systex | 7513288020d63db15e2a08dc057bb2998edbab3e0c871f8b625421ce0b93ca89

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 21:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-22_035ce61a639bac3bbe477addf12f44d1_amadey_darkgate_elex_smoke-loader_stop.exe
Size 384KB
Sample260722-1ca8gace83
SHA256 7513288020d63db15e2a08dc057bb2998edbab3e0c871f8b625421ce0b93ca89
MD5 035ce61a639bac3bbe477addf12f44d1
SHA1 3b9ffe5acc13a828260daa816761e56be9a2a425
SHA512 42b35cf1ea75b61f0ce436675846b2cd0bb7cdcd35d865d796aa33a209f58bb7f8d8aaeb4fa31c231cc2c3d1bebe1cc00bdbaca79a96ca7284231461c684b30c
SSDEEP 3072:ebtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:ebtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F8847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC3F754CE5D9A517C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
5216	wqojgeywtrojgbyw.exe
5176	wqojgeywtrojgbyw.sys
4928	CreateProcess.exe
3380	ebwtoljdyw.exe
5224	CreateProcess.exe
3484	CreateProcess.exe
2752	i_ebwtoljdyw.exe
1124	jgeywqojgb.sys
4896	CreateProcess.exe
4876	tqligbytql.exe
3308	CreateProcess.exe
4660	CreateProcess.exe
4608	i_tqligbytql.exe
5160	dyvqnlgays.sys
2784	CreateProcess.exe
1668	sqlidavtnl.exe
4200	CreateProcess.exe
264	CreateProcess.exe
3584	i_sqlidavtnl.exe
4572	qnifaysqni.sys
576	CreateProcess.exe
5128	qkicaysnki.exe
4648	CreateProcess.exe
5848	CreateProcess.exe
5040	i_qkicaysnki.exe
1900	icausmkfca.sys
5360	CreateProcess.exe
2972	caxvpnhfau.exe
5076	CreateProcess.exe
4676	CreateProcess.exe
1140	i_caxvpnhfau.exe
5680	kicausmkfc.sys
5372	CreateProcess.exe
4212	cxupnhfcxu.exe
1148	CreateProcess.exe
4080	CreateProcess.exe
4092	i_cxupnhfcxu.exe
3820	xupmhfzxrp.sys
5916	CreateProcess.exe
4736	usmhecxupm.exe
5136	CreateProcess.exe
2752	CreateProcess.exe
3168	i_usmhecxupm.exe
4548	jheztrpjhb.sys
5480	CreateProcess.exe
4612	kecwuomhez.exe
1496	CreateProcess.exe
3144	CreateProcess.exe
1268	i_kecwuomhez.exe
5588	mgeywuomge.sys
5876	CreateProcess.exe
5604	bzwrljhbzt.exe
4408	CreateProcess.exe
3352	CreateProcess.exe
2572	i_bzwrljhbzt.exe
5504	bwtomgebwt.sys
1124	CreateProcess.exe
2916	olgdyvtolg.exe
4312	CreateProcess.exe
4220	CreateProcess.exe
4864	i_olgdyvtolg.exe
5348	wtolgeywqo.sys
2224	CreateProcess.exe
5952	tqligaywqo.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2932_1873395035\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2932_903562721\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2932_903562721\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2932_737653591\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2932_737653591\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2932_770818631\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2932_770818631\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2932_770818631\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2932_770818631\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqojgeywtrojgbyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebwtoljdyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqligbytql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkicaysnki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cxupnhfcxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kecwuomhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzwrljhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_olgdyvtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_caxvpnhfau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmhecxupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kecwuomhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snlfdxvpni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkfcxvpkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uspnhfcxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomkecwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomkecwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxupnhfcxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqligaywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlgdyvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqlidavtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bzwrljhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	olgdyvtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljecwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgeywqojgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdbwtolgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebwtoljdyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqlidavtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnlfdaysqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdbwtolgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqligaywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkfcxvpkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uspnhfcxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-22_035ce61a639bac3bbe477addf12f44d1_amadey_darkgate_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkicaysnki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	caxvpnhfau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljecwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqligbytql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmhecxupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnlfdaysqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snlfdxvpni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgeywqojgb.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2396	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2024	ipconfig.exe
3472	ipconfig.exe
5344	ipconfig.exe
4292	ipconfig.exe
5956	ipconfig.exe
3096	ipconfig.exe
5588	ipconfig.exe
3452	ipconfig.exe
5996	ipconfig.exe
5200	ipconfig.exe
5276	ipconfig.exe
2012	ipconfig.exe
4260	ipconfig.exe
4320	ipconfig.exe
5164	ipconfig.exe
3344	ipconfig.exe
2468	ipconfig.exe
3268	ipconfig.exe
5040	ipconfig.exe
1544	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134292294002070184"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{DA5D9653-4635-457F-B553-69BDDBBA1DFD}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4456	2026-07-22_035ce61a639bac3bbe477addf12f44d1_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-07-22_035ce61a639bac3bbe477addf12f44d1_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-07-22_035ce61a639bac3bbe477addf12f44d1_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-07-22_035ce61a639bac3bbe477addf12f44d1_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-07-22_035ce61a639bac3bbe477addf12f44d1_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-07-22_035ce61a639bac3bbe477addf12f44d1_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-07-22_035ce61a639bac3bbe477addf12f44d1_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-07-22_035ce61a639bac3bbe477addf12f44d1_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-07-22_035ce61a639bac3bbe477addf12f44d1_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-07-22_035ce61a639bac3bbe477addf12f44d1_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-07-22_035ce61a639bac3bbe477addf12f44d1_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-07-22_035ce61a639bac3bbe477addf12f44d1_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-07-22_035ce61a639bac3bbe477addf12f44d1_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-07-22_035ce61a639bac3bbe477addf12f44d1_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-07-22_035ce61a639bac3bbe477addf12f44d1_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-07-22_035ce61a639bac3bbe477addf12f44d1_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-07-22_035ce61a639bac3bbe477addf12f44d1_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-07-22_035ce61a639bac3bbe477addf12f44d1_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-07-22_035ce61a639bac3bbe477addf12f44d1_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-07-22_035ce61a639bac3bbe477addf12f44d1_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-07-22_035ce61a639bac3bbe477addf12f44d1_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-07-22_035ce61a639bac3bbe477addf12f44d1_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-07-22_035ce61a639bac3bbe477addf12f44d1_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-07-22_035ce61a639bac3bbe477addf12f44d1_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-07-22_035ce61a639bac3bbe477addf12f44d1_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-07-22_035ce61a639bac3bbe477addf12f44d1_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-07-22_035ce61a639bac3bbe477addf12f44d1_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-07-22_035ce61a639bac3bbe477addf12f44d1_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-07-22_035ce61a639bac3bbe477addf12f44d1_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-07-22_035ce61a639bac3bbe477addf12f44d1_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-07-22_035ce61a639bac3bbe477addf12f44d1_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-07-22_035ce61a639bac3bbe477addf12f44d1_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-07-22_035ce61a639bac3bbe477addf12f44d1_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-07-22_035ce61a639bac3bbe477addf12f44d1_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-07-22_035ce61a639bac3bbe477addf12f44d1_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-07-22_035ce61a639bac3bbe477addf12f44d1_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-07-22_035ce61a639bac3bbe477addf12f44d1_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-07-22_035ce61a639bac3bbe477addf12f44d1_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-07-22_035ce61a639bac3bbe477addf12f44d1_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-07-22_035ce61a639bac3bbe477addf12f44d1_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-07-22_035ce61a639bac3bbe477addf12f44d1_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-07-22_035ce61a639bac3bbe477addf12f44d1_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-07-22_035ce61a639bac3bbe477addf12f44d1_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-07-22_035ce61a639bac3bbe477addf12f44d1_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-07-22_035ce61a639bac3bbe477addf12f44d1_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-07-22_035ce61a639bac3bbe477addf12f44d1_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-07-22_035ce61a639bac3bbe477addf12f44d1_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-07-22_035ce61a639bac3bbe477addf12f44d1_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-07-22_035ce61a639bac3bbe477addf12f44d1_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-07-22_035ce61a639bac3bbe477addf12f44d1_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-07-22_035ce61a639bac3bbe477addf12f44d1_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-07-22_035ce61a639bac3bbe477addf12f44d1_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-07-22_035ce61a639bac3bbe477addf12f44d1_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-07-22_035ce61a639bac3bbe477addf12f44d1_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-07-22_035ce61a639bac3bbe477addf12f44d1_amadey_darkgate_elex_smoke-loader_stop.exe
4456	2026-07-22_035ce61a639bac3bbe477addf12f44d1_amadey_darkgate_elex_smoke-loader_stop.exe
5216	wqojgeywtrojgbyw.exe
5216	wqojgeywtrojgbyw.exe
5216	wqojgeywtrojgbyw.exe
5216	wqojgeywtrojgbyw.exe
5216	wqojgeywtrojgbyw.exe
5216	wqojgeywtrojgbyw.exe
5216	wqojgeywtrojgbyw.exe
5216	wqojgeywtrojgbyw.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	2752	i_ebwtoljdyw.exe
Token: SeDebugPrivilege	4608	i_tqligbytql.exe
Token: SeDebugPrivilege	3584	i_sqlidavtnl.exe
Token: SeDebugPrivilege	5040	i_qkicaysnki.exe
Token: SeDebugPrivilege	1140	i_caxvpnhfau.exe
Token: SeDebugPrivilege	4092	i_cxupnhfcxu.exe
Token: SeDebugPrivilege	3168	i_usmhecxupm.exe
Token: SeDebugPrivilege	1268	i_kecwuomhez.exe
Token: SeDebugPrivilege	2572	i_bzwrljhbzt.exe
Token: SeDebugPrivilege	4864	i_olgdyvtolg.exe
Token: SeDebugPrivilege	1364	i_tqligaywqo.exe
Token: SeDebugPrivilege	4252	i_tnlfdaysqo.exe
Token: SeDebugPrivilege	5348	i_snlfdxvpni.exe
Token: SeDebugPrivilege	5796	i_nkfcxvpkic.exe
Token: SeDebugPrivilege	2416	i_uspnhfcxup.exe
Token: SeDebugPrivilege	6136	i_uomkecwuom.exe
Token: SeDebugPrivilege	1040	i_rljecwuomg.exe
Token: SeDebugPrivilege	5616	i_mgeywqojgb.exe
Token: SeDebugPrivilege	2572	i_gdbwtolgey.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2932	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4456 wrote to memory of 5216	4456	2026-07-22_035ce61a639bac3bbe477addf12f44d1_amadey_darkgate_elex_smoke-loader_stop.exe	89
PID 4456 wrote to memory of 1136	4456	2026-07-22_035ce61a639bac3bbe477addf12f44d1_amadey_darkgate_elex_smoke-loader_stop.exe	90
PID 1136 wrote to memory of 2932	1136	iexplore.exe	91
PID 2932 wrote to memory of 3396	2932	msedge.exe	92
PID 2932 wrote to memory of 1948	2932	msedge.exe	94
PID 2932 wrote to memory of 2396	2932	msedge.exe	93
PID 2932 wrote to memory of 1948	2932	msedge.exe	94
PID 2932 wrote to memory of 1948	2932	msedge.exe	94
PID 2932 wrote to memory of 5108	2932	msedge.exe	95
PID 2932 wrote to memory of 5108	2932	msedge.exe	95
PID 2932 wrote to memory of 4540	2932	msedge.exe	97
PID 2932 wrote to memory of 4540	2932	msedge.exe	97
PID 2932 wrote to memory of 4540	2932	msedge.exe	97
PID 2932 wrote to memory of 4556	2932	msedge.exe	98
PID 2932 wrote to memory of 4556	2932	msedge.exe	98
PID 2932 wrote to memory of 4556	2932	msedge.exe	98
PID 2932 wrote to memory of 1296	2932	msedge.exe	99
PID 2932 wrote to memory of 5048	2932	msedge.exe	100
PID 2932 wrote to memory of 1296	2932	msedge.exe	99
PID 2932 wrote to memory of 1296	2932	msedge.exe	99
PID 2932 wrote to memory of 5048	2932	msedge.exe	100
PID 2932 wrote to memory of 5048	2932	msedge.exe	100
PID 2932 wrote to memory of 2816	2932	msedge.exe	101
PID 2932 wrote to memory of 2816	2932	msedge.exe	101
PID 2932 wrote to memory of 5060	2932	msedge.exe	105
PID 2932 wrote to memory of 5060	2932	msedge.exe	105
PID 2932 wrote to memory of 1164	2932	msedge.exe	106
PID 2932 wrote to memory of 1164	2932	msedge.exe	106
PID 5216 wrote to memory of 4928	5216	wqojgeywtrojgbyw.exe	107
PID 2932 wrote to memory of 3096	2932	msedge.exe	110
PID 3380 wrote to memory of 5224	3380	ebwtoljdyw.exe	113
PID 2932 wrote to memory of 5364	2932	msedge.exe	117
PID 2932 wrote to memory of 5364	2932	msedge.exe	117
PID 2932 wrote to memory of 4440	2932	msedge.exe	118
PID 2932 wrote to memory of 4440	2932	msedge.exe	118
PID 5216 wrote to memory of 3484	5216	wqojgeywtrojgbyw.exe	119
PID 5216 wrote to memory of 4896	5216	wqojgeywtrojgbyw.exe	123
PID 4876 wrote to memory of 3308	4876	tqligbytql.exe	125
PID 5216 wrote to memory of 4660	5216	wqojgeywtrojgbyw.exe	128
PID 5216 wrote to memory of 2784	5216	wqojgeywtrojgbyw.exe	132
PID 1668 wrote to memory of 4200	1668	sqlidavtnl.exe	134
PID 5216 wrote to memory of 264	5216	wqojgeywtrojgbyw.exe	137
PID 5216 wrote to memory of 576	5216	wqojgeywtrojgbyw.exe	142
PID 5128 wrote to memory of 4648	5128	qkicaysnki.exe	144
PID 5216 wrote to memory of 5848	5216	wqojgeywtrojgbyw.exe	147
PID 2932 wrote to memory of 4220	2932	msedge.exe	149
PID 2932 wrote to memory of 1496	2932	msedge.exe	150
PID 2932 wrote to memory of 3412	2932	msedge.exe	151
PID 5216 wrote to memory of 5360	5216	wqojgeywtrojgbyw.exe	154
PID 2972 wrote to memory of 5076	2972	caxvpnhfau.exe	156
PID 5216 wrote to memory of 4676	5216	wqojgeywtrojgbyw.exe	159
PID 5216 wrote to memory of 5372	5216	wqojgeywtrojgbyw.exe	163
PID 4212 wrote to memory of 1148	4212	cxupnhfcxu.exe	165
PID 5216 wrote to memory of 4080	5216	wqojgeywtrojgbyw.exe	168
PID 5216 wrote to memory of 5916	5216	wqojgeywtrojgbyw.exe	172
PID 4736 wrote to memory of 5136	4736	usmhecxupm.exe	174
PID 5216 wrote to memory of 2752	5216	wqojgeywtrojgbyw.exe	177
PID 5216 wrote to memory of 5480	5216	wqojgeywtrojgbyw.exe	181
PID 4612 wrote to memory of 1496	4612	kecwuomhez.exe	183
PID 5216 wrote to memory of 3144	5216	wqojgeywtrojgbyw.exe	186
PID 2932 wrote to memory of 696	2932	msedge.exe	188
PID 2932 wrote to memory of 696	2932	msedge.exe	188
PID 5216 wrote to memory of 5876	5216	wqojgeywtrojgbyw.exe	194
PID 5604 wrote to memory of 4408	5604	bzwrljhbzt.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-07-22_035ce61a639bac3bbe477addf12f44d1_amadey_darkgate_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_035ce61a639bac3bbe477addf12f44d1_amadey_darkgate_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4456
- C:\Temp\wqojgeywtrojgbyw.exe
  C:\Temp\wqojgeywtrojgbyw.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5216
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ebwtoljdyw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4928
  - - C:\Temp\ebwtoljdyw.exe
      C:\Temp\ebwtoljdyw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3380
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5224
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5588
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ebwtoljdyw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3484
  - - C:\Temp\i_ebwtoljdyw.exe
      C:\Temp\i_ebwtoljdyw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2752
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tqligbytql.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4896
  - - C:\Temp\tqligbytql.exe
      C:\Temp\tqligbytql.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4876
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3308
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5276
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tqligbytql.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4660
  - - C:\Temp\i_tqligbytql.exe
      C:\Temp\i_tqligbytql.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4608
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqlidavtnl.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2784
  - - C:\Temp\sqlidavtnl.exe
      C:\Temp\sqlidavtnl.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1668
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4200
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2012
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqlidavtnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:264
  - - C:\Temp\i_sqlidavtnl.exe
      C:\Temp\i_sqlidavtnl.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3584
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qkicaysnki.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:576
  - - C:\Temp\qkicaysnki.exe
      C:\Temp\qkicaysnki.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5128
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4648
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4260
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qkicaysnki.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5848
  - - C:\Temp\i_qkicaysnki.exe
      C:\Temp\i_qkicaysnki.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5040
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\caxvpnhfau.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5360
  - - C:\Temp\caxvpnhfau.exe
      C:\Temp\caxvpnhfau.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2972
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5076
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4320
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_caxvpnhfau.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4676
  - - C:\Temp\i_caxvpnhfau.exe
      C:\Temp\i_caxvpnhfau.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1140
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cxupnhfcxu.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5372
  - - C:\Temp\cxupnhfcxu.exe
      C:\Temp\cxupnhfcxu.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4212
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1148
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5164
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cxupnhfcxu.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4080
  - - C:\Temp\i_cxupnhfcxu.exe
      C:\Temp\i_cxupnhfcxu.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4092
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\usmhecxupm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5916
  - - C:\Temp\usmhecxupm.exe
      C:\Temp\usmhecxupm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4736
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5136
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3344
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_usmhecxupm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2752
  - - C:\Temp\i_usmhecxupm.exe
      C:\Temp\i_usmhecxupm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3168
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kecwuomhez.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5480
  - - C:\Temp\kecwuomhez.exe
      C:\Temp\kecwuomhez.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4612
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1496
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2468
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kecwuomhez.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3144
  - - C:\Temp\i_kecwuomhez.exe
      C:\Temp\i_kecwuomhez.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1268
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bzwrljhbzt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5876
  - - C:\Temp\bzwrljhbzt.exe
      C:\Temp\bzwrljhbzt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5604
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4408
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3472
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bzwrljhbzt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3352
  - - C:\Temp\i_bzwrljhbzt.exe
      C:\Temp\i_bzwrljhbzt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2572
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\olgdyvtolg.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1124
  - - C:\Temp\olgdyvtolg.exe
      C:\Temp\olgdyvtolg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2916
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4312
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3268
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_olgdyvtolg.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4220
  - - C:\Temp\i_olgdyvtolg.exe
      C:\Temp\i_olgdyvtolg.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4864
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tqligaywqo.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2224
  - - C:\Temp\tqligaywqo.exe
      C:\Temp\tqligaywqo.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5952
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5440
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5040
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tqligaywqo.exe ups_ins
    3⤵
    PID:2868
  - - C:\Temp\i_tqligaywqo.exe
      C:\Temp\i_tqligaywqo.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1364
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tnlfdaysqo.exe ups_run
    3⤵
    PID:5828
  - - C:\Temp\tnlfdaysqo.exe
      C:\Temp\tnlfdaysqo.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1860
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4124
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1544
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tnlfdaysqo.exe ups_ins
    3⤵
    PID:972
  - - C:\Temp\i_tnlfdaysqo.exe
      C:\Temp\i_tnlfdaysqo.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4252
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\snlfdxvpni.exe ups_run
    3⤵
    PID:5260
  - - C:\Temp\snlfdxvpni.exe
      C:\Temp\snlfdxvpni.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2920
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4100
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5200
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_snlfdxvpni.exe ups_ins
    3⤵
    PID:712
  - - C:\Temp\i_snlfdxvpni.exe
      C:\Temp\i_snlfdxvpni.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5348
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nkfcxvpkic.exe ups_run
    3⤵
    PID:2816
  - - C:\Temp\nkfcxvpkic.exe
      C:\Temp\nkfcxvpkic.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5668
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2984
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2024
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nkfcxvpkic.exe ups_ins
    3⤵
    PID:2736
  - - C:\Temp\i_nkfcxvpkic.exe
      C:\Temp\i_nkfcxvpkic.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5796
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\uspnhfcxup.exe ups_run
    3⤵
    PID:5712
  - - C:\Temp\uspnhfcxup.exe
      C:\Temp\uspnhfcxup.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4492
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2712
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5344
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_uspnhfcxup.exe ups_ins
    3⤵
    PID:4344
  - - C:\Temp\i_uspnhfcxup.exe
      C:\Temp\i_uspnhfcxup.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2416
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\uomkecwuom.exe ups_run
    3⤵
    PID:4692
  - - C:\Temp\uomkecwuom.exe
      C:\Temp\uomkecwuom.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2348
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4540
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4292
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_uomkecwuom.exe ups_ins
    3⤵
    PID:5492
  - - C:\Temp\i_uomkecwuom.exe
      C:\Temp\i_uomkecwuom.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6136
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rljecwuomg.exe ups_run
    3⤵
    PID:4584
  - - C:\Temp\rljecwuomg.exe
      C:\Temp\rljecwuomg.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2604
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1680
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3096
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rljecwuomg.exe ups_ins
    3⤵
    PID:5744
  - - C:\Temp\i_rljecwuomg.exe
      C:\Temp\i_rljecwuomg.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1040
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mgeywqojgb.exe ups_run
    3⤵
    PID:700
  - - C:\Temp\mgeywqojgb.exe
      C:\Temp\mgeywqojgb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2024
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5028
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3452
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mgeywqojgb.exe ups_ins
    3⤵
    PID:6036
  - - C:\Temp\i_mgeywqojgb.exe
      C:\Temp\i_mgeywqojgb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5616
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gdbwtolgey.exe ups_run
    3⤵
    PID:5504
  - - C:\Temp\gdbwtolgey.exe
      C:\Temp\gdbwtolgey.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2356
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2460
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5956
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gdbwtolgey.exe ups_ins
    3⤵
    PID:2232
  - - C:\Temp\i_gdbwtolgey.exe
      C:\Temp\i_gdbwtolgey.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2572
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtnlgdyvqo.exe ups_run
    3⤵
    PID:1436
  - - C:\Temp\vtnlgdyvqo.exe
      C:\Temp\vtnlgdyvqo.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2312
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4268
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5996
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x31c,0x7ff8bafac188,0x7ff8bafac194,0x7ff8bafac1a0
      4⤵
      PID:3396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1908,i,534379968398017444,4240484220169418596,524288 --field-trial-handle=2380,i,13650910281193377511,8658919551537414405,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:11
      4⤵
      System Time Discovery
      PID:2396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1720,i,6384710527824307413,16645993160311361274,262144 --field-trial-handle=2380,i,13650910281193377511,8658919551537414405,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:2
      4⤵
      PID:1948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2424,i,6732124761771335728,4480362933241132611,524288 --field-trial-handle=2380,i,13650910281193377511,8658919551537414405,262144 --variations-seed-version --mojo-platform-channel-handle=3228 /prefetch:13
      4⤵
      PID:5108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3576,i,383098221366500631,1878096378565049493,2097152 --field-trial-handle=2380,i,13650910281193377511,8658919551537414405,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
      4⤵
      PID:4540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3580,i,4094735298925655366,5440635184523495655,2097152 --field-trial-handle=2380,i,13650910281193377511,8658919551537414405,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
      4⤵
      PID:4556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4304,i,12737641649654834837,18133754298025222853,2097152 --field-trial-handle=2380,i,13650910281193377511,8658919551537414405,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:1
      4⤵
      PID:1296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4300,i,16803638418906639409,15247772358931220019,2097152 --field-trial-handle=2380,i,13650910281193377511,8658919551537414405,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:9
      4⤵
      PID:5048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3796,i,15527380738844801246,3986444411696734029,524288 --field-trial-handle=2380,i,13650910281193377511,8658919551537414405,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:14
      4⤵
      PID:2816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,13359670199719904364,15313230939879851419,524288 --field-trial-handle=2380,i,13650910281193377511,8658919551537414405,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:14
      4⤵
      PID:5060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,8843459217831327898,8277466823119245807,524288 --field-trial-handle=2380,i,13650910281193377511,8658919551537414405,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:14
      4⤵
      PID:1164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,4362310141156713258,10884631485132801147,524288 --field-trial-handle=2380,i,13650910281193377511,8658919551537414405,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
      4⤵
      PID:4236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,4362310141156713258,10884631485132801147,524288 --field-trial-handle=2380,i,13650910281193377511,8658919551537414405,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
      4⤵
      PID:3096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,5898449019585554089,10982082059327268033,524288 --field-trial-handle=2380,i,13650910281193377511,8658919551537414405,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:14
      4⤵
      PID:5364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6452,i,10083817486394757676,13728563776410184925,524288 --field-trial-handle=2380,i,13650910281193377511,8658919551537414405,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:14
      4⤵
      PID:4440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6576,i,6520466892839909776,6907881843967519504,524288 --field-trial-handle=2380,i,13650910281193377511,8658919551537414405,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:14
      4⤵
      PID:4220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,4776254534689414423,12760857281032889183,524288 --field-trial-handle=2380,i,13650910281193377511,8658919551537414405,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:14
      4⤵
      PID:1496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6640,i,10333860425283392119,7892939328610509806,524288 --field-trial-handle=2380,i,13650910281193377511,8658919551537414405,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:14
      4⤵
      PID:3412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3176,i,1662201877519425590,8314637762786420580,524288 --field-trial-handle=2380,i,13650910281193377511,8658919551537414405,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:14
      4⤵
      PID:696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3736,i,13985176484077494407,16012993309134928814,524288 --field-trial-handle=2380,i,13650910281193377511,8658919551537414405,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:14
      4⤵
      PID:4064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=920,i,16683777644245837393,14258479977542771387,524288 --field-trial-handle=2380,i,13650910281193377511,8658919551537414405,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:14
      4⤵
      PID:1852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6580,i,2836979623372340266,17535540011273497946,524288 --field-trial-handle=2380,i,13650910281193377511,8658919551537414405,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:14
      4⤵
      PID:1112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5516,i,9838243253734797683,3370495241875124062,262144 --field-trial-handle=2380,i,13650910281193377511,8658919551537414405,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:10
      4⤵
      PID:2480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,12945979317556992091,9894636943396357549,524288 --field-trial-handle=2380,i,13650910281193377511,8658919551537414405,262144 --variations-seed-version --mojo-platform-channel-handle=3140 /prefetch:14
      4⤵
      PID:1752

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3900

C:\Temp\wqojgeywtrojgbyw.sys
C:\Temp\wqojgeywtrojgbyw.sys
1⤵
- Executes dropped EXE
PID:5176

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1484

C:\Temp\jgeywqojgb.sys
C:\Temp\jgeywqojgb.sys
1⤵
- Executes dropped EXE
PID:1124

C:\Temp\dyvqnlgays.sys
C:\Temp\dyvqnlgays.sys
1⤵
- Executes dropped EXE
PID:5160

C:\Temp\qnifaysqni.sys
C:\Temp\qnifaysqni.sys
1⤵
- Executes dropped EXE
PID:4572

C:\Temp\icausmkfca.sys
C:\Temp\icausmkfca.sys
1⤵
- Executes dropped EXE
PID:1900

C:\Temp\kicausmkfc.sys
C:\Temp\kicausmkfc.sys
1⤵
- Executes dropped EXE
PID:5680

C:\Temp\xupmhfzxrp.sys
C:\Temp\xupmhfzxrp.sys
1⤵
- Executes dropped EXE
PID:3820

C:\Temp\jheztrpjhb.sys
C:\Temp\jheztrpjhb.sys
1⤵
- Executes dropped EXE
PID:4548

C:\Temp\mgeywuomge.sys
C:\Temp\mgeywuomge.sys
1⤵
- Executes dropped EXE
PID:5588

C:\Temp\bwtomgebwt.sys
C:\Temp\bwtomgebwt.sys
1⤵
- Executes dropped EXE
PID:5504

C:\Temp\wtolgeywqo.sys
C:\Temp\wtolgeywqo.sys
1⤵
- Executes dropped EXE
PID:5348

C:\Temp\ysqnigaysq.sys
C:\Temp\ysqnigaysq.sys
1⤵
PID:1968

C:\Temp\xvpnifdxvp.sys
C:\Temp\xvpnifdxvp.sys
1⤵
PID:1776

C:\Temp\vsmkicausq.sys
C:\Temp\vsmkicausq.sys
1⤵
PID:3780

C:\Temp\usmkhczxvp.sys
C:\Temp\usmkhczxvp.sys
1⤵
PID:3476

C:\Temp\zusmkecwup.sys
C:\Temp\zusmkecwup.sys
1⤵
PID:4092

C:\Temp\urmjecwuom.sys
C:\Temp\urmjecwuom.sys
1⤵
PID:4724

C:\Temp\uomjebwuom.sys
C:\Temp\uomjebwuom.sys
1⤵
PID:3880

C:\Temp\igeytroige.sys
C:\Temp\igeytroige.sys
1⤵
PID:4236

C:\Temp\bvtnlgdyvq.sys
C:\Temp\bvtnlgdyvq.sys
1⤵
PID:3752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

caxvpnhfau.exe

Path C:\Temp\caxvpnhfau.exe
Size 384KB
SHA256 9c7eb6d8efcc3f71b2f03f6f8dbd3eb6056b9ccefe9ac859e8631ae7b9140251
MD5 4b24f8d592fd63166f3e0c21104b7787
SHA1 f6f26910615f4f029f20ec403b9a119dbeb295fa
SHA512 21bcd35c1285eadcbee3d456cbb7503a8d4d588065cfa2ec6d79a1cd920efa7ded44e56766eb36dd4ba5074de5116d5d8467c7225250fce1092bc2da46c9438b
SSDEEP 3072:xbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:xbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T10A847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC3F754CE5D9A517C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cxupnhfcxu.exe

Path C:\Temp\cxupnhfcxu.exe
Size 384KB
SHA256 7fee1ddfce698e2f87612499d65340cfdbf9a4eba50feb8c38e4c1dd804c894a
MD5 207b994e8a4be207eb260ea96e12b070
SHA1 a8b860bed09670f2ebfdfa9d671b4d98c4b53cc2
SHA512 9d9ecba746fead49253d5527e47b03faf4f7b9e6775d6431b56fb4a7784c3aa02f077d00a8a1d4332de8b23e1b280461fab73d44cf4904bdc223ee2e36d09ea2
SSDEEP 3072:mbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:mbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T19D847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dyvqnlgays.sys

Path C:\Temp\dyvqnlgays.sys
Size 293KB
SHA256 9618b4857e67843667d25a2266e75f749f46ff0623fae13b25ed7ae40caa78a7
MD5 d2418d978c3cec187f323a7aca83def6
SHA1 7e200fc8f506e1fe6b67ee914e30d460c290fe69
SHA512 84becfc8b0ef86bd8d75f9caea23040252221662e19046e414afb12b9ee4752aac2156e40cfe95050ce3ad4eb82d1f6bd61086384afcd78ea20b47f76842102c
SSDEEP 3072:etKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:eIJjiJcbI03GBc3ucY5DCSj
TLSH
T1E5545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ebwtoljdyw.exe

Path C:\Temp\ebwtoljdyw.exe
Size 384KB
SHA256 abdd8b7918e90611f12dcff857db5ac1b39601bba2e67b872cc8b020bac757dc
MD5 d85a56ed97f5f4e9406c1988f6f1857d
SHA1 0586eb0a8f102e1d8ab76a515c8eca168ee05999
SHA512 6683cd168a3ceb23ebc70632fe2c1f59afe96cce3d892465f15ce15e7190e58ca8946a732982b9418e59f1be814230290d2553ad89832aff987334468c42d01c
SSDEEP 3072:2btF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:2btt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T138847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC3F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_caxvpnhfau.exe

Path C:\Temp\i_caxvpnhfau.exe
Size 384KB
SHA256 235fe52092105370a621cfb65ab1bfff5c3996311d4f07db368f225ac6182bab
MD5 fe80b7b28691223456a4e71f42a8e29c
SHA1 3c54717ff039e92587fc0ade719a6fd7620238a6
SHA512 4d5c6122e53e3df579561da1ad7368a15fb05b9686e490c6173cf6513a79f34f89b24718f66a6ef6366b15e1c227776a72f6912cebc35ab2d416e21c95100d68
SSDEEP 3072:wbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:wbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T115847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC3F754CE5D9A517C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ebwtoljdyw.exe

Path C:\Temp\i_ebwtoljdyw.exe
Size 384KB
SHA256 4b4894021a7eaace554d7a16851f9203fb6b18021ed0715c7fd126358088afb2
MD5 e258c32fa73c36622adc6ac0011b71ac
SHA1 70689e882684697057c5ed0a13a9f22fe618beda
SHA512 0560f36969cba57c20f6e4efe1661b50d319b3d6403791277a83c733d7b3c92907a4a980b7ccacd08c720e10afef21cdc036d85ecd47fbf3169540e11fd922eb
SSDEEP 3072:ybtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:ybtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T18A847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qkicaysnki.exe

Path C:\Temp\i_qkicaysnki.exe
Size 384KB
SHA256 daf895c2a1ce71301df67b1f783f3ce875b7e34b884553116c52cde31b578bcc
MD5 c094d2058db4a947e90d048a4e7f0b49
SHA1 4586fb914fda614bdf1feded71e238e4b5e32712
SHA512 edeefe9cfa66a10761aa79d51eca9c0d1f8e1e93e7ab4fcd8cd70404a7e2547e2fee98b75f3aaa3a9ad39ee6f963126fdafccacee73bf9db26d0daaff236289f
SSDEEP 3072:rbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:rbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T17A847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_sqlidavtnl.exe

Path C:\Temp\i_sqlidavtnl.exe
Size 384KB
SHA256 2166863a534a70012c44e02b34a42d63f7a3602bc56785d9fa6eda4456e6221e
MD5 9daffd5c091f1c59c383721cb2a166e2
SHA1 8bd045ad4e307524038342e782a657501dbc4c04
SHA512 8da2e305478a76ea23cda730704b3d39c463157153909c2751b80703615bf29fcb1c43bdcd105ffaed92cb27a15094393022c1efb834625514de38b4160ae555
SSDEEP 3072:4btF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:4btt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1CA847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC3F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tqligbytql.exe

Path C:\Temp\i_tqligbytql.exe
Size 384KB
SHA256 c2a219ba07d9f25fa63ac1c3083071b6aef0751b8f0a968286ff8378c508e16c
MD5 0783538f6cd70bf9032c8e3e85da8531
SHA1 1aa7220b27b0f41ea2774e72b775d2c5ba445817
SHA512 8093f09f22178eb67a5b7db5f480f36613cb5b5a902628c7b7d6be3755c1e515edde0a7827b7c1beb608334f588d89f861557a3975aaa81ef8c090ee27b0a525
SSDEEP 3072:7btF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:7btt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1CF847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icausmkfca.sys

Path C:\Temp\icausmkfca.sys
Size 293KB
SHA256 59f9e2ae6e586b32c25e35a2f1334b160af0b63e7cb063e3a70128970aa0476f
MD5 2ef9606ef32188d101ff61dfa70bc7fe
SHA1 6140edd9c23c22a285f1a4c19f4e0c7241cf94b3
SHA512 fd5b98d2ee8ad5596306afa6752e039da84449308fa2869228fddf7ebb94f61ee4b557553134874058f193388fe6130ab40394c2ad232feeefbfceb612531006
SSDEEP 3072:+tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:+IJjiJcbI03GBc3ucY5DCSj
TLSH
T17D545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jgeywqojgb.sys

Path C:\Temp\jgeywqojgb.sys
Size 293KB
SHA256 6514ec0ae9f854b17209ae7a1e5efca340058b42ed618b8238ed82f90c2b0af9
MD5 ccea5f1b43499fa2aee779c08dafd5e6
SHA1 fc5c71af3405346ac5aefd30bb48b146e6a5b281
SHA512 23c67d0d64005eedd358956afa263f55255a701247be4ff56cd082404baecf92949d547aaf609542b878d3367615e7f1ba2c73095bf01577593fb9e62f5f21a0
SSDEEP 3072:AtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:AIJjiJcbI03GBc3ucY5DCSj
TLSH
T19F545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kicausmkfc.sys

Path C:\Temp\kicausmkfc.sys
Size 293KB
SHA256 b65a27be37842de00198059bd5aaa3340fe3732ba99e2d2ae0949276cd80941a
MD5 f106cca3398d14a57a4e13c9b39ae5e0
SHA1 7bb26417a1348762e7ea38090acd6f3b101af5f4
SHA512 d2e8333b92cc8ff8988b15e1b652bfbf48b9fdb10a6a24eb83198a311b2f7d6588956f587709edec21e0088b2d8e20161ce2a518938343748944b05e3d463147
SSDEEP 3072:OtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:OIJjiJcbI03GBc3ucY5DCSj
TLSH
T134545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qkicaysnki.exe

Path C:\Temp\qkicaysnki.exe
Size 384KB
SHA256 00009ff5c1347b7b8c2ba89d36648653a14bbd92e601628f973880f70b431490
MD5 742c69aa8e0eda2660ee1ea63a43c3bf
SHA1 8bbaefc09ef3d112bcd1b9913ee5199627aa5e13
SHA512 6ba0534c9e5cc1118e1594cf3755955353953c64f4cfab6c8d84d2ebe2d7e970146757da04ddb5e8ccc43d2ed075e8bce0ac1f4ce97712a1decbce6d5d31009b
SSDEEP 3072:0btF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:0btt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T17D847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qnifaysqni.sys

Path C:\Temp\qnifaysqni.sys
Size 293KB
SHA256 9d24baa7666d9364aa44dfb9df5586af6701db4aa317c2fd7925dd267f1b85d5
MD5 52e66b2a7702165b2cd8250f8e86ee23
SHA1 12a702139037f3b7729c227d0834d918dc20995e
SHA512 f51ac802a3dc20ca78626de96f9a339f830a265e157dc1027e8742a72b2133050c7b42d803b8f78efd022b8e2085e849155b5eabbcf499b4761f61d4eaa9c2f3
SSDEEP 3072:dtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:dIJjiJcbI03GBc3ucY5DCSj
TLSH
T1F7545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlidavtnl.exe

Path C:\Temp\sqlidavtnl.exe
Size 384KB
SHA256 19ecb2b1566cfd28a036d515a994d2da09f07dffe92f19e32c4ebbfa1af5c27c
MD5 58269e1417269128c2b46dd263c67584
SHA1 a6bcc764da88e2126eb4d1910c966018edd220c4
SHA512 89ab4f0f4df8230cfcdd7dcd6717e1da5134a5eaa8d852067f941f9834cf223bb6b92758f1f88e8fa434c58e9d541ed50d43bb8707b07da1bd9312dcf19ca851
SSDEEP 3072:+btF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:+btt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T132847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tqligbytql.exe

Path C:\Temp\tqligbytql.exe
Size 384KB
SHA256 6e461aeffa18cd7c1d77110a3a113675574ee9636da9cb8887977f953db3fb5f
MD5 83a84782f384eb7af8a649cd50e6eeae
SHA1 d64879e6a766189885e864136604bfb1758e3d06
SHA512 e279e6f0a1a7563b945dc32003bc3256ef302669912a5945753baa7afee0fd57b770150dbfec27c65a0e4d9a5461faf690d6a8d4e14eab2dae3ebf1fd2c6457e
SSDEEP 3072:kbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:kbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E6847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wqojgeywtrojgbyw.exe

Path C:\Temp\wqojgeywtrojgbyw.exe
Size 384KB
SHA256 80d70b520b983d35cf9eb91af6e3755f8b46e042559f2bb63f7fefc157b13703
MD5 3c8e9bd4bc6404dc249d69019945267e
SHA1 964ded71f3c0a87f4ea36abaf3d526eb3cca920f
SHA512 d34edc085acb9e0bbc8967e154c68d32a4bb5d25f085d462a84d600aa961363e7c605de873201ac8ad291471ba5ae19703bcfd93269a3ae23e2bbc0133d48355
SSDEEP 3072:YbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:Ybtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T172847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wqojgeywtrojgbyw.sys

Path C:\Temp\wqojgeywtrojgbyw.sys
Size 293KB
SHA256 be97d286658082a1432a93b40cf84ae39392d52a9e84728a565bc094bfdc1caa
MD5 2db1ad09d9dbf7f712f37bf3ca9c5301
SHA1 3cfa50972990c87cc6093ed30430e9a03206a9e8
SHA512 748d94d376c9bc8d3fadcb3987ca37b187c090072863e627d34c6be7be8364cbb4f3a91f140454735ad13b74f5d1484a63ae913a9bd6393165a8a05c8df1ae33
SSDEEP 3072:3tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:3IJjiJcbI03GBc3ucY5DCSj
TLSH
T148545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 08e588d89af58d1a81c19cb7b1e61171c31c5bad7319946863e09936558aa532
MD5 b2b5a93b3bbb3c73b0a7f201c0738e96
SHA1 e7a9b4abb022452a59f66df55b59f24ca78aec59
SHA512 eac0182685b4b26f248543d333533518a1fc8ddb0ba071282fd5b8ba99e125048b7a6af955b95674ff1719508350ba6bf7e382875ec5f5d61c9b0f6f2d306173
TLSH
T1AD61A45423AB0AE3D32845B521F1145836F086F5CD47FFAAA04E9EB8D4A6F34D0D8617
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59ad9b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59ad9b.TMP
Size 3KB
SHA256 e55f86800b189629e762f90bed722dcf5843d8aba16d53f5d13f17080ab4cc6c
MD5 80a6989a07be39df5d7e677dad8af815
SHA1 3234d24b52c5887dd51ecd4f1b1a84fed0c4d528
SHA512 5ec82b5657010e86b4687b910201e929f926077de8c956144f106928a5f0f30f6199c421e7c75002a6c5aaafcdfeabe94c4d2a99b79a6783c95280e6c4ea8d8d
TLSH
T1D561845423AB1AE3D32845B161F1145836F086F5CD47FFAAA04E5EB8D4E6F34D0D8617
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a5fae3422338c04b8221efeed20ee639913686f7b7e215bd1ec81f638c68353e
MD5 54845ca21db86dbe2ecd0f05bd3289bf
SHA1 5dfd6ab39735e4764c01f4758b24bc9d7a7b64d1
SHA512 b882a5efceb980c4315612995ae5d77734bb3a3e34d9ad0db6addc6976828f1ba7c914f09119a55cb5c4032fd3ee468a6800c150f01d8c73bd9b33727325e6d9
TLSH
T1EA518CF3C2E8866E890156F0AB187E1BCE2D0955832C3D5AC9E4EF6B93E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 d66e28efd5ca96222072e529b97f8a273b075d9140f2e527297f79b505c6bb28
MD5 54a4fb10241eb2d382a0180ebcf58034
SHA1 fae7feaea37d6fe48429b012b2481313d4511bfb
SHA512 d262c459b68f4dd5e0bfebc1113664bcef1ff47b0b5b3f65650a18fa1a43a6521f3d9f6d330a0193f1aa86ea605281aadca5fc267ce90d6f7d6ee4c538d4d75e
SSDEEP 192:sxRK9RGC3/f9s8IWSZ8zqZzoA8p9J/g6+WNCyXeo/YozjCYdGpIgVbJ:sxRK9r3/f9s850Hkf/5h/q1P
TLSH
T17542A91AAD28993B9CD7D219FB55BF53D2F91032A1D52E88E6FC870C04EA6DD130741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 6390600c37aafdbdbcfaf02e55a8e1f23c5ef6e2f1551115a9148d00c9c23382
MD5 d912c083e70d6cf22ab36aea0d647ac7
SHA1 5f90b72854412d50b4dd8215ea73083f7c844405
SHA512 678e30599637556fd85834d4a7646e778b276add11f2fdd2e7d3b55c8a00852567a0da78fcba182cce66184c459bf5293ced0bc4bfdea67d05126a6703246e92
SSDEEP 192:sxRKSRGC3/f9saIlSZ8zqZzoA8p9J/g6+WNCyXeo/Yoz2CYdGpIgDIbJ:sxRKSr3/f9saS0Hkf/5h/J1E
TLSH
T1C542B91AAD28593B9CDBD219FB55BF53E2F91032A1D51E88B6FC870C14EA6CD230741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 b71b6c0e7dedae87608b2576eb3d760393c6852b7c19958f84f896f07d76c2f8
MD5 1d13d790a976befb96a2349674786325
SHA1 62b0114d10d423b89d9f937baef737520ced06aa
SHA512 b5c90a69247eb9b1f1747074ccd5568c25a668bbc6fa7f389bc3582ff18aef2c1268ac1a23d9863920a652bc4552dd7f5816acb86fce7278e757ce44b0a8f717
SSDEEP 192:sxRKSRGC3/f9saIWSZ8zqZzoA8p9J/g6+WNCyXeo/YozjCYdGpIgDybJ:sxRKSr3/f9sa50Hkf/5h/q1a
TLSH
T1CD42B91AAD24993B9CDBD21DFB55BF53D2F91032A1D52E88A6FC870C04EA6CD230741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 e477e237acfbd0fbe3c7e4a843e29e7c6d1cad9f101b467a8968fa399ca3a6c7
MD5 4a122c2ff2485abb232022eb82e33f6e
SHA1 bdaa12a45d58bf428b4d0c8f913880996fef9ecc
SHA512 e849610c8f95c4fd698166bfe57daea12e1950fbd7dcdff536982534e46dc7f654916870c80c969452c4f98a13e1f8efd122488d92d10bb48c8734aa2c0aaa08
SSDEEP 768:j26Hxo7pLuL7MRWgs2f028F1+UoAYDCx9Tuqh0VfUC9xbog/OVJWBVuwhro9me0R:j26HxUE7MRWgs2f02u1jauWB4waxe
TLSH
T188D2DA7B640DCABE4F800ADDEC197EDF6D6802CB9698CD8047FE951C02C6BEA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

05876456-6e95-45bc-89a3-dbd9ed3be1ba.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\05876456-6e95-45bc-89a3-dbd9ed3be1ba.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a49ad.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a49ad.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 62ec8873cb103c242c144f5de695dcca158cb6f3d8296b3b08154a9cb2169020
MD5 33e10dae3e7adb1511137359e4147487
SHA1 255642ac3944257a7738bfca90f42f2a7f5fbe11
SHA512 370f58ae36be427e2c8a23f369c55ec5a74d599537c0c5517f2b735ddc10a810ca3cd3f1918199bbd035dea7b1beac6e30b939fb998c619d29afa2f5997ad963
SSDEEP 768:/B3LF/TBOWoSc7ONXyer1IRCzni9kMju/:/B3p47SIqn7p/
TLSH
T133F2AF31E5659D238DE5A396F1467793AFF82063C8C40A90EDE96F4D09C366D130F82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 0a07e970d4b0cef16d07a9d642d58772e784b0258c3a38c6a46db036e5124fc3
MD5 0ea088a435e52a6153e61e920c298b20
SHA1 ae5d40d35b2da19781a368e552984bf2718fe1c9
SHA512 adc41124a017583c0746f5892e32f5b038a49ebf587096d76623d99583f0caf915e909415b77ab2464b0769aa06c74e35f83ad81f0b465a2aa5e35c95f6aa3f5
SSDEEP 768:hrv+4UNbdz3sI/TBOWoGONXyer1IRCzniBoeVH1SK7:hbsbV3nlSIqnnEH1l
TLSH
T19803CF32A4A89E338DE2A3C5B14776437FF85057D6800790EDDE2F4E069B59D130B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 c523dd16869c0e57d6194aad8fac0f729bdd8eee433b2b0ad419d3d7894180ef
MD5 0af21866c806da15290cb825258c9b54
SHA1 a7ae85831179721cf2af0fd129846dcc20dface2
SHA512 30a5b189c78764d801b49515f3501e7f0c544f30a31c96411f2f6955bf1808936cbd1485df7b7ea46b5374ea8168fafe26071b694d5be19d37cc4695763fe32c
SSDEEP 768:Jrv+4UNbd+3zaF/TBOWoScmONXyer1IRCzni9khm:Jbsbw3w4mSIqn7Q
TLSH
T12E03AE31E569DE338DE6A385F14776937FB82067C9C10A90E9D92F8D098B59E230F816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 e1f7f97fcfe41df6ecb17af3d5f9667b48b0941a57197f8bbc4062138cf8a86c
MD5 0216040a1fd266cb1cdc3ec957668355
SHA1 d7ddb6f76a931d5600d9cdc234ef7d1d24d5b24b
SHA512 6657fa8fd49740cd34bf4fbdb25593a61c21920083742011bd58b1f0cad38913f8130be7d9b70bdd6e3821db41aa799580831758d73c022fed21e1f8f7a7de1c
SSDEEP 768:1FQS3hwgqapsOWoScYONXyer1IRCzni9kMju/:US3/FYSIqn7p/
TLSH
T17E1328F694D78A37D9AD9383A33D6E429EBCD063B5844980BBD55E4CCC825BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 36ad6d611cc8270e9b9b38892b5c68b72e30f1c76a165ca92cab3ed5975034fb
MD5 7a0a2c4319eafc0a29a0ea09d239a227
SHA1 8c6173e4bc9a561dff8572b4b2831360acbd1d19
SHA512 f20599b4b1baf0e973f537b900cfef6fe1bb54e6f14cec8b335de89925db139ff09e94ecec0d2cb567ae1a67d0a6693e6cef8036539fdf06b5627f8d50113cac
SSDEEP 768:wB3YF/TBOWoSc7ONXyer1IRCzni9kMju/:wB3m47SIqn7p/
TLSH
T194F2BF31E5659D238DE5E392F1467793AFF42063C8C40A90EDE96F4D09C766D130F82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

0b18c599-ec9c-4de7-9a1e-f9e29c18c605.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\0b18c599-ec9c-4de7-9a1e-f9e29c18c605.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2932_1669313325\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 c28d76c93c156a39ca31a5f63a9b961dbfa6e2032e3555b93fd98f8150ae6cd7
MD5 3781f096b1f63c76dc53b099e06098c6
SHA1 a9b4523be3b08d4b5a8d09a1da39d448f8781631
SHA512 4197306d48decb50bbc7f404db96bcc4df70391dae789df28c064d285967f365b68127a019856f013b742fe44ab7697fe53cb9650a9824d943f8c8d30736f3b2
TLSH
T15171238357B9C6B3C2DE5FF102835604F6FB62384B2330644B91558AEB30A7A24B8F08
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1124-185-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1776-401-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1900-273-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1968-403-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3476-426-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3752-485-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3780-406-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3820-310-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3880-464-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4092-437-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4092-461-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4236-468-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4548-314-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4572-261-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4724-442-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5160-233-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5176-62-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5348-362-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5504-333-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5588-329-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5680-286-0x0000000000010000-0x00000000000AB000-memory.dmp

Download