - - C:\Temp\qoigeywtom.exe
      C:\Temp\qoigeywtom.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3040
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1452
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2272
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qoigeywtom.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3700
  - - C:\Temp\i_qoigeywtom.exe
      C:\Temp\i_qoigeywtom.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3356
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ysqolgaytq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4356
  - - C:\Temp\ysqolgaytq.exe
      C:\Temp\ysqolgaytq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5260
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4260
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1356
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ysqolgaytq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5164
  - - C:\Temp\i_ysqolgaytq.exe
      C:\Temp\i_ysqolgaytq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5700
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qkicavsnlf.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6068
  - - C:\Temp\qkicavsnlf.exe
      C:\Temp\qkicavsnlf.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4156
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5732
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4804
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qkicavsnlf.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5100
  - - C:\Temp\i_qkicavsnlf.exe
      C:\Temp\i_qkicavsnlf.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3028
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ifaxvtnlfd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6020
  - - C:\Temp\ifaxvtnlfd.exe
      C:\Temp\ifaxvtnlfd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4616
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2684
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4220
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ifaxvtnlfd.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3520
  - - C:\Temp\i_ifaxvtnlfd.exe
      C:\Temp\i_ifaxvtnlfd.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3356
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvsnkfcxvp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5240
  - - C:\Temp\xvsnkfcxvp.exe
      C:\Temp\xvsnkfcxvp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4324
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5252
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3036
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xvsnkfcxvp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2428
  - - C:\Temp\i_xvsnkfcxvp.exe
      C:\Temp\i_xvsnkfcxvp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4104
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\smkecwupmh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5452
  - - C:\Temp\smkecwupmh.exe
      C:\Temp\smkecwupmh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5952
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2984
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5740
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_smkecwupmh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:892
  - - C:\Temp\i_smkecwupmh.exe
      C:\Temp\i_smkecwupmh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:932
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jhezwuomjh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1132
  - - C:\Temp\jhezwuomjh.exe
      C:\Temp\jhezwuomjh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2840
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2864
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4540
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jhezwuomjh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2492
  - - C:\Temp\i_jhezwuomjh.exe
      C:\Temp\i_jhezwuomjh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1888
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gecwurmjec.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:124
  - - C:\Temp\gecwurmjec.exe
      C:\Temp\gecwurmjec.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1500
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4908
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4588
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gecwurmjec.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5844
  - - C:\Temp\i_gecwurmjec.exe
      C:\Temp\i_gecwurmjec.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2444
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wuoljdbywq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5816
  - - C:\Temp\wuoljdbywq.exe
      C:\Temp\wuoljdbywq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2608
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2536
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4952
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wuoljdbywq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4540
  - - C:\Temp\i_wuoljdbywq.exe
      C:\Temp\i_wuoljdbywq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1536
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\olgdywtolg.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5384
  - - C:\Temp\olgdywtolg.exe
      C:\Temp\olgdywtolg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3120
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5948
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1124
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_olgdywtolg.exe ups_ins
    3⤵
    PID:5892
  - - C:\Temp\i_olgdywtolg.exe
      C:\Temp\i_olgdywtolg.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3668
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fdbvtnlfdx.exe ups_run
    3⤵
    PID:4172
  - - C:\Temp\fdbvtnlfdx.exe
      C:\Temp\fdbvtnlfdx.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3988
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1196
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4360
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fdbvtnlfdx.exe ups_ins
    3⤵
    PID:4344
  - - C:\Temp\i_fdbvtnlfdx.exe
      C:\Temp\i_fdbvtnlfdx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4824
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xspnlfdxvs.exe ups_run
    3⤵
    PID:256
  - - C:\Temp\xspnlfdxvs.exe
      C:\Temp\xspnlfdxvs.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5144
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2740
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5600
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xspnlfdxvs.exe ups_ins
    3⤵
    PID:3236
  - - C:\Temp\i_xspnlfdxvs.exe
      C:\Temp\i_xspnlfdxvs.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3960
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\icausnkica.exe ups_run
    3⤵
    PID:2892
  - - C:\Temp\icausnkica.exe
      C:\Temp\icausnkica.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3036
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4228
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3128
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_icausnkica.exe ups_ins
    3⤵
    PID:2788
  - - C:\Temp\i_icausnkica.exe
      C:\Temp\i_icausnkica.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5880
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hczuspkhca.exe ups_run
    3⤵
    PID:1216
  - - C:\Temp\hczuspkhca.exe
      C:\Temp\hczuspkhca.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3388
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5268
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4360
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hczuspkhca.exe ups_ins
    3⤵
    PID:3428
  - - C:\Temp\i_hczuspkhca.exe
      C:\Temp\i_hczuspkhca.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5632
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\upmkecwurp.exe ups_run
    3⤵
    PID:1804
  - - C:\Temp\upmkecwurp.exe
      C:\Temp\upmkecwurp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4640
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2420
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:428
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_upmkecwurp.exe ups_ins
    3⤵
    PID:1524
  - - C:\Temp\i_upmkecwurp.exe
      C:\Temp\i_upmkecwurp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2072
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zurmcwuomg.exe ups_run
    3⤵
    PID:2076
  - - C:\Temp\zurmcwuomg.exe
      C:\Temp\zurmcwuomg.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3360
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4268
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:696
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zurmcwuomg.exe ups_ins
    3⤵
    PID:3960
  - - C:\Temp\i_zurmcwuomg.exe
      C:\Temp\i_zurmcwuomg.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5112
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bztrmjdbzw.exe ups_run
    3⤵
    PID:4424
  - - C:\Temp\bztrmjdbzw.exe
      C:\Temp\bztrmjdbzw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1848
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4548
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5880
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bztrmjdbzw.exe ups_ins
    3⤵
    PID:1148
  - - C:\Temp\i_bztrmjdbzw.exe
      C:\Temp\i_bztrmjdbzw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5316
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gbywqolgey.exe ups_run
    3⤵
    PID:3680
  - - C:\Temp\gbywqolgey.exe
      C:\Temp\gbywqolgey.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6132
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3544
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4316
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gbywqolgey.exe ups_ins
    3⤵
    PID:4708
  - - C:\Temp\i_gbywqolgey.exe
      C:\Temp\i_gbywqolgey.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4536
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffcb089c188,0x7ffcb089c194,0x7ffcb089c1a0
      4⤵
      PID:1572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,16181270249903865088,9714591821845047456,524288 --field-trial-handle=2416,i,13565383979266521792,2297187991977189350,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:11
      4⤵
      System Time Discovery
      PID:2564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1584,i,1224559802098162089,15244934591309335108,262144 --field-trial-handle=2416,i,13565383979266521792,2297187991977189350,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:2
      4⤵
      PID:5292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2248,i,9990548079920465272,11881559222495116261,524288 --field-trial-handle=2416,i,13565383979266521792,2297187991977189350,262144 --variations-seed-version --mojo-platform-channel-handle=2676 /prefetch:13
      4⤵
      PID:1928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3572,i,14371802864067930956,7866007455178097801,2097152 --field-trial-handle=2416,i,13565383979266521792,2297187991977189350,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
      4⤵
      PID:6068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3580,i,3498900114358547214,4399813155946427259,2097152 --field-trial-handle=2416,i,13565383979266521792,2297187991977189350,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
      4⤵
      PID:4624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,899427800419215350,11564106486009478082,2097152 --field-trial-handle=2416,i,13565383979266521792,2297187991977189350,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:9
      4⤵
      PID:3520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,8827396852426465832,9555235667567401019,2097152 --field-trial-handle=2416,i,13565383979266521792,2297187991977189350,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:1
      4⤵
      PID:4940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3736,i,8800243272800271613,4622338827306752184,524288 --field-trial-handle=2416,i,13565383979266521792,2297187991977189350,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:14
      4⤵
      PID:8
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,1575031285780800450,3069938127352389380,524288 --field-trial-handle=2416,i,13565383979266521792,2297187991977189350,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
      4⤵
      PID:4136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3700,i,14409323819497063275,15500576680694607692,524288 --field-trial-handle=2416,i,13565383979266521792,2297187991977189350,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:14
      4⤵
      PID:5496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,14478509489903124500,9673153419048586093,524288 --field-trial-handle=2416,i,13565383979266521792,2297187991977189350,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
      4⤵
      PID:4512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,14478509489903124500,9673153419048586093,524288 --field-trial-handle=2416,i,13565383979266521792,2297187991977189350,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
      4⤵
      PID:1180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,1324630483629703847,12810518127938741545,524288 --field-trial-handle=2416,i,13565383979266521792,2297187991977189350,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:14
      4⤵
      PID:2120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,16862624720068585686,10621284209697133677,524288 --field-trial-handle=2416,i,13565383979266521792,2297187991977189350,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:14
      4⤵
      PID:4364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3772,i,10946317293328695326,2189342887704072687,524288 --field-trial-handle=2416,i,13565383979266521792,2297187991977189350,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
      4⤵
      PID:5572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4368,i,3128664348244680896,12413662840173836032,524288 --field-trial-handle=2416,i,13565383979266521792,2297187991977189350,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:14
      4⤵
      PID:5600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4340,i,13737471010654709727,13496253231255994102,524288 --field-trial-handle=2416,i,13565383979266521792,2297187991977189350,262144 --variations-seed-version --mojo-platform-channel-handle=6804 /prefetch:14
      4⤵
      PID:1536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5608,i,14256828171722230885,13854947162630736153,524288 --field-trial-handle=2416,i,13565383979266521792,2297187991977189350,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:14
      4⤵
      PID:5248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,13550473744775792561,6898442206437499123,524288 --field-trial-handle=2416,i,13565383979266521792,2297187991977189350,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:14
      4⤵
      PID:2432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,7371524919519946260,6494795204241109059,524288 --field-trial-handle=2416,i,13565383979266521792,2297187991977189350,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:14
      4⤵
      PID:828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,11302089205219559549,16134099023122321942,524288 --field-trial-handle=2416,i,13565383979266521792,2297187991977189350,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:14
      4⤵
      PID:2408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=920,i,9173411898280569610,12390480537163103298,524288 --field-trial-handle=2416,i,13565383979266521792,2297187991977189350,262144 --variations-seed-version --mojo-platform-channel-handle=3320 /prefetch:14
      4⤵
      PID:424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5444,i,5159188267139712360,11901310445297655486,262144 --field-trial-handle=2416,i,13565383979266521792,2297187991977189350,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:10
      4⤵
      PID:2628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4840,i,9267373149796730389,13902687986581675001,524288 --field-trial-handle=2416,i,13565383979266521792,2297187991977189350,262144 --variations-seed-version --mojo-platform-channel-handle=924 /prefetch:14
      4⤵
      PID:3624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3576,i,2236048175966827201,11498241992787333488,524288 --field-trial-handle=2416,i,13565383979266521792,2297187991977189350,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:14
      4⤵
      PID:3144

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1732

C:\Temp\mjebwuomjebztrmj.sys
C:\Temp\mjebwuomjebztrmj.sys
1⤵
- Executes dropped EXE
PID:1452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:252

C:\Temp\wtrlgeywqo.sys
C:\Temp\wtrlgeywqo.sys
1⤵
- Executes dropped EXE
PID:2748

C:\Temp\aytqligdyw.sys
C:\Temp\aytqligdyw.sys
1⤵
- Executes dropped EXE
PID:3840

C:\Temp\bvtqligays.sys
C:\Temp\bvtqligays.sys
1⤵
- Executes dropped EXE
PID:1604

C:\Temp\nifaysqkif.sys
C:\Temp\nifaysqkif.sys
1⤵
- Executes dropped EXE
PID:1096

C:\Temp\uspnhfdxvp.sys
C:\Temp\uspnhfdxvp.sys
1⤵
- Executes dropped EXE
PID:4476

C:\Temp\rpnhczxrpk.sys
C:\Temp\rpnhczxrpk.sys
1⤵
- Executes dropped EXE
PID:5792

C:\Temp\rmkeczxupm.sys
C:\Temp\rmkeczxupm.sys
1⤵
- Executes dropped EXE
PID:1804

C:\Temp\uomkezwrom.sys
C:\Temp\uomkezwrom.sys
1⤵
- Executes dropped EXE
PID:3716

C:\Temp\bztrljhbzt.sys
C:\Temp\bztrljhbzt.sys
1⤵
- Executes dropped EXE
PID:4848

C:\Temp\qljdbytqoi.sys
C:\Temp\qljdbytqoi.sys
1⤵
- Executes dropped EXE
PID:2800

C:\Temp\ifdbvtnlgd.sys
C:\Temp\ifdbvtnlgd.sys
1⤵
PID:4548

C:\Temp\nlidbvtnlf.sys
C:\Temp\nlidbvtnlf.sys
1⤵
PID:3452

C:\Temp\hfdxvpnlfc.sys
C:\Temp\hfdxvpnlfc.sys
1⤵
PID:3748

C:\Temp\kicausmkec.sys
C:\Temp\kicausmkec.sys
1⤵
PID:420

C:\Temp\ecxukecxuo.sys
C:\Temp\ecxukecxuo.sys
1⤵
PID:4840

C:\Temp\bzxrpjhbzx.sys
C:\Temp\bzxrpjhbzx.sys
1⤵
PID:1112

C:\Temp\bztrljebzw.sys
C:\Temp\bztrljebzw.sys
1⤵
PID:1396

C:\Temp\dbztrligey.sys
C:\Temp\dbztrligey.sys
1⤵
PID:5988

C:\Temp\olgdywqoig.sys
C:\Temp\olgdywqoig.sys
1⤵
PID:2256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aytqligdyw.sys

Path C:\Temp\aytqligdyw.sys
Size 293KB
SHA256 4b27b3ba3d4cef7c5f7d21373ce1cd7c9e298e4938c228c9436cb2105f1b694b
MD5 6b6f266f55a755162cccab841018fa03
SHA1 b614b1bf3c89e7d92be415fdd41855bce15d4470
SHA512 fb158ca4bb8604f22fdc76cfcaea0f4271abacf91dd4c97b5826d8ef2afa6a01a7e3852b075c2bf868f53c9dc2ef23e6812673babed7066774717ffcbe70acbd
SSDEEP 3072:+tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:+IJjiJcbI03GBc3ucY5DCSj
TLSH
T177545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bvtqligays.sys

Path C:\Temp\bvtqligays.sys
Size 293KB
SHA256 8e921bc47d0d5e55e0b53c132c5ba7496ea3f80b74cf4459456d7c96146a41de
MD5 752e3213d2ac6bd78779752e488a3688
SHA1 c16ca1a0714f8fb63645d21dd0c5ad6d008945b5
SHA512 e0581a078a53b73934925eb1966845913af9a83af2e237d0731a09d888ada362b6744f929b4ba9f6cd86fdf5470adac13fed4edb9d5e5c645e7b0ce89b7fdb4f
SSDEEP 3072:xtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:xIJjiJcbI03GBc3ucY5DCSj
TLSH
T1A7545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ifaxvtnlfd.exe

Path C:\Temp\i_ifaxvtnlfd.exe
Size 384KB
SHA256 5f1b77a89431c3e67d589c39d3cd3b50d026082fa42f508d3158e221c7bda749
MD5 d6bd1ad0c0916632257ac18111c038dd
SHA1 935843355be5aaf1dea9b0b5076b108ea67c8721
SHA512 6b534b57f5f7ea13bac0bf967d32f2e4d611948598ca89e1e49aedad1f819e714cf61add16efe22001867d38a3af1964553665065e6870b3ca837d12da9da484
SSDEEP 3072:B9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:LctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T166847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qkicavsnlf.exe

Path C:\Temp\i_qkicavsnlf.exe
Size 384KB
SHA256 3dd1c6978173cc8672bf02164c5891b6ff75d9d34683974ffcef0fdee96c5750
MD5 ff12592b393089649f1814904e58c6a8
SHA1 63123c27c71062355c357a4d0495129f407f84b5
SHA512 84c0d9530d30d67eff8ba214d4330bf74638c90975fe415e1e952ec1bafb60b57ca58aebffc36122b436bc6897e6f143b39e5adb57d1e51eedb309adb9f3fd00
SSDEEP 3072:n9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:9ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1EB847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qoigeywtom.exe

Path C:\Temp\i_qoigeywtom.exe
Size 384KB
SHA256 9561707821eeb79acaa8895218d3790818f59a0864d9c2482646e9b1c326f8e8
MD5 9327a37369e027de47025acb4cae78fb
SHA1 e78f616e85c3bfd0c3c3c736865d4db8108e649e
SHA512 15def3da845ca11f3e1e253d9fbee63a95b5b6e5db6072c2621ccd860c4ec592ec26b8da270c8cb8c10d26103f10651e0c69aba228917b31d62ec96865c88b2c
SSDEEP 3072:19ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:XctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1FF847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_uomgbzurjb.exe

Path C:\Temp\i_uomgbzurjb.exe
Size 384KB
SHA256 682ebb71c62ec15e46d9423202888f2e8e20fe8e27e892055e293f0db6de5b3b
MD5 a356f34829866faa05de7bdb6b8cd043
SHA1 5a6e69e799cda8f265a3638b9c3323cd51c8e78c
SHA512 8daba609cfd1503c20855f22b93cc2a9099fab5c1829c9c65fb118fff3fdc10f05e74171493fdbcef392090de514bc0ad5c225d0a71597be8bb39a1a9f4e596c
SSDEEP 3072:i9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:4ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1BC847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ysqolgaytq.exe

Path C:\Temp\i_ysqolgaytq.exe
Size 384KB
SHA256 7dccd5088924c94de0c0eb7234bd0fecf360fa16efa50934a2bc51eee357b058
MD5 524d6abdb4e8729ebdc1d214b7322645
SHA1 1dd48e1bd5d74ad0a06bd46831de72536fc5d603
SHA512 615b1c9f979521d783384c5e7f09e2a56bde91d48395e12d6c5321c0c371532d269e25d556446f0c161dc79f79e904dd229710c55d0b1c477018b6ccc94b3c89
SSDEEP 3072:V9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:3ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1EE847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ifaxvtnlfd.exe

Path C:\Temp\ifaxvtnlfd.exe
Size 384KB
SHA256 463e43492cf56aed41289f442bed7dc1a7eb2f58b68525c426400931dffa19f3
MD5 97535970765dd2684cc9d7d5135182b9
SHA1 33a9215ab72c65cb3c288485482cd3fef412ac1e
SHA512 f12b7dfe56a9aed032c38b618eb1dd1167ce8966b7d00243f89e7104a1ee46fc99a66a7cd7645654e8e8d024f742e980e3d68f1ab715b11ab14b944e924074e5
SSDEEP 3072:r9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:ZctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T176846B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mjebwuomjebztrmj.exe

Path C:\Temp\mjebwuomjebztrmj.exe
Size 384KB
SHA256 399d64d982d42275aafc7ee32226b9d8d481d13aa0672f4f718781ec1ef15e13
MD5 be8c8c139cd4a9b81383f3e260f102b6
SHA1 75ca07334cc00a92302cfdb833c59b2a0be8836e
SHA512 eba61c6e04a3383159423f817b98b5319ea7e0089dc734f02ed489cef7ea54392a5683a8cdd1c0978d12d270457a923f9f597f5bc8a2ce760c3a2d36a8956ba7
SSDEEP 3072:M9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:WctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T17B847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mjebwuomjebztrmj.sys

Path C:\Temp\mjebwuomjebztrmj.sys
Size 293KB
SHA256 2b84f5906f8eb4a19c8bad0dd66d1f17102d247cc08be7f05705363b26574cc5
MD5 bb67f1eb9d11ed5c8502563b11e0ab21
SHA1 c5743bcdfb242a86a63fd721e3107b7370c4d2cd
SHA512 637fbd70078f9715ec37e67ee2321d5750d809d0f154c760dabb69f2ce924085b0888e333dc3a31b742355cf15f2853b0a8b0091cb95280b31b97b2d564266e1
SSDEEP 3072:XtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:XIJjiJcbI03GBc3ucY5DCSj
TLSH
T168545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nifaysqkif.sys

Path C:\Temp\nifaysqkif.sys
Size 293KB
SHA256 84e0368b48b981812ce278a1b1c3c9eaf0ffb2c0dc1dc3bf18cabf29ad27d1b1
MD5 39897088c4d033c41498a426550ed0de
SHA1 3d305b881f4d6cda2966e7e29be0881ebe9c6755
SHA512 632c1ebf59ef51d8cfad03d4e0531020181bb4f2be26f984ea985c06afaea1862384a2f799cec4cfd66dc8724ccfac976470f9e0c25ca50262e4d5ba9bdf8ef7
SSDEEP 3072:otKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:oIJjiJcbI03GBc3ucY5DCSj
TLSH
T190545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qkicavsnlf.exe

Path C:\Temp\qkicavsnlf.exe
Size 384KB
SHA256 06bf19bd6563444b37f2f7ef8aeb10d943d244294dbcbd7b5c21e04de7c7d500
MD5 91d7e9ed26afbdb34b6449bfb3e2d30d
SHA1 3460d36419e16e1a62fd7025b85258d07370827f
SHA512 29486f384a7643e236c102e09cca450cde7e6f1aec7d018e5e567ec326cac16c52f51bbeac5f39facf993dec4e4a71c13e6f02f42b84935c7cda78839cdb83e7
SSDEEP 3072:O9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:sctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F3847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qoigeywtom.exe

Path C:\Temp\qoigeywtom.exe
Size 384KB
SHA256 800408858b95d58415804641c40794a03db566a1e16db1ee8d112e37f4e9f649
MD5 cbb5c146c0762b0d339389f41cde3612
SHA1 643329b0cf2389f0132c85c2d9b1431908de9d62
SHA512 961a5e2a9a5bb8032a398f3941d70cbd2437b483b780fad60d68811194b284d4afbf580839db79b295b5f5c9a0fb14d98fba26ad70142fd47edc369cb0fe706d
SSDEEP 3072:c9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:mctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T151847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uomgbzurjb.exe

Path C:\Temp\uomgbzurjb.exe
Size 384KB
SHA256 51b59f3fbd797af36652985d29c36b54ee5bf714c5f9bc32ffd445e75565206e
MD5 cbf76d6480f5377860ab09eca67d4fcd
SHA1 3835d089dcc014625fe7c076c470543935bac3e5
SHA512 c0dbe56eb49019adc35fe7d0cbf4375bca68b481ddf76a4efe002cc30b716b0536f76015117301df5bbb393a647653b696ce02bf044c333cc15d767de495257c
SSDEEP 3072:79ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:pctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T123847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uspnhfdxvp.sys

Path C:\Temp\uspnhfdxvp.sys
Size 293KB
SHA256 ef5e061b1a8bc0aaca0723a45c09ddcafe24b6a610d25964d67c2308b6d21f49
MD5 bc516369baaf7f7eee6df73a14217114
SHA1 4284caebb86d6d08984516e37feea43db04665fc
SHA512 22d63c01c56e3cd7b8c7f70d15a7186439070e792b00ca25260b827318d1436026d163f35ed06c84d2b6150cf03309167141e95fff5d2b13dee905f21b3d97e3
SSDEEP 3072:RtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:RIJjiJcbI03GBc3ucY5DCSj
TLSH
T123545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wtrlgeywqo.sys

Path C:\Temp\wtrlgeywqo.sys
Size 293KB
SHA256 00078306f53516dcbd4f5cc6d322d378b166ab9892f2da750b29e837fe921906
MD5 0e6ce9cea603a618aeb5c420e1d8e0d6
SHA1 a7bd278c4e5ecbbdabb477cabfeeb1087d96ccb2
SHA512 3c97308940f686232addbf6fa17f289e4c473d0874eb167d9ef56732a44dcf0a82789cfa8f9e7dc6ec7963eb55611d2a1371f4058ec052d64b38515fcfbb4e7d
SSDEEP 3072:9tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:9IJjiJcbI03GBc3ucY5DCSj
TLSH
T1BC545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvsnkfcxvp.exe

Path C:\Temp\xvsnkfcxvp.exe
Size 384KB
SHA256 de736546609efc944357457bd2f5e4e449ee30367b9fa858d807a6ef76da9ce7
MD5 274612ee81fe0640a517a8d3e80e6c66
SHA1 9578116ebe686b86509cb2ad0804a37525bd03aa
SHA512 7d98f59aca852257b27ef6e3885e9ce5c96f92c394ab6cd0f87d532d362855a56da3ada4a4cbe16d88e771445804d8193291a98e6cbf55d388c59b4d4f1f973e
SSDEEP 3072:S9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:octFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B6847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ysqolgaytq.exe

Path C:\Temp\ysqolgaytq.exe
Size 384KB
SHA256 0a2d75716254f696b80ba8a4372e20ade61a20d11720457abb862dd62d76cc85
MD5 e8292a73e4ade58e63280b5ec8fa69ae
SHA1 3ad891ff523ab9d5887c936936eff676ad05ef36
SHA512 9ea8a8aa53e878aff2ac6f83cf49fd79b3dafeaabc1df605d85bd043cddf0793733dc4b2ee5231e79959c8714cd3c10268e19c67017c5ef18a5827beb7e39bb3
SSDEEP 3072:29ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:kctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T195847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 79d658f88ad4e153641ca58e2f8417361266f30e941e73ffec527dd3e2dd4830
MD5 eaff122db6b7da1a2a0e92209e1aa1d6
SHA1 5c628adecac6efb55cf7249039d62177ac07cd3d
SHA512 bea8c19bd51e6e5463fc9aab954a1938935cf6936048b7bc5eb8bfdc3d6cbed7cfa8c49d340e7afa66791a7bfd2638fe1f53f09bdbff7d0b82aae67f476baa7f
TLSH
T14541C8114B7B05EBC76313B52EF1A78572B083970F072FC94E5C39B869C1B235091029
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 2eb899796453540979aa398d4cd2101a6dd825a999cc36279c9e7f84e2123712
MD5 346123ce489875a3b65de48d98f24d61
SHA1 336bf706c4347c654e9a085ad4cddd34bd24894a
SHA512 9a329aff735045b318bc301eda17eecf70698fbbd1f29407a6d2d0bd2df510f238ae3d09cdefc4c4d923cb725e3dfbc3307218026590958094f6e2d0acf3a236
TLSH
T1AC41CDF7C6E8866E890156F0AA187E2BCE1D0914832C3D5AC9E4EF1B93F2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 7079f6f8b2f5e6fca08b4502aeab42d1a8fe40087a6cd9d061aecffd291b6752
MD5 142a563f60b84dbfb948e2c2e5100739
SHA1 4165910342b4c2aaaedfe21aa98b8d34d97df1b7
SHA512 b08dc36493ced105d927aa42f79a61db4a139b32d71b06fd24bf49cbd88f1968a32024fdd753189f93afdb7d0037fa868e3b02292a7cfbbf58f68ab614b00157
SSDEEP 192:sxRPRvpCe/fvscpQ5ZRQizoA8p9L/g6+WNC6B/YoPCYVFGTIgtJ:sxRPqe/fvscpQXRQvF/5h/aQE3
TLSH
T1CE32A4166E28A93B9CC7E21DBA65BF53D6F91033A1D11E48B7FC870C04E66DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 742131ab5edf7f2d57e0637580efd707d93d4d1e79a42c2c969ea59063c0b887
MD5 ca0b6aa7ff2805c44164d057d4737b0e
SHA1 3a2b036d174ca2a61967f34e13d7cdd119d812c8
SHA512 8c88c8d9aed07c2a3d0813a73f4054c1d75d60d36eab4730110f38130b26b15ea86e83b3f08951a900fb3b755d4e936f909bc86b746e124a86650879b9725d96
SSDEEP 192:sxRERvpCe/fvsnpQ5ZRQizoA8p9L/g6+WNC6B/YoPCYVFGTIgD7J:sxREqe/fvsnpQXRQvF/5h/aQEp
TLSH
T1414294166E28993B9CC7E21DBA65BF53D6F95033A1D11E48A7FC870C04E66DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 1e0c641900c37b4d18da3d82d8bbfba6dfb1b00159be2801677a114b995572c2
MD5 36113c1b39c01a369b08c34ab6fdab51
SHA1 f8492b7403a72f00632998bc70e548a601980c42
SHA512 c95447242aa01e4f9d31ff7633fc7fd8af6d7d625b3064b5c773d559b5e3c5c91eca723d2ff9964b920621f9fc06f911eff48d9d45c1490eb94847ce91212626
SSDEEP 192:sxRERvpCe/fvsnpd5ZRQizoA8p9L/g6+WNC6B/Yo5CYVFGTIgDxJ:sxREqe/fvsnpdXRQvF/5h/MQEH
TLSH
T1FA4295166D28993B9CC7E21DBA65BF63D6F95033A1D51E48B7FC870C00E66DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 4bf3067880b3a5a1d9de100f089abc8708a1931d5fd92ed0c0e7d2080ba7b955
MD5 bf9d0c2c30d4b30cc8e5b7657fc6b74a
SHA1 4ea57885bc823abe4d5d559ec009d74c118aef92
SHA512 f4138a4c8275ba443401dc573c91addd4c08391158ec0806989681962b95da9271146f299b6553648cdd650c92a2a2ff65eb6c948038f3bbee02a476fd05e456
SSDEEP 768:j26HRo7pLuL7MRWgs2f028F1+UoAYDCx9Tuqh0VfUC9xbog/OVMZBVuwJro9Te0d:j26HRUE7MRWgs2f02u1javZB4wi6a
TLSH
T1C2D2DB7B640DCABF4F800ADDEC197E9F6D6802CB9698CD8047FE951C02C6BEA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a373e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a373e.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 580201a0e3634cce00fe7c59af5a4a7b3093ef1c9604e92d1714a11e46e19509
MD5 a76faf94df2925eeed019bfb58641e2a
SHA1 6735cb7d16af5ff00dd417ec886d636bef6eee0d
SHA512 99ff5b79c3741b9b4c9d429f8bbfa423b6e3c187b198f9222e0de49000770b663c92675e36a6a020ac8f97e382834d7fb96d0ce9c60d75309d9ec2eff0be70f3
SSDEEP 768:Hrv+4UNbdX35J/TBOWvynZtnONXyer1IRCzni9wf:Hbsbx3fkSIqnbf
TLSH
T1D803BF31E4699E334DE2A296B10773837FB820A7C9C44B50EEEA5F4D019799E270F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 874b937f48e4d65303ff2d98547610995a723d34f452afa2528214ca254fa687
MD5 adc4f3b88e93fd85a58199242dd9babf
SHA1 b74cff443ee98b43367997ed4d248d62ef711603
SHA512 744963509b4b1c5d5a1e06af08693ef78dd9eda72744c90d294010aba1ebd9f450f0287d4d93bcd56690cefae68addc34527dc194702bc85a9b94f2fe710834c
SSDEEP 768:hrv+4UNbdz3yg/TBOWvy4ONXyer1IRCzniBCeVH1SK7:hbsbV3lZSIqn1EH1l
TLSH
T1EF03CF36A4A89E334DE2A3C6B14773437FB85057C6800790EDDE2F4E069B59D130B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 9f276b368c74f8879105cb053efac4004821636f6b77e7050fb48498ef5b0a15
MD5 874d4edac949da620a03fbe873c6cac0
SHA1 22d5873a82bbc723bc7dc10d9091ec18e0aa4302
SHA512 216d48f3244696501d96831dcf76fa19d0b43fec2f007ef4d60975b90f5507f7a1e9ae4c03dffcd176dbff23ce7174b584f999f86da0091fbecbf7475be1c5ee
SSDEEP 768:wj+9t3DJ/TBOWvynZtxONXyer1IRCzni9wb9Mx:P9t310SIqnbb+x
TLSH
T14EF2AE35E8569E234CD2A3DAB2473797BFF410B7C5C40A44EAEA6F4D05C7A5D070B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 073a0493a215e01bca4b2de998212c61a9a5d74bad8781a9f3460e67b704b6b1
MD5 58a6175bc6e02cd640e717ab564dad18
SHA1 d3bcc303680c77863d3da0f7fd8c9be4273d23c2
SHA512 464d41edaf1f961f3521c3ffe182624403e80f6bafe31cbaf114b02fc457846389b3bd38476690bf5d550c114cda89d6788996886b9c8cc77027df7d949da81a
SSDEEP 768:xF1j+9M3lwglucsOWvynZtOONXyer1IRCzni9wb9Mx:Q9M34VSIqnbb+x
TLSH
T1A01327F594D38A36D89E5797A33D2E86AEBCD067B4844980BBD55E4CCC825BFC30A805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

bd32ed2b-1ce9-43fd-a11a-637c2c00a483.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\bd32ed2b-1ce9-43fd-a11a-637c2c00a483.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5548_487420195\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 3a4de87b4b266aadc891ef0683f10b31c27e318e787698ea75511cac69fd24dd
MD5 7db26572082ccdb24ba0558adfcec241
SHA1 30fea17cc3ca2759842bbd26bb0712720d78ed84
SHA512 0fe95eba9dd4943ea65e0199052c828a77e4b2ae8ad4533ea2c78d2404c38bdff14e944b93ea7a64c9da2483aa71663e6b7f4768ea69f94013a5972d324ece8a
TLSH
T17B71E38357B9C6B3C5DE5FF502835648F5FF22380B6370350B555546AB30A7A64B8F48
MD5 SHA1 SHA512 TLSH

Submit Download

memory/420-424-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1096-268-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1112-462-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1396-467-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1452-62-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1604-256-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1804-309-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2256-491-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2748-182-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2800-361-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3452-409-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3716-324-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3748-420-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3840-229-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4476-289-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4548-388-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4840-444-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4848-336-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5792-305-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5988-487-0x0000000000010000-0x00000000000AB000-memory.dmp

Download