systex | 203f6a7bdcef009f826394ecaa89ab5887a6de83d4a4fa9e4f7af84c7249ce20

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 17:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_35f77dd0c3a9deb717aa2a955c39ccba_amadey_darkgate_elex_smoke-loader_stop.exe
Size 384KB
Sample260719-vpl8lsfv7m
SHA256 203f6a7bdcef009f826394ecaa89ab5887a6de83d4a4fa9e4f7af84c7249ce20
MD5 35f77dd0c3a9deb717aa2a955c39ccba
SHA1 ee00ac6d3158afeb6c04edd899d039daa12a80ce
SHA512 56d59f689acf29bfb8004caff5622a23c65734dcab9b4b2e773f474afbd8d7c904f06cde83d466bd8974a9f4a1dc9823de4f65bd43f41a2f60d1361a58e132a2
SSDEEP 3072:z9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:RctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T166847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
4768	ausmkecxupnhfzxr.exe
2088	ausmkecxupnhfzxr.sys
1840	CreateProcess.exe
4372	xspkhczxsp.exe
5832	CreateProcess.exe
3252	CreateProcess.exe
1300	i_xspkhczxsp.exe
1904	hczxrpmhez.sys
2116	CreateProcess.exe
1488	ecwuomhezx.exe
1984	CreateProcess.exe
2172	CreateProcess.exe
4244	i_ecwuomhezx.exe
4736	gezwuomgec.sys
2004	CreateProcess.exe
3436	ezwtrljgec.exe
2776	CreateProcess.exe
4576	CreateProcess.exe
5460	i_ezwtrljgec.exe
3544	bwtrljebwu.sys
6076	CreateProcess.exe
5028	bztrljebwt.exe
5360	CreateProcess.exe
3032	CreateProcess.exe
5680	i_bztrljebwt.exe
5436	ztrljdbytq.sys
5952	CreateProcess.exe
1828	qoigbytqlj.exe
2928	CreateProcess.exe
2728	CreateProcess.exe
2624	i_qoigbytqlj.exe
700	qligdywqoi.sys
2948	CreateProcess.exe
4216	qoigaysqli.exe
1900	CreateProcess.exe
4144	CreateProcess.exe
3080	i_qoigaysqli.exe
6128	ifaysqkida.sys
408	CreateProcess.exe
4528	caysqkicav.exe
4860	CreateProcess.exe
4532	CreateProcess.exe
4112	i_caysqkicav.exe
3864	vsnkfcausq.sys
2368	CreateProcess.exe
1648	vspkhfaxsq.exe
2936	CreateProcess.exe
4152	CreateProcess.exe
5216	i_vspkhfaxsq.exe
5068	xvpnhfaxsp.sys
3164	CreateProcess.exe
5980	hfzxrpkhca.exe
1600	CreateProcess.exe
3248	CreateProcess.exe
2556	i_hfzxrpkhca.exe
4160	hczurpnhfz.sys
1296	CreateProcess.exe
3404	eczxupmhez.exe
5476	CreateProcess.exe
5324	CreateProcess.exe
3580	i_eczxupmhez.exe
4904	kecwuomgez.sys
1308	CreateProcess.exe
5900	ecwuomgezw.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_666772371\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_1232479231\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_2100367952\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_265085282\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_265085282\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_666772371\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_1232479231\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_1232479231\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2708_1232479231\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vspkhfaxsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eczxupmhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezxrpjhczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigbytqlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwuomhezx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrljebwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezwtrljgec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfzxrpkhca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eczxupmhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywqoigbytr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aywqoigayt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlfdyvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvpnifay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxvpnifay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xspkhczxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqoigbytr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vspkhfaxsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnlfdyvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezxrpjhczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_35f77dd0c3a9deb717aa2a955c39ccba_amadey_darkgate_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ausmkecxupnhfzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigbytqlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigaysqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwuomgezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwuomgezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eztrljebwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrljebwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_caysqkicav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uspkhfaxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxupnhfzxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigaysqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezwtrljgec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	caysqkicav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfzxrpkhca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eztrljebwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aywqoigayt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uspkhfaxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxupnhfzxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xspkhczxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwuomhezx.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4140	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1296	ipconfig.exe
2520	ipconfig.exe
5184	ipconfig.exe
3628	ipconfig.exe
2412	ipconfig.exe
3888	ipconfig.exe
3476	ipconfig.exe
1208	ipconfig.exe
5732	ipconfig.exe
560	ipconfig.exe
2852	ipconfig.exe
3236	ipconfig.exe
2872	ipconfig.exe
4880	ipconfig.exe
1904	ipconfig.exe
3396	ipconfig.exe
4312	ipconfig.exe
5892	ipconfig.exe
632	ipconfig.exe
4284	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134289546090962587"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2246396966-3025826688-3847171515-1000\{EAFF9A77-24CD-4100-9B54-FEF6455BB752}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2976	2026-07-19_35f77dd0c3a9deb717aa2a955c39ccba_amadey_darkgate_elex_smoke-loader_stop.exe
2976	2026-07-19_35f77dd0c3a9deb717aa2a955c39ccba_amadey_darkgate_elex_smoke-loader_stop.exe
2976	2026-07-19_35f77dd0c3a9deb717aa2a955c39ccba_amadey_darkgate_elex_smoke-loader_stop.exe
2976	2026-07-19_35f77dd0c3a9deb717aa2a955c39ccba_amadey_darkgate_elex_smoke-loader_stop.exe
2976	2026-07-19_35f77dd0c3a9deb717aa2a955c39ccba_amadey_darkgate_elex_smoke-loader_stop.exe
2976	2026-07-19_35f77dd0c3a9deb717aa2a955c39ccba_amadey_darkgate_elex_smoke-loader_stop.exe
2976	2026-07-19_35f77dd0c3a9deb717aa2a955c39ccba_amadey_darkgate_elex_smoke-loader_stop.exe
2976	2026-07-19_35f77dd0c3a9deb717aa2a955c39ccba_amadey_darkgate_elex_smoke-loader_stop.exe
2976	2026-07-19_35f77dd0c3a9deb717aa2a955c39ccba_amadey_darkgate_elex_smoke-loader_stop.exe
2976	2026-07-19_35f77dd0c3a9deb717aa2a955c39ccba_amadey_darkgate_elex_smoke-loader_stop.exe
2976	2026-07-19_35f77dd0c3a9deb717aa2a955c39ccba_amadey_darkgate_elex_smoke-loader_stop.exe
2976	2026-07-19_35f77dd0c3a9deb717aa2a955c39ccba_amadey_darkgate_elex_smoke-loader_stop.exe
2976	2026-07-19_35f77dd0c3a9deb717aa2a955c39ccba_amadey_darkgate_elex_smoke-loader_stop.exe
2976	2026-07-19_35f77dd0c3a9deb717aa2a955c39ccba_amadey_darkgate_elex_smoke-loader_stop.exe
2976	2026-07-19_35f77dd0c3a9deb717aa2a955c39ccba_amadey_darkgate_elex_smoke-loader_stop.exe
2976	2026-07-19_35f77dd0c3a9deb717aa2a955c39ccba_amadey_darkgate_elex_smoke-loader_stop.exe
2976	2026-07-19_35f77dd0c3a9deb717aa2a955c39ccba_amadey_darkgate_elex_smoke-loader_stop.exe
2976	2026-07-19_35f77dd0c3a9deb717aa2a955c39ccba_amadey_darkgate_elex_smoke-loader_stop.exe
2976	2026-07-19_35f77dd0c3a9deb717aa2a955c39ccba_amadey_darkgate_elex_smoke-loader_stop.exe
2976	2026-07-19_35f77dd0c3a9deb717aa2a955c39ccba_amadey_darkgate_elex_smoke-loader_stop.exe
2976	2026-07-19_35f77dd0c3a9deb717aa2a955c39ccba_amadey_darkgate_elex_smoke-loader_stop.exe
2976	2026-07-19_35f77dd0c3a9deb717aa2a955c39ccba_amadey_darkgate_elex_smoke-loader_stop.exe
2976	2026-07-19_35f77dd0c3a9deb717aa2a955c39ccba_amadey_darkgate_elex_smoke-loader_stop.exe
2976	2026-07-19_35f77dd0c3a9deb717aa2a955c39ccba_amadey_darkgate_elex_smoke-loader_stop.exe
2976	2026-07-19_35f77dd0c3a9deb717aa2a955c39ccba_amadey_darkgate_elex_smoke-loader_stop.exe
2976	2026-07-19_35f77dd0c3a9deb717aa2a955c39ccba_amadey_darkgate_elex_smoke-loader_stop.exe
2976	2026-07-19_35f77dd0c3a9deb717aa2a955c39ccba_amadey_darkgate_elex_smoke-loader_stop.exe
2976	2026-07-19_35f77dd0c3a9deb717aa2a955c39ccba_amadey_darkgate_elex_smoke-loader_stop.exe
2976	2026-07-19_35f77dd0c3a9deb717aa2a955c39ccba_amadey_darkgate_elex_smoke-loader_stop.exe
2976	2026-07-19_35f77dd0c3a9deb717aa2a955c39ccba_amadey_darkgate_elex_smoke-loader_stop.exe
2976	2026-07-19_35f77dd0c3a9deb717aa2a955c39ccba_amadey_darkgate_elex_smoke-loader_stop.exe
2976	2026-07-19_35f77dd0c3a9deb717aa2a955c39ccba_amadey_darkgate_elex_smoke-loader_stop.exe
2976	2026-07-19_35f77dd0c3a9deb717aa2a955c39ccba_amadey_darkgate_elex_smoke-loader_stop.exe
2976	2026-07-19_35f77dd0c3a9deb717aa2a955c39ccba_amadey_darkgate_elex_smoke-loader_stop.exe
2976	2026-07-19_35f77dd0c3a9deb717aa2a955c39ccba_amadey_darkgate_elex_smoke-loader_stop.exe
2976	2026-07-19_35f77dd0c3a9deb717aa2a955c39ccba_amadey_darkgate_elex_smoke-loader_stop.exe
2976	2026-07-19_35f77dd0c3a9deb717aa2a955c39ccba_amadey_darkgate_elex_smoke-loader_stop.exe
2976	2026-07-19_35f77dd0c3a9deb717aa2a955c39ccba_amadey_darkgate_elex_smoke-loader_stop.exe
2976	2026-07-19_35f77dd0c3a9deb717aa2a955c39ccba_amadey_darkgate_elex_smoke-loader_stop.exe
2976	2026-07-19_35f77dd0c3a9deb717aa2a955c39ccba_amadey_darkgate_elex_smoke-loader_stop.exe
2976	2026-07-19_35f77dd0c3a9deb717aa2a955c39ccba_amadey_darkgate_elex_smoke-loader_stop.exe
2976	2026-07-19_35f77dd0c3a9deb717aa2a955c39ccba_amadey_darkgate_elex_smoke-loader_stop.exe
2976	2026-07-19_35f77dd0c3a9deb717aa2a955c39ccba_amadey_darkgate_elex_smoke-loader_stop.exe
2976	2026-07-19_35f77dd0c3a9deb717aa2a955c39ccba_amadey_darkgate_elex_smoke-loader_stop.exe
2976	2026-07-19_35f77dd0c3a9deb717aa2a955c39ccba_amadey_darkgate_elex_smoke-loader_stop.exe
2976	2026-07-19_35f77dd0c3a9deb717aa2a955c39ccba_amadey_darkgate_elex_smoke-loader_stop.exe
2976	2026-07-19_35f77dd0c3a9deb717aa2a955c39ccba_amadey_darkgate_elex_smoke-loader_stop.exe
2976	2026-07-19_35f77dd0c3a9deb717aa2a955c39ccba_amadey_darkgate_elex_smoke-loader_stop.exe
2976	2026-07-19_35f77dd0c3a9deb717aa2a955c39ccba_amadey_darkgate_elex_smoke-loader_stop.exe
2976	2026-07-19_35f77dd0c3a9deb717aa2a955c39ccba_amadey_darkgate_elex_smoke-loader_stop.exe
2976	2026-07-19_35f77dd0c3a9deb717aa2a955c39ccba_amadey_darkgate_elex_smoke-loader_stop.exe
2976	2026-07-19_35f77dd0c3a9deb717aa2a955c39ccba_amadey_darkgate_elex_smoke-loader_stop.exe
2976	2026-07-19_35f77dd0c3a9deb717aa2a955c39ccba_amadey_darkgate_elex_smoke-loader_stop.exe
2976	2026-07-19_35f77dd0c3a9deb717aa2a955c39ccba_amadey_darkgate_elex_smoke-loader_stop.exe
2976	2026-07-19_35f77dd0c3a9deb717aa2a955c39ccba_amadey_darkgate_elex_smoke-loader_stop.exe
2976	2026-07-19_35f77dd0c3a9deb717aa2a955c39ccba_amadey_darkgate_elex_smoke-loader_stop.exe
4768	ausmkecxupnhfzxr.exe
4768	ausmkecxupnhfzxr.exe
4768	ausmkecxupnhfzxr.exe
4768	ausmkecxupnhfzxr.exe
4768	ausmkecxupnhfzxr.exe
4768	ausmkecxupnhfzxr.exe
4768	ausmkecxupnhfzxr.exe
4768	ausmkecxupnhfzxr.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe
2708	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	1300	i_xspkhczxsp.exe
Token: SeDebugPrivilege	4244	i_ecwuomhezx.exe
Token: SeDebugPrivilege	5460	i_ezwtrljgec.exe
Token: SeDebugPrivilege	5680	i_bztrljebwt.exe
Token: SeDebugPrivilege	2624	i_qoigbytqlj.exe
Token: SeDebugPrivilege	3080	i_qoigaysqli.exe
Token: SeDebugPrivilege	4112	i_caysqkicav.exe
Token: SeDebugPrivilege	5216	i_vspkhfaxsq.exe
Token: SeDebugPrivilege	2556	i_hfzxrpkhca.exe
Token: SeDebugPrivilege	3580	i_eczxupmhez.exe
Token: SeDebugPrivilege	708	i_ecwuomgezw.exe
Token: SeDebugPrivilege	4624	i_eztrljebwt.exe
Token: SeDebugPrivilege	4316	i_ywqoigbytr.exe
Token: SeDebugPrivilege	1596	i_aywqoigayt.exe
Token: SeDebugPrivilege	4756	i_vtnlfdyvqo.exe
Token: SeDebugPrivilege	4284	i_fdxvpnifay.exe
Token: SeDebugPrivilege	3472	i_uspkhfaxsp.exe
Token: SeDebugPrivilege	5516	i_zxupnhfzxs.exe
Token: SeDebugPrivilege	2224	i_ezxrpjhczu.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2708	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 4768	2976	2026-07-19_35f77dd0c3a9deb717aa2a955c39ccba_amadey_darkgate_elex_smoke-loader_stop.exe	89
PID 2976 wrote to memory of 1336	2976	2026-07-19_35f77dd0c3a9deb717aa2a955c39ccba_amadey_darkgate_elex_smoke-loader_stop.exe	90
PID 1336 wrote to memory of 2708	1336	iexplore.exe	91
PID 2708 wrote to memory of 5256	2708	msedge.exe	92
PID 2708 wrote to memory of 4700	2708	msedge.exe	95
PID 2708 wrote to memory of 4140	2708	msedge.exe	94
PID 2708 wrote to memory of 4700	2708	msedge.exe	95
PID 2708 wrote to memory of 4700	2708	msedge.exe	95
PID 2708 wrote to memory of 2876	2708	msedge.exe	96
PID 2708 wrote to memory of 2876	2708	msedge.exe	96
PID 2708 wrote to memory of 240	2708	msedge.exe	97
PID 2708 wrote to memory of 252	2708	msedge.exe	98
PID 2708 wrote to memory of 240	2708	msedge.exe	97
PID 2708 wrote to memory of 240	2708	msedge.exe	97
PID 2708 wrote to memory of 252	2708	msedge.exe	98
PID 2708 wrote to memory of 252	2708	msedge.exe	98
PID 2708 wrote to memory of 1204	2708	msedge.exe	99
PID 2708 wrote to memory of 1204	2708	msedge.exe	99
PID 2708 wrote to memory of 1204	2708	msedge.exe	99
PID 2708 wrote to memory of 2964	2708	msedge.exe	100
PID 2708 wrote to memory of 2964	2708	msedge.exe	100
PID 2708 wrote to memory of 2964	2708	msedge.exe	100
PID 2708 wrote to memory of 2476	2708	msedge.exe	101
PID 2708 wrote to memory of 2476	2708	msedge.exe	101
PID 2708 wrote to memory of 4412	2708	msedge.exe	105
PID 2708 wrote to memory of 2244	2708	msedge.exe	106
PID 2708 wrote to memory of 4412	2708	msedge.exe	105
PID 2708 wrote to memory of 2244	2708	msedge.exe	106
PID 4768 wrote to memory of 1840	4768	ausmkecxupnhfzxr.exe	107
PID 2708 wrote to memory of 2496	2708	msedge.exe	110
PID 4372 wrote to memory of 5832	4372	xspkhczxsp.exe	112
PID 2708 wrote to memory of 4144	2708	msedge.exe	115
PID 2708 wrote to memory of 4144	2708	msedge.exe	115
PID 2708 wrote to memory of 3544	2708	msedge.exe	116
PID 2708 wrote to memory of 3544	2708	msedge.exe	116
PID 4768 wrote to memory of 3252	4768	ausmkecxupnhfzxr.exe	119
PID 4768 wrote to memory of 2116	4768	ausmkecxupnhfzxr.exe	123
PID 1488 wrote to memory of 1984	1488	ecwuomhezx.exe	125
PID 4768 wrote to memory of 2172	4768	ausmkecxupnhfzxr.exe	128
PID 4768 wrote to memory of 2004	4768	ausmkecxupnhfzxr.exe	132
PID 3436 wrote to memory of 2776	3436	ezwtrljgec.exe	134
PID 4768 wrote to memory of 4576	4768	ausmkecxupnhfzxr.exe	137
PID 4768 wrote to memory of 6076	4768	ausmkecxupnhfzxr.exe	142
PID 5028 wrote to memory of 5360	5028	bztrljebwt.exe	144
PID 4768 wrote to memory of 3032	4768	ausmkecxupnhfzxr.exe	147
PID 2708 wrote to memory of 1284	2708	msedge.exe	149
PID 2708 wrote to memory of 4280	2708	msedge.exe	150
PID 2708 wrote to memory of 560	2708	msedge.exe	151
PID 4768 wrote to memory of 5952	4768	ausmkecxupnhfzxr.exe	154
PID 1828 wrote to memory of 2928	1828	qoigbytqlj.exe	156
PID 4768 wrote to memory of 2728	4768	ausmkecxupnhfzxr.exe	159
PID 4768 wrote to memory of 2948	4768	ausmkecxupnhfzxr.exe	163
PID 4216 wrote to memory of 1900	4216	qoigaysqli.exe	165
PID 4768 wrote to memory of 4144	4768	ausmkecxupnhfzxr.exe	168
PID 4768 wrote to memory of 408	4768	ausmkecxupnhfzxr.exe	172
PID 4528 wrote to memory of 4860	4528	caysqkicav.exe	174
PID 4768 wrote to memory of 4532	4768	ausmkecxupnhfzxr.exe	177
PID 4768 wrote to memory of 2368	4768	ausmkecxupnhfzxr.exe	181
PID 1648 wrote to memory of 2936	1648	vspkhfaxsq.exe	183
PID 4768 wrote to memory of 4152	4768	ausmkecxupnhfzxr.exe	186
PID 2708 wrote to memory of 1832	2708	msedge.exe	188
PID 2708 wrote to memory of 1832	2708	msedge.exe	188
PID 4768 wrote to memory of 3164	4768	ausmkecxupnhfzxr.exe	194
PID 5980 wrote to memory of 1600	5980	hfzxrpkhca.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-07-19_35f77dd0c3a9deb717aa2a955c39ccba_amadey_darkgate_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_35f77dd0c3a9deb717aa2a955c39ccba_amadey_darkgate_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Temp\ausmkecxupnhfzxr.exe
  C:\Temp\ausmkecxupnhfzxr.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4768
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xspkhczxsp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1840
  - - C:\Temp\xspkhczxsp.exe
      C:\Temp\xspkhczxsp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4372
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5832
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3236
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xspkhczxsp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3252
  - - C:\Temp\i_xspkhczxsp.exe
      C:\Temp\i_xspkhczxsp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1300
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ecwuomhezx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2116
  - - C:\Temp\ecwuomhezx.exe
      C:\Temp\ecwuomhezx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1488
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1984
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2412
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ecwuomhezx.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2172
  - - C:\Temp\i_ecwuomhezx.exe
      C:\Temp\i_ecwuomhezx.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4244
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ezwtrljgec.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2004
  - - C:\Temp\ezwtrljgec.exe
      C:\Temp\ezwtrljgec.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3436
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2776
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3888
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ezwtrljgec.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4576
  - - C:\Temp\i_ezwtrljgec.exe
      C:\Temp\i_ezwtrljgec.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5460
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bztrljebwt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6076
  - - C:\Temp\bztrljebwt.exe
      C:\Temp\bztrljebwt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5028
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5360
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:632
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bztrljebwt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3032
  - - C:\Temp\i_bztrljebwt.exe
      C:\Temp\i_bztrljebwt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5680
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qoigbytqlj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5952
  - - C:\Temp\qoigbytqlj.exe
      C:\Temp\qoigbytqlj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1828
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2928
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4284
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qoigbytqlj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2728
  - - C:\Temp\i_qoigbytqlj.exe
      C:\Temp\i_qoigbytqlj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2624
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qoigaysqli.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2948
  - - C:\Temp\qoigaysqli.exe
      C:\Temp\qoigaysqli.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4216
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1900
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5184
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qoigaysqli.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4144
  - - C:\Temp\i_qoigaysqli.exe
      C:\Temp\i_qoigaysqli.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3080
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\caysqkicav.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:408
  - - C:\Temp\caysqkicav.exe
      C:\Temp\caysqkicav.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4528
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4860
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1296
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_caysqkicav.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4532
  - - C:\Temp\i_caysqkicav.exe
      C:\Temp\i_caysqkicav.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4112
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vspkhfaxsq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2368
  - - C:\Temp\vspkhfaxsq.exe
      C:\Temp\vspkhfaxsq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1648
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2936
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2520
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vspkhfaxsq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4152
  - - C:\Temp\i_vspkhfaxsq.exe
      C:\Temp\i_vspkhfaxsq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5216
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hfzxrpkhca.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3164
  - - C:\Temp\hfzxrpkhca.exe
      C:\Temp\hfzxrpkhca.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5980
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1600
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3628
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hfzxrpkhca.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3248
  - - C:\Temp\i_hfzxrpkhca.exe
      C:\Temp\i_hfzxrpkhca.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2556
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\eczxupmhez.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1296
  - - C:\Temp\eczxupmhez.exe
      C:\Temp\eczxupmhez.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3404
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5476
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3476
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_eczxupmhez.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5324
  - - C:\Temp\i_eczxupmhez.exe
      C:\Temp\i_eczxupmhez.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3580
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ecwuomgezw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1308
  - - C:\Temp\ecwuomgezw.exe
      C:\Temp\ecwuomgezw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5900
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1644
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1208
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ecwuomgezw.exe ups_ins
    3⤵
    PID:5180
  - - C:\Temp\i_ecwuomgezw.exe
      C:\Temp\i_ecwuomgezw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:708
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\eztrljebwt.exe ups_run
    3⤵
    PID:3268
  - - C:\Temp\eztrljebwt.exe
      C:\Temp\eztrljebwt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4244
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5384
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5732
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_eztrljebwt.exe ups_ins
    3⤵
    PID:2800
  - - C:\Temp\i_eztrljebwt.exe
      C:\Temp\i_eztrljebwt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4624
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ywqoigbytr.exe ups_run
    3⤵
    PID:5644
  - - C:\Temp\ywqoigbytr.exe
      C:\Temp\ywqoigbytr.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4300
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1568
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:560
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ywqoigbytr.exe ups_ins
    3⤵
    PID:3980
  - - C:\Temp\i_ywqoigbytr.exe
      C:\Temp\i_ywqoigbytr.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4316
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\aywqoigayt.exe ups_run
    3⤵
    PID:2312
  - - C:\Temp\aywqoigayt.exe
      C:\Temp\aywqoigayt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5500
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3860
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2872
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_aywqoigayt.exe ups_ins
    3⤵
    PID:2448
  - - C:\Temp\i_aywqoigayt.exe
      C:\Temp\i_aywqoigayt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1596
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtnlfdyvqo.exe ups_run
    3⤵
    PID:3152
  - - C:\Temp\vtnlfdyvqo.exe
      C:\Temp\vtnlfdyvqo.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6128
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3068
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4880
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtnlfdyvqo.exe ups_ins
    3⤵
    PID:1008
  - - C:\Temp\i_vtnlfdyvqo.exe
      C:\Temp\i_vtnlfdyvqo.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4756
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fdxvpnifay.exe ups_run
    3⤵
    PID:4316
  - - C:\Temp\fdxvpnifay.exe
      C:\Temp\fdxvpnifay.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4904
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3776
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1904
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fdxvpnifay.exe ups_ins
    3⤵
    PID:3624
  - - C:\Temp\i_fdxvpnifay.exe
      C:\Temp\i_fdxvpnifay.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4284
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\uspkhfaxsp.exe ups_run
    3⤵
    PID:1596
  - - C:\Temp\uspkhfaxsp.exe
      C:\Temp\uspkhfaxsp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4852
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5732
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2852
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_uspkhfaxsp.exe ups_ins
    3⤵
    PID:1448
  - - C:\Temp\i_uspkhfaxsp.exe
      C:\Temp\i_uspkhfaxsp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3472
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zxupnhfzxs.exe ups_run
    3⤵
    PID:4508
  - - C:\Temp\zxupnhfzxs.exe
      C:\Temp\zxupnhfzxs.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1676
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2720
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3396
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zxupnhfzxs.exe ups_ins
    3⤵
    PID:4112
  - - C:\Temp\i_zxupnhfzxs.exe
      C:\Temp\i_zxupnhfzxs.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5516
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ezxrpjhczu.exe ups_run
    3⤵
    PID:4196
  - - C:\Temp\ezxrpjhczu.exe
      C:\Temp\ezxrpjhczu.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5208
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1716
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4312
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ezxrpjhczu.exe ups_ins
    3⤵
    PID:2592
  - - C:\Temp\i_ezxrpjhczu.exe
      C:\Temp\i_ezxrpjhczu.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2224
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljebztrmje.exe ups_run
    3⤵
    PID:5964
  - - C:\Temp\ljebztrmje.exe
      C:\Temp\ljebztrmje.exe ups_run
      4⤵
      PID:5012
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1680
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5892
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ff81657c188,0x7ff81657c194,0x7ff81657c1a0
      4⤵
      PID:5256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,1778059466760309667,11695162200158525216,524288 --field-trial-handle=2556,i,13776654274546825445,797256293414921872,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:11
      4⤵
      System Time Discovery
      PID:4140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,10805854534481558994,1136051757541072985,262144 --field-trial-handle=2556,i,13776654274546825445,797256293414921872,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:2
      4⤵
      PID:4700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2280,i,17906383483387091078,2896128762101443535,524288 --field-trial-handle=2556,i,13776654274546825445,797256293414921872,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:13
      4⤵
      PID:2876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3560,i,11063941490008750004,1323507940649377353,2097152 --field-trial-handle=2556,i,13776654274546825445,797256293414921872,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
      4⤵
      PID:240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3556,i,2567651820728279178,12829808242866442193,2097152 --field-trial-handle=2556,i,13776654274546825445,797256293414921872,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
      4⤵
      PID:252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4360,i,18085520955580062332,12809082240566220846,2097152 --field-trial-handle=2556,i,13776654274546825445,797256293414921872,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:1
      4⤵
      PID:1204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4372,i,3024556983851404097,14421816807079029623,2097152 --field-trial-handle=2556,i,13776654274546825445,797256293414921872,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:9
      4⤵
      PID:2964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,6121183810095320468,15313009508775871997,524288 --field-trial-handle=2556,i,13776654274546825445,797256293414921872,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:14
      4⤵
      PID:2476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,15807827736534636095,17703654117461090677,524288 --field-trial-handle=2556,i,13776654274546825445,797256293414921872,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:14
      4⤵
      PID:4412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,15817014993197212895,4311484026014958679,524288 --field-trial-handle=2556,i,13776654274546825445,797256293414921872,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:14
      4⤵
      PID:2244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,3220618254168116761,15149589088007885015,524288 --field-trial-handle=2556,i,13776654274546825445,797256293414921872,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:14
      4⤵
      PID:1828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,3220618254168116761,15149589088007885015,524288 --field-trial-handle=2556,i,13776654274546825445,797256293414921872,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:14
      4⤵
      PID:2496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,7750394077449876152,16341920539498398502,524288 --field-trial-handle=2556,i,13776654274546825445,797256293414921872,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:14
      4⤵
      PID:4144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,9939751844469520865,6882119168364358318,524288 --field-trial-handle=2556,i,13776654274546825445,797256293414921872,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:14
      4⤵
      PID:3544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,2233624889068573049,9661484418081157342,524288 --field-trial-handle=2556,i,13776654274546825445,797256293414921872,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:14
      4⤵
      PID:1284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,351020975718578223,8071398564715753345,524288 --field-trial-handle=2556,i,13776654274546825445,797256293414921872,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:14
      4⤵
      PID:4280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,317292458394762072,5671524952348641269,524288 --field-trial-handle=2556,i,13776654274546825445,797256293414921872,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:14
      4⤵
      PID:560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,11741677104835710445,14506968279605320394,524288 --field-trial-handle=2556,i,13776654274546825445,797256293414921872,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:14
      4⤵
      PID:1832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3284,i,17298118076026991804,12277006942604313473,524288 --field-trial-handle=2556,i,13776654274546825445,797256293414921872,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:14
      4⤵
      PID:3524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5636,i,13774167491921826630,15415682169066593519,524288 --field-trial-handle=2556,i,13776654274546825445,797256293414921872,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:14
      4⤵
      PID:680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,2492288407503255576,3741395984676413970,524288 --field-trial-handle=2556,i,13776654274546825445,797256293414921872,262144 --variations-seed-version --mojo-platform-channel-handle=6856 /prefetch:14
      4⤵
      PID:2100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=912,i,14579706544243734667,1786593589053279441,262144 --field-trial-handle=2556,i,13776654274546825445,797256293414921872,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:10
      4⤵
      PID:4892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6652,i,12515909046140530040,9486579958179497133,524288 --field-trial-handle=2556,i,13776654274546825445,797256293414921872,262144 --variations-seed-version --mojo-platform-channel-handle=4088 /prefetch:14
      4⤵
      PID:5916

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5756

C:\Temp\ausmkecxupnhfzxr.sys
C:\Temp\ausmkecxupnhfzxr.sys
1⤵
- Executes dropped EXE
PID:2088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4812

C:\Temp\hczxrpmhez.sys
C:\Temp\hczxrpmhez.sys
1⤵
- Executes dropped EXE
PID:1904

C:\Temp\gezwuomgec.sys
C:\Temp\gezwuomgec.sys
1⤵
- Executes dropped EXE
PID:4736

C:\Temp\bwtrljebwu.sys
C:\Temp\bwtrljebwu.sys
1⤵
- Executes dropped EXE
PID:3544

C:\Temp\ztrljdbytq.sys
C:\Temp\ztrljdbytq.sys
1⤵
- Executes dropped EXE
PID:5436

C:\Temp\qligdywqoi.sys
C:\Temp\qligdywqoi.sys
1⤵
- Executes dropped EXE
PID:700

C:\Temp\ifaysqkida.sys
C:\Temp\ifaysqkida.sys
1⤵
- Executes dropped EXE
PID:6128

C:\Temp\vsnkfcausq.sys
C:\Temp\vsnkfcausq.sys
1⤵
- Executes dropped EXE
PID:3864

C:\Temp\xvpnhfaxsp.sys
C:\Temp\xvpnhfaxsp.sys
1⤵
- Executes dropped EXE
PID:5068

C:\Temp\hczurpnhfz.sys
C:\Temp\hczurpnhfz.sys
1⤵
- Executes dropped EXE
PID:4160

C:\Temp\kecwuomgez.sys
C:\Temp\kecwuomgez.sys
1⤵
- Executes dropped EXE
PID:4904

C:\Temp\eywromgebw.sys
C:\Temp\eywromgebw.sys
1⤵
PID:4500

C:\Temp\jgbywuomge.sys
C:\Temp\jgbywuomge.sys
1⤵
PID:3476

C:\Temp\bytqljdbvt.sys
C:\Temp\bytqljdbvt.sys
1⤵
PID:3776

C:\Temp\sqolfdxvtn.sys
C:\Temp\sqolfdxvtn.sys
1⤵
PID:3180

C:\Temp\nkfdxvsnkf.sys
C:\Temp\nkfdxvsnkf.sys
1⤵
PID:4196

C:\Temp\fcxvpnkifa.sys
C:\Temp\fcxvpnkifa.sys
1⤵
PID:1544

C:\Temp\causmkecxu.sys
C:\Temp\causmkecxu.sys
1⤵
PID:4572

C:\Temp\ecwuomkecz.sys
C:\Temp\ecwuomkecz.sys
1⤵
PID:3428

C:\Temp\trmjebwuom.sys
C:\Temp\trmjebwuom.sys
1⤵
PID:3800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ausmkecxupnhfzxr.exe

Path C:\Temp\ausmkecxupnhfzxr.exe
Size 384KB
SHA256 7980c5f2cc148f4bc6f92cc300c180c0229a5ba2730446deebe61a8ffeadf1c1
MD5 ec44c6a7368030599663f4e317ce313e
SHA1 6ad251d31c39603407a027b925d590d687b743a3
SHA512 1b840c905ab14627d56406f1210e373477d946c5bb382ed7fc9a1d624a244372afffcc35529e0bb43d9019217c4961d8f396b0d2f63d43fda4dda4aba6ab4a9a
SSDEEP 3072:V9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:3ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T176847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ausmkecxupnhfzxr.sys

Path C:\Temp\ausmkecxupnhfzxr.sys
Size 293KB
SHA256 c6b61d84388044d78c96b0b20186ced7e40a84a0fb14f460fc77b836df5d7737
MD5 a57cd4c42e8f0570b5c7631a3d2df213
SHA1 84c3b7fa71d495b86a2b4a55c8ccb47c1bd52422
SHA512 c96c85b86fe1699b8baa5fcd12e70914f3678824279733f57cfaa46d26054150c9ef16ea3887a8f5b91b4e7ace2b2ee7c004c8e8b197493e2d01851ee45bb325
SSDEEP 3072:MtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:MIJjiJcbI03GBc3ucY5DCSj
TLSH
T1D4545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bwtrljebwu.sys

Path C:\Temp\bwtrljebwu.sys
Size 293KB
SHA256 073221c23237a6057776b7fe9c4245bbbf80bd0c0803870c3c5c5a2369435dd1
MD5 9f0b77a93c595d9f1c35a527263109a8
SHA1 25e57203d2d4aae8beac77125c8bb768316b69e8
SHA512 3c938565431a8a33ff05938bf52018a7a6348744f59cda7da2a2484068ed0aa708157949fff0abe54505b1a2524e527c29faf85b8a9aa84e0c60feececdd7b9d
SSDEEP 3072:PtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:PIJjiJcbI03GBc3ucY5DCSj
TLSH
T11D545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bztrljebwt.exe

Path C:\Temp\bztrljebwt.exe
Size 384KB
SHA256 8bc445acab5c81c685b333b3eeff6c4b4bb73555e233ec8de6a4a931b329d2fb
MD5 7aad4b21ba1cd6832b8e9f697782722c
SHA1 0e15bb62573cc2e68fff1efd2b32ab05c0bffe2c
SHA512 7d15d686b57c192c5a3bb1c7c71e38c7d0d7d93daf4a9eb9374680823e34641f73f53faa42d6c65a2cdd03c43051864f8278593a5e8dc495a1a2e0ef61f6c71b
SSDEEP 3072:M9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:WctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T10E847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecwuomhezx.exe

Path C:\Temp\ecwuomhezx.exe
Size 384KB
SHA256 027e5b1c2446c8c617b61c6f1f2f1f2c9ea9d86327210963cec123cefd3a95b5
MD5 f1090b57d9753985e3c924f936d31633
SHA1 8b5939f872a21d376eb777f0bd605ef4bc71868d
SHA512 84dc771c93c250b1d30199ae3d32eb7720c93f0397a7cb7ff9f991776e5aaca5bedbb52615a9a32fd14649f97027092f76aaff17408bbc518a067076cd1a326a
SSDEEP 3072:39ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:NctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T13F847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ezwtrljgec.exe

Path C:\Temp\ezwtrljgec.exe
Size 384KB
SHA256 709583f2e1e6cb4d0dccffc29b4afbf2f4d218db2d79bb9f0dd028ddc4851de3
MD5 ce377237734eac460a8c465dcf0a1932
SHA1 fa08241d0728f6cf6ff972ce5c72c12570233269
SHA512 17702137343a32db09108db4163ba9a0fa0bbe7b7bda930207a1d969d765460282c8c1e1df341a72018aebcaef1e8a8ea3117200c48f3d653b9077b5bfab346e
SSDEEP 3072:99ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:PctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1AD847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gezwuomgec.sys

Path C:\Temp\gezwuomgec.sys
Size 293KB
SHA256 2396c950c09da3ada3afe10eaa40dc4776630bd871f14a8f846ca4896094ba59
MD5 08aeed5a54ae865266678ea7e5bc898e
SHA1 af8997ff71f9316c40e8111a28a115882ed76ee0
SHA512 3387d0979c19fd47ff290c92be45ab32ff042a781d02c0be66886b0f4c0a5a772e314607b5b1a3ecc8edefe2cd8751478a8531e5731aad0fbd86f5fa7cce1277
SSDEEP 3072:qtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:qIJjiJcbI03GBc3ucY5DCSj
TLSH
T1AF545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hczxrpmhez.sys

Path C:\Temp\hczxrpmhez.sys
Size 293KB
SHA256 5f67696f958d4da0a10c7b79deef4ab7086ab98d9680eef40d705d5ee014073b
MD5 26dc92b61ed445a0d52c83b60d388f50
SHA1 3f94b5263611336cbf33b8220d0287eb29414d8d
SHA512 1d0f9bb54eea66a19e3f6c8f302f48219bb50bb100d2eb0fd1f7b9513f8a7626bbec8bea2665770a900550f7426bfba897f07e56dd67141dbfc732f4aa35a452
SSDEEP 3072:AtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:AIJjiJcbI03GBc3ucY5DCSj
TLSH
T148545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bztrljebwt.exe

Path C:\Temp\i_bztrljebwt.exe
Size 384KB
SHA256 e704dba759c6a8f97b76c26d8941d5796264d425c1356afcb7550f2a6069e0e9
MD5 2d324896c79e6467f5ec90415246d8af
SHA1 35359c4c211c093ddeeb7680fb74a02ecd70cfd9
SHA512 c7e9082516adb7aca59a020caf3430627ec6cb87674c306c8ae52c3c52d179c25bce4e4d76fe28683bc85a1313ed69c6c76b4e74f0ac01dfe509f61bfd98b3c7
SSDEEP 3072:a9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:ActFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T147847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ecwuomhezx.exe

Path C:\Temp\i_ecwuomhezx.exe
Size 384KB
SHA256 7036d9e01cb70effcb7011eadb1e5d4329f6b41246758e1b2e147915ea4ecee6
MD5 f33f2bf4602c76a494d193d70efd0cca
SHA1 e3504ef62bb8ad3cf62342d6a6ec360c667e9689
SHA512 dc62954994a96d99519aa503a03cebd95312b390550b8bc70d644d17b005b4e627055d6be761ee751ab512470bc8f4724578044e15caf24270e06cec165fc145
SSDEEP 3072:79ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:pctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T138847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ezwtrljgec.exe

Path C:\Temp\i_ezwtrljgec.exe
Size 384KB
SHA256 f76fc12d116c14645e3d23ad154e95cecba0444456c6eed299a3067f2c76ca72
MD5 efdf43f653b75b495fe6afb47cfc1b93
SHA1 3a58bf45fd375bc880d7868e61119b165156e0ab
SHA512 e2da10d13228fe700dca89640711d433bdf54575cc2215a33d76e4279fc19a4a1d07479c7788c489f0e40ef4d6a196c85ef1e7a87f4452ae66e69e70c2bf423b
SSDEEP 3072:t9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:/ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T17A847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qoigbytqlj.exe

Path C:\Temp\i_qoigbytqlj.exe
Size 384KB
SHA256 e0c2e60bc2328d7fa49e91aff4bfc2df5be384f4dc45f9d7d81c9dd971691c1d
MD5 801bf849b0dc0896a946ab2cf64cb28c
SHA1 d597f93eacfd3938bc0d6e1e85f8e7d7644f4269
SHA512 9c1cd9248b8477dd3760326f28040d47a78183c01fd86fa7af77b207d2d5344ba241db53637841177a004e216f81530e61c437ff62ad28f8cb52a51cf772c81e
SSDEEP 3072:R9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:bctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C8847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xspkhczxsp.exe

Path C:\Temp\i_xspkhczxsp.exe
Size 384KB
SHA256 98c2a9bc4211b594b5b4915291056e582b4d028ffbe42fcbeb129d8bf637126d
MD5 52098b0c84e9b21bc1f6f8b0ec30a1c1
SHA1 dccac4035d569677eef68c5bae6fe1ebb1d69422
SHA512 ca81238543bf460497432bc81b85b6c82d5d36f5c5fe6f7df374dca5ba74ca381d8f93adfd52e87e446733e080cc12ce41545ae39e9f74803dc4ff647bd56c19
SSDEEP 3072:g/9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9N:octFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B4847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qligdywqoi.sys

Path C:\Temp\qligdywqoi.sys
Size 293KB
SHA256 44d249969fd026209e36bd4b953052aa02cce0296ebdeb0c2d3b48caeedc3447
MD5 bf7deac3fdef8ef962cb8594399f0185
SHA1 9a00807041b62d672006841b32ef0e7893b4bad6
SHA512 5e806093747a14afaffae95de70da92b68f90bb020c152fec7a0bb02c0fb320114cccbd319b98a2a2aa74e20ab7699869dd9f205ca077084e4180fbe23563325
SSDEEP 3072:ytKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:yIJjiJcbI03GBc3ucY5DCSj
TLSH
T111545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qoigaysqli.exe

Path C:\Temp\qoigaysqli.exe
Size 384KB
SHA256 177004dd6e04eb450d75d8c23c7d5b14e5a799ddb590d788e23ab816f37e91aa
MD5 10a1c92230a084c48e7e3d874b9eb1c6
SHA1 3625b7a64dce43ce347483fa3092ba77ad08fd46
SHA512 d906feadd4aab2ff5576ecfe407a833e7f392b8352c6b344667b13c619e8556e235d870521d0c02afcfeadb1ebcceb441ef70080914004e6615228a0eb7e1d59
SSDEEP 3072:P9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:VctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T183846A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qoigbytqlj.exe

Path C:\Temp\qoigbytqlj.exe
Size 384KB
SHA256 2eb39d3aeb6fed523ffceff1d8058266c370dfb59397c527bc73a6cafe0eb2bc
MD5 28ddd31054d8d2f560d943942be5f8fb
SHA1 9ecb83895893f5ed42045f481e928543616d7d2f
SHA512 05368e3387ed005272d735b2b54805464340fd08acee9f23e58978233de0ca05ac81561e8b3c615dc738bb47c658a461c1dccf5d3dcc2ee835a462e2e38bfcc8
SSDEEP 3072:69ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:gctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T142847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xspkhczxsp.exe

Path C:\Temp\xspkhczxsp.exe
Size 384KB
SHA256 12407a6f9c7f7c444593b8ad3180a3f78c252e81cf53ea8f18d63108da84e519
MD5 cf1b47349e7f631cbd7980c4b616cb7f
SHA1 85e5e908249c5f30e0ddb5ef7c340e50eb31d005
SHA512 448050114a958463807ed594cfba563941407ee9c5d921c29cbfd9bf3a6a0f7fb42bb82178c8ee81d7226e81fd3b8838b5b6b6b546767c97b491d42961ffdb8c
SSDEEP 3072:r9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:ZctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F5847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ztrljdbytq.sys

Path C:\Temp\ztrljdbytq.sys
Size 293KB
SHA256 fb5cacb9de2b5f6f1bd56de5abb914a47407bc2a42e83e6f0d0c48d60f5828b8
MD5 1c6e18f3c8627cacef7b3fd9f0a19591
SHA1 111157c6ef371adafd8cae89e3433656ee847b64
SHA512 265adbff7b466ca2485192558afd4b4dd9e699771bc63097b672cabe00da3b9b250849ec07b39d90731df396e865bc9ed71bc165ffb1322eb1ada6f9f6a63692
SSDEEP 3072:EtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:EIJjiJcbI03GBc3ucY5DCSj
TLSH
T159545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 67b546fed422708faf33930b82ff4826bc323bc64f67af30b02bb9e565fa27ee
MD5 04925ec9b8ab191e010732cba0eeefe1
SHA1 a6847bd1b4e86ab3cf9f2a8e109e78b04f51204d
SHA512 25e65b33281d8c58aaf4bad265d912d01bcadd9284dc1ce818ccc1dcf59200f57de5e8d8f4ce5ef6da06c777b54dd4dbee7a3aad7a16da9542538e92104e9c68
TLSH
T1C7D0C0343948E288C9832172DCA033117320007074B147054031B41CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 e46a6816f1d862c6466cb33393bdbaa81e6cba8e8bda601a24c24e1f8aa9bd3e
MD5 f69a13110d3cc37e04641d21e1f87f87
SHA1 d184d2a53d8324fbebabfc901f397e9fb51854db
SHA512 53ff31c445e8aca8e63fc2067ce86f2a314fd50227d1f11d6b1f1d75deff63236cb8e7c2366dc7b7419f5303e5287459c0a662b6552e4be525cde470ab443b62
TLSH
T13A412E9063270997CB6F75F952E682FF33F957786D02FB1285B02277192A3583E12611
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 4d3b921877319ca5a67e1b0a6deb076d0259902c1c3bf49fe74f858c7f3c4c3a
MD5 6d5e5df2ac38ae0bc9a24582f2964188
SHA1 09925b5903ac50625e362003debff87d985cc492
SHA512 9fb8c3b3aeb6e9d714f7790a6fb2d57264f017f6b7a8c0faad13792078141ccf7a5875a3fe9b33a5a139afad78b2ef46c74807cbfbd26c3177f18a365a0d46b0
TLSH
T193519EF3C3E8852E890156F4AB187E2BCE1D0914832C3D9AC9E4EF1BA3E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 696e8643d9b03bc27689083ae38f2643076aa505e6557e764b8409f486d78688
MD5 cf7f7de3822fcf8f3e3eb8d861ec01d3
SHA1 73749fb21bde5ca680fddfcd71ca194a30f6bb10
SHA512 01677a5421843142e09ddf18c99eb4ff64639de5b3f7ec0a8ed406979fc8a4d2e01e1b443ea65c54eb481a2f3a295386e427d82d528848c6d5bd6be75cd54189
SSDEEP 192:sxRCRMCu/fMswuibZ49ZmzoA8p9n/g6+WNC0L/YZ7nKs9GP4xIgVfJ:sxRCxu/fMswuiV4nbB/5B/MB9n
TLSH
T1F24297566E38993B9CC7D21ABB557F52D2F81032A1D41E48ABFC8B1C05E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 d91f10095f6f84cdcf3cd0fbfc29d9c5bfb9e7f9a936d756278d8019cf93a229
MD5 1a87a8d2ec81c4ef4d917004bd300e05
SHA1 35955dcb5d522e2b4301e87797e225ed6a6a7672
SHA512 44cac39525da335d47182c4124566583398501996b6e0727be1282e7ce5f9b41c33c9ab9ed4285bbe54e3e56d61fcbf350d71f34915445c21cbf31dd8a3bd74f
SSDEEP 192:sxRhRMCu/fMs2MuibZ49ZmzoA8p9n/g6+WNC0L/YZ7nKs9GP4xIgDVfJ:sxRhxu/fMs2MuiV4nbB/5B/MB9D
TLSH
T1594297566E38993B5CCBD21ABB557F52D6F81032E1D41E48ABFC8B1C05EB6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 db0dcda659dce3a4189990fadbeca0daca76c9b8a04206233bc4905c746034e8
MD5 b72a445c2442664bf29865db39def066
SHA1 89bac41b9b5754a3a099f871046f38588e5300a0
SHA512 fe2aa02c3653eba6eab195f4dac6752616f3537e2a1126243bc6168f78386878832f78e579ac6f1a74558fa6ae85bdf46109f21be913514548fb22ca98f360ed
SSDEEP 192:sxRhRMCu/fMs2MuJbZ49ZmzoA8p9n/g6+WNC0L/YZ7nSs9GP4xIgDvfJ:sxRhxu/fMs2MuJV4nbB/5B/WB91
TLSH
T1834298566E38993B9CC7D219BB557F52E2F85032A1D41E48ABFC8B1C05E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 86bdc3be642b46a579ba1eb00f44dd9f741809aa352713c3d635c15e257a5131
MD5 f913823662454d935f3e6e4d5839b198
SHA1 95ad8c92555113fce34e87845cf3851e1bc97087
SHA512 86965484e4ee6d54c816742924836e4b65ccf1cce8cdcc5f3da3b077f2c56cb0c25b7e1ecde3b23ee765aa7333c4ec53227fba7172f6636c4e4324746cb7c5a5
SSDEEP 768:ky2SuS7pLuL7evWgd5f/b8F1+UoAYDCx9Tuqh0VfUC9xbog/OVebuSV4MroxKg+A:ky2SuqE7evWgd5f/bu1jaBbuU4XxKnA
TLSH
T1F1D2EA3B640DCB7F4F804ADDAC197E9E6DA802CB96D8C98047FA951C03C6BEB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 531ea4f9b668818e460f7040357e636d1cf4d4c3a026ddf822395c7911d6f06a
MD5 9ffbefe91d12efea72ab5025f41fc2c3
SHA1 7c12997d6799ac9eb5d2777b1eb01b12a00eeafd
SHA512 0a56de545cbac0a2cfbb97fec771d7354f3918e4681cd36924baaec0b3907a42b8c5b17fd77f4db3850147d15bdedea2fd68c30a6db77239737f2da3b93b4572
SSDEEP 24:KSitEiFiQiSPi3SiEiQiz1iAivDiCI4iMizKXichPiOiz1RiKijSrid5i4JiQiQK:Ks6IPKjaovyRwInKZmkNXItK8UYnyy
TLSH
T12E9100A271364304B9BE25198074D667DAC270F73514A82B3BE951F20F67F125FBC9CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59ef86.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59ef86.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 8205ae8727242aea76e403c5d44348db13ce237702ac2a84e2cfae2fed75d259
MD5 6d276a448db493553324f0225d46efcf
SHA1 05ff69c0ef0374d8b4f9a745d171b2c8d713debf
SHA512 4fbd39197200fe2e24c29a536e44c7734a04ade16cd0983e622e16b881f0f465a14c4f18abede0ee2edded34abe74757f069a1bae4e8ca6107c5e8133190cf8e
SSDEEP 768:/rv+4UNbdq3gdqFLm4AAam6aQMGdjWca4GhfB/PeU/:/bsbc3k4KmaME6p3H
TLSH
T181F2AE31A8689973DDB79A99F21B6787BEF021A385D40E84C9D95B0D43970CE2307D2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 1d59219e5ecf1998ee9cb5a4ea24d06cd86333f2c37640903d592b5e216685f8
MD5 7d33fa5369dad68fe3a0e289e65ae18d
SHA1 37157c6149f74ed8286953813ebc7e2292824391
SHA512 1c682ef8515d16716eb94e8c2949269751909b1e8e71bdd5c24a8ee09b4e524c89b7933306fd975f202cd46d32f69f2bb392e4b2a2668d4f36a113428719b2c8
SSDEEP 768:Cj+9V3kG2kFqFLmQ/NCAam6aQMGdjWca4Ghf9DIuU:x9V3920gsmaME6p8T
TLSH
T1C0D28E315865DC679CE79695F72B37C7BEF011B388C80E84D9D8AB0D068729E270BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 9f8b139cb7c9e4583fa02552dce08cee0d7d7de621fe76b1566f845af48b5a92
MD5 c3a515e7d6bbc65ac80c02d7a87159a7
SHA1 198eac913ea1948b4a05c11f2f9cb1e0ea8cd06e
SHA512 8d0f35cb3a4cf33c4436813feb5e1c652ca182ce18f5cf33fca22dbf9ba73a743337daf83a55ba9937b7e8ad2c851a1be91f82006bf8f0534d75eb9c77ca1a61
SSDEEP 768:5rv+4UNbdf3xG2kFqFLmQ/NCAam6aQMGdjWca4Ghf9DI9Q:5bsbx3U20gsmaME6p8e
TLSH
T1DA03AE316868D9739CF79295F21B7683BEB421B388C80E84D9D9AB0D46971DE330BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 dbc46f524e8f27b6d8d10bb434d408bfa613274aff00addd1654ae2669093935
MD5 257c7762f9194f7a00f8651c3b551bec
SHA1 df262e54c6fcce872ed62a961819a0f09c43a2b4
SHA512 1f1f4d93959e2009b76a2b099577fd8cb8a1a008fc1eb92ec5528c0c272eeba4870efe5ca47d39192566c27255a18dd56e6729c5d9c664c7bfb2ad67e8655959
SSDEEP 768:vj+9V3HG2kFqFLmQ/NCAam6aQMGdjWca4Ghf9DIuU:C9V3m20gsmaME6p8T
TLSH
T101D28E315865DC639CE79695F72B3787BEF011B388C80E84D9D8AB0D068729E270BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 5fdd48a52ead446f14e805da65b4dca56b1c6f8e490a5f54c45ac262266e537f
MD5 e417c169b151707adb975138e0fe023e
SHA1 9a383e93808cf97235b1f580ab2ae5d4ae89c6c2
SHA512 5c6216198f017d9096ac08e6a1fc39260c9accc7a08a1845b7180ddfe8195203024b0fdcfb0e6961b3e507afcb2679c73c6ef75329f726362dfe858a6b7fcf70
SSDEEP 768:NF1j+9P3+wgYG2u9DLmQ/iAam6aQMGdjWca4Ghf9DIuU:E9P3E2hxmaME6p8T
TLSH
T1F60307F198E78937DCAE4787A73E2E8699BCD163B4884984F7D45E0CCD821BFD206815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

13caf261-e7f0-4e31-bb90-4787bdf0e6ff.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\13caf261-e7f0-4e31-bb90-4787bdf0e6ff.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2708_349492073\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 dce9c6764ad766527d60c63306ce1ddc51e911776880ff19a11e61aff245152d
MD5 585009e73e344b93e88315805c9ca804
SHA1 f58549dbf89d0854284cea27c001b2d199bdabed
SHA512 97211bfdb9c1fb2cbe250d181975faa573ad9202a2c545a970a60bff24be1172722a56df3b7df483b667b5f5b1c21284871f5e868887157cffd96b0e67ce5a21
TLSH
T14071238356BDC5B3C1DA5FF402835604F1FB2338073370604B52594AAB30A3A54B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/700-281-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1544-439-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1904-180-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2088-55-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3180-422-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3428-463-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3476-398-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3544-256-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3776-402-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3776-424-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3800-480-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3864-310-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4160-329-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4196-434-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4500-378-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4572-459-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4736-231-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4904-358-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5068-325-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5436-268-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6128-306-0x0000000000010000-0x00000000000AB000-memory.dmp

Download