systex | 06078311e988840e1eeb223cb37e7a543dcc88c5e8bf891f99ccf8b26e10f50c

Analysis

max time kernel
149s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 01:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_df224d47ba85f233a8c02e8da1e390b9_amadey_darkgate_elex_smoke-loader_stop.exe
Size 384KB
Sample260816-b7wefsxdkd
SHA256 06078311e988840e1eeb223cb37e7a543dcc88c5e8bf891f99ccf8b26e10f50c
MD5 df224d47ba85f233a8c02e8da1e390b9
SHA1 3ee7e379f752d9a074db9ba0ea9a823b067bcef6
SHA512 9dc5dbbffb0cd4afb104569a7a174f0511000930b8a15afaf227a22da80949f680decd5eb76cf887f2870c228d4724dd20d65193b1d2c14e9d1ee2e81347b04e
SSDEEP 3072:mO6UF5toCvty8dsaMj4ygtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ug:/6QtpouIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1BB847B00BAA4F0F6D995043800EFAF36A67E74281B26CBC3E754CE5D99513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
5296	xrpjhbzurmkecwuo.exe
2928	xrpjhbzurmkecwuo.sys
4420	CreateProcess.exe
2264	zusmkecwup.exe
3308	CreateProcess.exe
1916	CreateProcess.exe
2256	i_zusmkecwup.exe
1508	mjecwuomje.sys
4516	CreateProcess.exe
3792	gezwuomgbz.exe
5968	CreateProcess.exe
604	CreateProcess.exe
1896	i_gezwuomgbz.exe
1316	tolgebwtrl.sys
1300	CreateProcess.exe
3544	trojdbztrl.exe
4404	CreateProcess.exe
2024	CreateProcess.exe
3648	i_trojdbztrl.exe
3404	wlgeywqoig.sys
408	CreateProcess.exe
3896	gdyvqoigay.exe
1508	CreateProcess.exe
5532	CreateProcess.exe
1512	i_gdyvqoigay.exe
3748	bvtnlidays.sys
2612	CreateProcess.exe
4696	qnifdxvqni.exe
2792	CreateProcess.exe
2628	CreateProcess.exe
4540	i_qnifdxvqni.exe
5720	ifaysqkica.sys
2828	CreateProcess.exe
1884	fdavsnlidy.exe
4532	CreateProcess.exe
1204	CreateProcess.exe
5856	i_fdavsnlidy.exe
4128	fcxvpnkfda.sys
4748	CreateProcess.exe
1588	fcaxsqkica.exe
5688	CreateProcess.exe
200	CreateProcess.exe
4584	i_fcaxsqkica.exe
2968	fzxupmkhca.sys
2164	CreateProcess.exe
4656	hfzxupmhfc.exe
704	CreateProcess.exe
1448	CreateProcess.exe
2912	i_hfzxupmhfc.exe
5504	spkhczxrpk.sys
1928	CreateProcess.exe
3228	rpmhfrpjhc.exe
1408	CreateProcess.exe
5192	CreateProcess.exe
1820	i_rpmhfrpjhc.exe
5872	ecwurpjhbz.sys
3928	CreateProcess.exe
6076	cwurpjgecw.exe
1340	CreateProcess.exe
4920	CreateProcess.exe
4828	i_cwurpjgecw.exe
5780	hezwqojgbz.sys
712	CreateProcess.exe
3288	heywrojhbz.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4368_1271605111\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4368_1271605111\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4368_219084570\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4368_149310337\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4368_1271605111\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4368_149310337\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4368_1323656019\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4368_1323656019\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4368_1271605111\llm_user_input_extractor_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gayvqoifax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsnhfaxsqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xupnhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xupnhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upmkecausp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trojdbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfzxupmhfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bywqoigayt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zusmkecwup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdyvqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdavsnlidy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcaxsqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpmhfrpjhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urmhecwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrojhbztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgeywqljgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trojdbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnifdxvqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpmhfrpjhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_heywrojhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bywqoigayt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_upmkecausp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_df224d47ba85f233a8c02e8da1e390b9_amadey_darkgate_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gayvqoifax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsnhfaxsqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urmhecwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrojhbztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdyvqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpjhbzurmkecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnifdxvqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zusmkecwup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gezwuomgbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gezwuomgbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdavsnlidy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfzxupmhfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwurpjgecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	heywrojhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbvtqljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbvtqljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fcaxsqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwurpjgecw.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5612	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1516	ipconfig.exe
5744	ipconfig.exe
2960	ipconfig.exe
4704	ipconfig.exe
2868	ipconfig.exe
2848	ipconfig.exe
5596	ipconfig.exe
4520	ipconfig.exe
5916	ipconfig.exe
5456	ipconfig.exe
468	ipconfig.exe
2120	ipconfig.exe
5476	ipconfig.exe
1648	ipconfig.exe
5136	ipconfig.exe
3380	ipconfig.exe
3880	ipconfig.exe
3192	ipconfig.exe
3848	ipconfig.exe
3312	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134313184705412551"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3986082593-3624157295-3514260330-1000\{A372AE65-1B1D-4649-80EA-D81D742B62FE}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4628	2026-08-16_df224d47ba85f233a8c02e8da1e390b9_amadey_darkgate_elex_smoke-loader_stop.exe
4628	2026-08-16_df224d47ba85f233a8c02e8da1e390b9_amadey_darkgate_elex_smoke-loader_stop.exe
4628	2026-08-16_df224d47ba85f233a8c02e8da1e390b9_amadey_darkgate_elex_smoke-loader_stop.exe
4628	2026-08-16_df224d47ba85f233a8c02e8da1e390b9_amadey_darkgate_elex_smoke-loader_stop.exe
4628	2026-08-16_df224d47ba85f233a8c02e8da1e390b9_amadey_darkgate_elex_smoke-loader_stop.exe
4628	2026-08-16_df224d47ba85f233a8c02e8da1e390b9_amadey_darkgate_elex_smoke-loader_stop.exe
4628	2026-08-16_df224d47ba85f233a8c02e8da1e390b9_amadey_darkgate_elex_smoke-loader_stop.exe
4628	2026-08-16_df224d47ba85f233a8c02e8da1e390b9_amadey_darkgate_elex_smoke-loader_stop.exe
4628	2026-08-16_df224d47ba85f233a8c02e8da1e390b9_amadey_darkgate_elex_smoke-loader_stop.exe
4628	2026-08-16_df224d47ba85f233a8c02e8da1e390b9_amadey_darkgate_elex_smoke-loader_stop.exe
4628	2026-08-16_df224d47ba85f233a8c02e8da1e390b9_amadey_darkgate_elex_smoke-loader_stop.exe
4628	2026-08-16_df224d47ba85f233a8c02e8da1e390b9_amadey_darkgate_elex_smoke-loader_stop.exe
4628	2026-08-16_df224d47ba85f233a8c02e8da1e390b9_amadey_darkgate_elex_smoke-loader_stop.exe
4628	2026-08-16_df224d47ba85f233a8c02e8da1e390b9_amadey_darkgate_elex_smoke-loader_stop.exe
4628	2026-08-16_df224d47ba85f233a8c02e8da1e390b9_amadey_darkgate_elex_smoke-loader_stop.exe
4628	2026-08-16_df224d47ba85f233a8c02e8da1e390b9_amadey_darkgate_elex_smoke-loader_stop.exe
4628	2026-08-16_df224d47ba85f233a8c02e8da1e390b9_amadey_darkgate_elex_smoke-loader_stop.exe
4628	2026-08-16_df224d47ba85f233a8c02e8da1e390b9_amadey_darkgate_elex_smoke-loader_stop.exe
4628	2026-08-16_df224d47ba85f233a8c02e8da1e390b9_amadey_darkgate_elex_smoke-loader_stop.exe
4628	2026-08-16_df224d47ba85f233a8c02e8da1e390b9_amadey_darkgate_elex_smoke-loader_stop.exe
4628	2026-08-16_df224d47ba85f233a8c02e8da1e390b9_amadey_darkgate_elex_smoke-loader_stop.exe
4628	2026-08-16_df224d47ba85f233a8c02e8da1e390b9_amadey_darkgate_elex_smoke-loader_stop.exe
4628	2026-08-16_df224d47ba85f233a8c02e8da1e390b9_amadey_darkgate_elex_smoke-loader_stop.exe
4628	2026-08-16_df224d47ba85f233a8c02e8da1e390b9_amadey_darkgate_elex_smoke-loader_stop.exe
4628	2026-08-16_df224d47ba85f233a8c02e8da1e390b9_amadey_darkgate_elex_smoke-loader_stop.exe
4628	2026-08-16_df224d47ba85f233a8c02e8da1e390b9_amadey_darkgate_elex_smoke-loader_stop.exe
4628	2026-08-16_df224d47ba85f233a8c02e8da1e390b9_amadey_darkgate_elex_smoke-loader_stop.exe
4628	2026-08-16_df224d47ba85f233a8c02e8da1e390b9_amadey_darkgate_elex_smoke-loader_stop.exe
4628	2026-08-16_df224d47ba85f233a8c02e8da1e390b9_amadey_darkgate_elex_smoke-loader_stop.exe
4628	2026-08-16_df224d47ba85f233a8c02e8da1e390b9_amadey_darkgate_elex_smoke-loader_stop.exe
4628	2026-08-16_df224d47ba85f233a8c02e8da1e390b9_amadey_darkgate_elex_smoke-loader_stop.exe
4628	2026-08-16_df224d47ba85f233a8c02e8da1e390b9_amadey_darkgate_elex_smoke-loader_stop.exe
4628	2026-08-16_df224d47ba85f233a8c02e8da1e390b9_amadey_darkgate_elex_smoke-loader_stop.exe
4628	2026-08-16_df224d47ba85f233a8c02e8da1e390b9_amadey_darkgate_elex_smoke-loader_stop.exe
4628	2026-08-16_df224d47ba85f233a8c02e8da1e390b9_amadey_darkgate_elex_smoke-loader_stop.exe
4628	2026-08-16_df224d47ba85f233a8c02e8da1e390b9_amadey_darkgate_elex_smoke-loader_stop.exe
4628	2026-08-16_df224d47ba85f233a8c02e8da1e390b9_amadey_darkgate_elex_smoke-loader_stop.exe
4628	2026-08-16_df224d47ba85f233a8c02e8da1e390b9_amadey_darkgate_elex_smoke-loader_stop.exe
4628	2026-08-16_df224d47ba85f233a8c02e8da1e390b9_amadey_darkgate_elex_smoke-loader_stop.exe
4628	2026-08-16_df224d47ba85f233a8c02e8da1e390b9_amadey_darkgate_elex_smoke-loader_stop.exe
4628	2026-08-16_df224d47ba85f233a8c02e8da1e390b9_amadey_darkgate_elex_smoke-loader_stop.exe
4628	2026-08-16_df224d47ba85f233a8c02e8da1e390b9_amadey_darkgate_elex_smoke-loader_stop.exe
4628	2026-08-16_df224d47ba85f233a8c02e8da1e390b9_amadey_darkgate_elex_smoke-loader_stop.exe
4628	2026-08-16_df224d47ba85f233a8c02e8da1e390b9_amadey_darkgate_elex_smoke-loader_stop.exe
4628	2026-08-16_df224d47ba85f233a8c02e8da1e390b9_amadey_darkgate_elex_smoke-loader_stop.exe
4628	2026-08-16_df224d47ba85f233a8c02e8da1e390b9_amadey_darkgate_elex_smoke-loader_stop.exe
4628	2026-08-16_df224d47ba85f233a8c02e8da1e390b9_amadey_darkgate_elex_smoke-loader_stop.exe
4628	2026-08-16_df224d47ba85f233a8c02e8da1e390b9_amadey_darkgate_elex_smoke-loader_stop.exe
4628	2026-08-16_df224d47ba85f233a8c02e8da1e390b9_amadey_darkgate_elex_smoke-loader_stop.exe
4628	2026-08-16_df224d47ba85f233a8c02e8da1e390b9_amadey_darkgate_elex_smoke-loader_stop.exe
4628	2026-08-16_df224d47ba85f233a8c02e8da1e390b9_amadey_darkgate_elex_smoke-loader_stop.exe
4628	2026-08-16_df224d47ba85f233a8c02e8da1e390b9_amadey_darkgate_elex_smoke-loader_stop.exe
4628	2026-08-16_df224d47ba85f233a8c02e8da1e390b9_amadey_darkgate_elex_smoke-loader_stop.exe
4628	2026-08-16_df224d47ba85f233a8c02e8da1e390b9_amadey_darkgate_elex_smoke-loader_stop.exe
4628	2026-08-16_df224d47ba85f233a8c02e8da1e390b9_amadey_darkgate_elex_smoke-loader_stop.exe
4628	2026-08-16_df224d47ba85f233a8c02e8da1e390b9_amadey_darkgate_elex_smoke-loader_stop.exe
5296	xrpjhbzurmkecwuo.exe
5296	xrpjhbzurmkecwuo.exe
5296	xrpjhbzurmkecwuo.exe
5296	xrpjhbzurmkecwuo.exe
5296	xrpjhbzurmkecwuo.exe
5296	xrpjhbzurmkecwuo.exe
5296	xrpjhbzurmkecwuo.exe
5296	xrpjhbzurmkecwuo.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	2256	i_zusmkecwup.exe
Token: SeDebugPrivilege	1896	i_gezwuomgbz.exe
Token: SeDebugPrivilege	3648	i_trojdbztrl.exe
Token: SeDebugPrivilege	1512	i_gdyvqoigay.exe
Token: SeDebugPrivilege	4540	i_qnifdxvqni.exe
Token: SeDebugPrivilege	5856	i_fdavsnlidy.exe
Token: SeDebugPrivilege	4584	i_fcaxsqkica.exe
Token: SeDebugPrivilege	2912	i_hfzxupmhfc.exe
Token: SeDebugPrivilege	1820	i_rpmhfrpjhc.exe
Token: SeDebugPrivilege	4828	i_cwurpjgecw.exe
Token: SeDebugPrivilege	2728	i_heywrojhbz.exe
Token: SeDebugPrivilege	2976	i_bywqoigayt.exe
Token: SeDebugPrivilege	3192	i_ljdbvtqljd.exe
Token: SeDebugPrivilege	1800	i_gayvqoifax.exe
Token: SeDebugPrivilege	2404	i_vsnhfaxsqk.exe
Token: SeDebugPrivilege	2472	i_xupnhfzxrp.exe
Token: SeDebugPrivilege	2836	i_upmkecausp.exe
Token: SeDebugPrivilege	2120	i_urmhecwuom.exe
Token: SeDebugPrivilege	4800	i_wrojhbztrm.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4368	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4628 wrote to memory of 5296	4628	2026-08-16_df224d47ba85f233a8c02e8da1e390b9_amadey_darkgate_elex_smoke-loader_stop.exe	89
PID 4628 wrote to memory of 3388	4628	2026-08-16_df224d47ba85f233a8c02e8da1e390b9_amadey_darkgate_elex_smoke-loader_stop.exe	90
PID 3388 wrote to memory of 4368	3388	iexplore.exe	91
PID 4368 wrote to memory of 4608	4368	msedge.exe	92
PID 4368 wrote to memory of 2748	4368	msedge.exe	93
PID 4368 wrote to memory of 5612	4368	msedge.exe	94
PID 4368 wrote to memory of 2748	4368	msedge.exe	93
PID 4368 wrote to memory of 2748	4368	msedge.exe	93
PID 4368 wrote to memory of 3504	4368	msedge.exe	95
PID 4368 wrote to memory of 3504	4368	msedge.exe	95
PID 4368 wrote to memory of 5188	4368	msedge.exe	97
PID 4368 wrote to memory of 5188	4368	msedge.exe	97
PID 4368 wrote to memory of 5188	4368	msedge.exe	97
PID 4368 wrote to memory of 5416	4368	msedge.exe	98
PID 4368 wrote to memory of 5416	4368	msedge.exe	98
PID 4368 wrote to memory of 5416	4368	msedge.exe	98
PID 4368 wrote to memory of 6136	4368	msedge.exe	99
PID 4368 wrote to memory of 6136	4368	msedge.exe	99
PID 4368 wrote to memory of 6136	4368	msedge.exe	99
PID 4368 wrote to memory of 5224	4368	msedge.exe	100
PID 4368 wrote to memory of 5224	4368	msedge.exe	100
PID 4368 wrote to memory of 5224	4368	msedge.exe	100
PID 4368 wrote to memory of 4460	4368	msedge.exe	102
PID 4368 wrote to memory of 4460	4368	msedge.exe	102
PID 4368 wrote to memory of 3624	4368	msedge.exe	105
PID 4368 wrote to memory of 3624	4368	msedge.exe	105
PID 4368 wrote to memory of 4664	4368	msedge.exe	106
PID 4368 wrote to memory of 4664	4368	msedge.exe	106
PID 4368 wrote to memory of 6096	4368	msedge.exe	108
PID 5296 wrote to memory of 4420	5296	xrpjhbzurmkecwuo.exe	109
PID 2264 wrote to memory of 3308	2264	zusmkecwup.exe	112
PID 5296 wrote to memory of 1916	5296	xrpjhbzurmkecwuo.exe	117
PID 5296 wrote to memory of 4516	5296	xrpjhbzurmkecwuo.exe	121
PID 3792 wrote to memory of 5968	3792	gezwuomgbz.exe	123
PID 5296 wrote to memory of 604	5296	xrpjhbzurmkecwuo.exe	126
PID 5296 wrote to memory of 1300	5296	xrpjhbzurmkecwuo.exe	130
PID 3544 wrote to memory of 4404	3544	trojdbztrl.exe	132
PID 5296 wrote to memory of 2024	5296	xrpjhbzurmkecwuo.exe	135
PID 4368 wrote to memory of 1756	4368	msedge.exe	137
PID 4368 wrote to memory of 1756	4368	msedge.exe	137
PID 4368 wrote to memory of 1900	4368	msedge.exe	138
PID 4368 wrote to memory of 1900	4368	msedge.exe	138
PID 5296 wrote to memory of 408	5296	xrpjhbzurmkecwuo.exe	142
PID 3896 wrote to memory of 1508	3896	gdyvqoigay.exe	144
PID 5296 wrote to memory of 5532	5296	xrpjhbzurmkecwuo.exe	147
PID 4368 wrote to memory of 2164	4368	msedge.exe	149
PID 4368 wrote to memory of 4304	4368	msedge.exe	150
PID 4368 wrote to memory of 4976	4368	msedge.exe	151
PID 5296 wrote to memory of 2612	5296	xrpjhbzurmkecwuo.exe	154
PID 4696 wrote to memory of 2792	4696	qnifdxvqni.exe	156
PID 5296 wrote to memory of 2628	5296	xrpjhbzurmkecwuo.exe	159
PID 5296 wrote to memory of 2828	5296	xrpjhbzurmkecwuo.exe	163
PID 1884 wrote to memory of 4532	1884	fdavsnlidy.exe	165
PID 5296 wrote to memory of 1204	5296	xrpjhbzurmkecwuo.exe	168
PID 5296 wrote to memory of 4748	5296	xrpjhbzurmkecwuo.exe	172
PID 1588 wrote to memory of 5688	1588	fcaxsqkica.exe	174
PID 5296 wrote to memory of 200	5296	xrpjhbzurmkecwuo.exe	177
PID 5296 wrote to memory of 2164	5296	xrpjhbzurmkecwuo.exe	181
PID 4656 wrote to memory of 704	4656	hfzxupmhfc.exe	183
PID 5296 wrote to memory of 1448	5296	xrpjhbzurmkecwuo.exe	186
PID 4368 wrote to memory of 1228	4368	msedge.exe	188
PID 4368 wrote to memory of 1228	4368	msedge.exe	188
PID 5296 wrote to memory of 1928	5296	xrpjhbzurmkecwuo.exe	194
PID 3228 wrote to memory of 1408	3228	rpmhfrpjhc.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-08-16_df224d47ba85f233a8c02e8da1e390b9_amadey_darkgate_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_df224d47ba85f233a8c02e8da1e390b9_amadey_darkgate_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4628
- C:\Temp\xrpjhbzurmkecwuo.exe
  C:\Temp\xrpjhbzurmkecwuo.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5296
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zusmkecwup.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4420
  - - C:\Temp\zusmkecwup.exe
      C:\Temp\zusmkecwup.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2264
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3308
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2848
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zusmkecwup.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1916
  - - C:\Temp\i_zusmkecwup.exe
      C:\Temp\i_zusmkecwup.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2256
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gezwuomgbz.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4516
  - - C:\Temp\gezwuomgbz.exe
      C:\Temp\gezwuomgbz.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3792
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5968
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1516
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gezwuomgbz.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:604
  - - C:\Temp\i_gezwuomgbz.exe
      C:\Temp\i_gezwuomgbz.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1896
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\trojdbztrl.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1300
  - - C:\Temp\trojdbztrl.exe
      C:\Temp\trojdbztrl.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3544
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4404
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5744
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_trojdbztrl.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2024
  - - C:\Temp\i_trojdbztrl.exe
      C:\Temp\i_trojdbztrl.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3648
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gdyvqoigay.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:408
  - - C:\Temp\gdyvqoigay.exe
      C:\Temp\gdyvqoigay.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3896
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1508
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3380
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gdyvqoigay.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5532
  - - C:\Temp\i_gdyvqoigay.exe
      C:\Temp\i_gdyvqoigay.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1512
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qnifdxvqni.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2612
  - - C:\Temp\qnifdxvqni.exe
      C:\Temp\qnifdxvqni.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4696
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2792
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5596
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qnifdxvqni.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2628
  - - C:\Temp\i_qnifdxvqni.exe
      C:\Temp\i_qnifdxvqni.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4540
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fdavsnlidy.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2828
  - - C:\Temp\fdavsnlidy.exe
      C:\Temp\fdavsnlidy.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1884
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4532
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2960
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fdavsnlidy.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1204
  - - C:\Temp\i_fdavsnlidy.exe
      C:\Temp\i_fdavsnlidy.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5856
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fcaxsqkica.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4748
  - - C:\Temp\fcaxsqkica.exe
      C:\Temp\fcaxsqkica.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1588
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5688
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4520
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fcaxsqkica.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:200
  - - C:\Temp\i_fcaxsqkica.exe
      C:\Temp\i_fcaxsqkica.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4584
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hfzxupmhfc.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2164
  - - C:\Temp\hfzxupmhfc.exe
      C:\Temp\hfzxupmhfc.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4656
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:704
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5916
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hfzxupmhfc.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1448
  - - C:\Temp\i_hfzxupmhfc.exe
      C:\Temp\i_hfzxupmhfc.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2912
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rpmhfrpjhc.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1928
  - - C:\Temp\rpmhfrpjhc.exe
      C:\Temp\rpmhfrpjhc.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3228
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1408
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5456
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rpmhfrpjhc.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5192
  - - C:\Temp\i_rpmhfrpjhc.exe
      C:\Temp\i_rpmhfrpjhc.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1820
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cwurpjgecw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3928
  - - C:\Temp\cwurpjgecw.exe
      C:\Temp\cwurpjgecw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:6076
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1340
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3880
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cwurpjgecw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4920
  - - C:\Temp\i_cwurpjgecw.exe
      C:\Temp\i_cwurpjgecw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4828
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\heywrojhbz.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:712
  - - C:\Temp\heywrojhbz.exe
      C:\Temp\heywrojhbz.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3288
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1460
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:468
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_heywrojhbz.exe ups_ins
    3⤵
    PID:4768
  - - C:\Temp\i_heywrojhbz.exe
      C:\Temp\i_heywrojhbz.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2728
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bywqoigayt.exe ups_run
    3⤵
    PID:1196
  - - C:\Temp\bywqoigayt.exe
      C:\Temp\bywqoigayt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2296
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3772
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2120
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bywqoigayt.exe ups_ins
    3⤵
    PID:5856
  - - C:\Temp\i_bywqoigayt.exe
      C:\Temp\i_bywqoigayt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2976
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljdbvtqljd.exe ups_run
    3⤵
    PID:3556
  - - C:\Temp\ljdbvtqljd.exe
      C:\Temp\ljdbvtqljd.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5916
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5300
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5476
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljdbvtqljd.exe ups_ins
    3⤵
    PID:4148
  - - C:\Temp\i_ljdbvtqljd.exe
      C:\Temp\i_ljdbvtqljd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3192
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gayvqoifax.exe ups_run
    3⤵
    PID:5228
  - - C:\Temp\gayvqoifax.exe
      C:\Temp\gayvqoifax.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4956
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4252
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4704
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gayvqoifax.exe ups_ins
    3⤵
    PID:1756
  - - C:\Temp\i_gayvqoifax.exe
      C:\Temp\i_gayvqoifax.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1800
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vsnhfaxsqk.exe ups_run
    3⤵
    PID:4944
  - - C:\Temp\vsnhfaxsqk.exe
      C:\Temp\vsnhfaxsqk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1008
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3284
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1648
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vsnhfaxsqk.exe ups_ins
    3⤵
    PID:5836
  - - C:\Temp\i_vsnhfaxsqk.exe
      C:\Temp\i_vsnhfaxsqk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2404
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xupnhfzxrp.exe ups_run
    3⤵
    PID:3124
  - - C:\Temp\xupnhfzxrp.exe
      C:\Temp\xupnhfzxrp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4204
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4664
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3192
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xupnhfzxrp.exe ups_ins
    3⤵
    PID:1896
  - - C:\Temp\i_xupnhfzxrp.exe
      C:\Temp\i_xupnhfzxrp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2472
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\upmkecausp.exe ups_run
    3⤵
    PID:3084
  - - C:\Temp\upmkecausp.exe
      C:\Temp\upmkecausp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5952
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5568
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3848
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_upmkecausp.exe ups_ins
    3⤵
    PID:3468
  - - C:\Temp\i_upmkecausp.exe
      C:\Temp\i_upmkecausp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2836
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\urmhecwuom.exe ups_run
    3⤵
    PID:3764
  - - C:\Temp\urmhecwuom.exe
      C:\Temp\urmhecwuom.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4556
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5044
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2868
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_urmhecwuom.exe ups_ins
    3⤵
    PID:1416
  - - C:\Temp\i_urmhecwuom.exe
      C:\Temp\i_urmhecwuom.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2120
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wrojhbztrm.exe ups_run
    3⤵
    PID:2356
  - - C:\Temp\wrojhbztrm.exe
      C:\Temp\wrojhbztrm.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4560
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4504
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5136
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wrojhbztrm.exe ups_ins
    3⤵
    PID:5716
  - - C:\Temp\i_wrojhbztrm.exe
      C:\Temp\i_wrojhbztrm.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4800
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jgeywqljgb.exe ups_run
    3⤵
    PID:4596
  - - C:\Temp\jgeywqljgb.exe
      C:\Temp\jgeywqljgb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3300
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5972
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3312
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7fff1f77c188,0x7fff1f77c194,0x7fff1f77c1a0
      4⤵
      PID:4608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,14931142102225978566,6772142893977132364,262144 --field-trial-handle=2288,i,14318852527396043649,18284733534171638890,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
      4⤵
      PID:2748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,3200286320931218701,4503984139965175539,524288 --field-trial-handle=2288,i,14318852527396043649,18284733534171638890,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:11
      4⤵
      System Time Discovery
      PID:5612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2264,i,8578711928581308954,4364000702879192600,524288 --field-trial-handle=2288,i,14318852527396043649,18284733534171638890,262144 --variations-seed-version --mojo-platform-channel-handle=3344 /prefetch:13
      4⤵
      PID:3504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3584,i,9805375939964928750,1108697763068444787,2097152 --field-trial-handle=2288,i,14318852527396043649,18284733534171638890,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
      4⤵
      PID:5188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3588,i,11265106011287301083,16521936173624630150,2097152 --field-trial-handle=2288,i,14318852527396043649,18284733534171638890,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
      4⤵
      PID:5416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4324,i,7004686504850880683,11208878746502738925,2097152 --field-trial-handle=2288,i,14318852527396043649,18284733534171638890,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:1
      4⤵
      PID:6136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4344,i,8717544018974419973,13888723177251875585,2097152 --field-trial-handle=2288,i,14318852527396043649,18284733534171638890,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:9
      4⤵
      PID:5224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3792,i,13420260819458515670,15960712684423655820,524288 --field-trial-handle=2288,i,14318852527396043649,18284733534171638890,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:14
      4⤵
      PID:4460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5468,i,9647373196782290316,1816785808204845433,524288 --field-trial-handle=2288,i,14318852527396043649,18284733534171638890,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:14
      4⤵
      PID:3624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,14771770361939417874,10104687082052331506,524288 --field-trial-handle=2288,i,14318852527396043649,18284733534171638890,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:14
      4⤵
      PID:4664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,2076831909832444994,4782361820807799085,524288 --field-trial-handle=2288,i,14318852527396043649,18284733534171638890,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:14
      4⤵
      PID:5684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,2076831909832444994,4782361820807799085,524288 --field-trial-handle=2288,i,14318852527396043649,18284733534171638890,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:14
      4⤵
      PID:6096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5212,i,11082637998488701037,15451405749581997868,524288 --field-trial-handle=2288,i,14318852527396043649,18284733534171638890,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:14
      4⤵
      PID:1756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,6785535851830991283,5214823075428123644,524288 --field-trial-handle=2288,i,14318852527396043649,18284733534171638890,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:14
      4⤵
      PID:1900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,8422074240878468116,8969362012815623266,524288 --field-trial-handle=2288,i,14318852527396043649,18284733534171638890,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:14
      4⤵
      PID:2164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5220,i,18377894893003788336,7293224124603971125,524288 --field-trial-handle=2288,i,14318852527396043649,18284733534171638890,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:14
      4⤵
      PID:4304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5212,i,16667763594669881041,11011709650329497761,524288 --field-trial-handle=2288,i,14318852527396043649,18284733534171638890,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:14
      4⤵
      PID:4976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,7222566023822527205,6075517145658006186,524288 --field-trial-handle=2288,i,14318852527396043649,18284733534171638890,262144 --variations-seed-version --mojo-platform-channel-handle=768 /prefetch:14
      4⤵
      PID:1228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,11363460701425314181,2034507183724711564,524288 --field-trial-handle=2288,i,14318852527396043649,18284733534171638890,262144 --variations-seed-version --mojo-platform-channel-handle=2144 /prefetch:14
      4⤵
      PID:3376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6696,i,11067664831092412714,9262826209574281698,524288 --field-trial-handle=2288,i,14318852527396043649,18284733534171638890,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:14
      4⤵
      PID:3832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,6857940765228661735,12450246744210614117,524288 --field-trial-handle=2288,i,14318852527396043649,18284733534171638890,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:14
      4⤵
      PID:5136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5780,i,10472515970711275974,16424583019644557569,262144 --field-trial-handle=2288,i,14318852527396043649,18284733534171638890,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:10
      4⤵
      PID:3844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,17686876700965995942,10733820457987270096,524288 --field-trial-handle=2288,i,14318852527396043649,18284733534171638890,262144 --variations-seed-version --mojo-platform-channel-handle=4116 /prefetch:14
      4⤵
      PID:1648

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1508

C:\Temp\xrpjhbzurmkecwuo.sys
C:\Temp\xrpjhbzurmkecwuo.sys
1⤵
- Executes dropped EXE
PID:2928

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5856

C:\Temp\mjecwuomje.sys
C:\Temp\mjecwuomje.sys
1⤵
- Executes dropped EXE
PID:1508

C:\Temp\tolgebwtrl.sys
C:\Temp\tolgebwtrl.sys
1⤵
- Executes dropped EXE
PID:1316

C:\Temp\wlgeywqoig.sys
C:\Temp\wlgeywqoig.sys
1⤵
- Executes dropped EXE
PID:3404

C:\Temp\bvtnlidays.sys
C:\Temp\bvtnlidays.sys
1⤵
- Executes dropped EXE
PID:3748

C:\Temp\ifaysqkica.sys
C:\Temp\ifaysqkica.sys
1⤵
- Executes dropped EXE
PID:5720

C:\Temp\fcxvpnkfda.sys
C:\Temp\fcxvpnkfda.sys
1⤵
- Executes dropped EXE
PID:4128

C:\Temp\fzxupmkhca.sys
C:\Temp\fzxupmkhca.sys
1⤵
- Executes dropped EXE
PID:2968

C:\Temp\spkhczxrpk.sys
C:\Temp\spkhczxrpk.sys
1⤵
- Executes dropped EXE
PID:5504

C:\Temp\ecwurpjhbz.sys
C:\Temp\ecwurpjhbz.sys
1⤵
- Executes dropped EXE
PID:5872

C:\Temp\hezwqojgbz.sys
C:\Temp\hezwqojgbz.sys
1⤵
- Executes dropped EXE
PID:5780

C:\Temp\gdbwtrljyt.sys
C:\Temp\gdbwtrljyt.sys
1⤵
PID:4332

C:\Temp\qligbywqnl.sys
C:\Temp\qligbywqnl.sys
1⤵
PID:5836

C:\Temp\lfdyvtnlfd.sys
C:\Temp\lfdyvtnlfd.sys
1⤵
PID:1912

C:\Temp\vsqnifaxsp.sys
C:\Temp\vsqnifaxsp.sys
1⤵
PID:5768

C:\Temp\ifausqkicx.sys
C:\Temp\ifausqkicx.sys
1⤵
PID:1576

C:\Temp\xvpmkecaus.sys
C:\Temp\xvpmkecaus.sys
1⤵
PID:4492

C:\Temp\rmjhfzxrpk.sys
C:\Temp\rmjhfzxrpk.sys
1⤵
PID:1924

C:\Temp\cwuomgezwr.sys
C:\Temp\cwuomgezwr.sys
1⤵
PID:5880

C:\Temp\rojhbztrlj.sys
C:\Temp\rojhbztrlj.sys
1⤵
PID:3192

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bvtnlidays.sys

Path C:\Temp\bvtnlidays.sys
Size 293KB
SHA256 b846c807487b5ace825956671147fce049ea11e6a6cb91c7bcfbae31275ce0b6
MD5 5d9f8e58d848fa03eb4a0eca8ce49b0d
SHA1 a0a245e8980dc0a4a3036376fec6c1dfd6b2c21c
SHA512 52ddb711093f6d55c72a0516a29962315045c79326156099fa4b02578b9f1ec19bd32e3530157330161fa4e1ae1db17f9402d0e13160cbe89dd749d6c3f01eed
SSDEEP 3072:ntKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:nIJjiJcbI03GBc3ucY5DCSj
TLSH
T1EE545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdavsnlidy.exe

Path C:\Temp\fdavsnlidy.exe
Size 384KB
SHA256 3f3f835c94ccbc888d052f785bc807fa78498bd68d7d0edf565ae8db562f4986
MD5 08f0fc3ff27487e24fda5a6ea307925e
SHA1 39f98d226088e47ee5305dfe24f0ff04e3489db4
SHA512 24044008fa8974fecbea0a4d406c4351c2a407a75b6309e689e9b609445210465586339b295e82e01ced0a5f520ec0c539bb519d097dbc3a1a293ed0cd1aea75
SSDEEP 3072:TO6UF5toCvty8dsaMj4ygtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ug:66QtpouIJjiJcbI03GBc3ucY5DCSjX
TLSH
T18A847B00BAA4F0F6D995043800EFAF36A67E74281B26CBC3E754CE5D99513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gdyvqoigay.exe

Path C:\Temp\gdyvqoigay.exe
Size 384KB
SHA256 1863c5c870e803dc6cd2594e7174769b4d0c1fcf1be73d7ec36b61c743a30096
MD5 3eb44bdb3718917f214ba7240579aec3
SHA1 36207e9738d6e5bf58735807cf9dbaf491cf749b
SHA512 a8f0db0a6adf28d28d0d056739e6a4996025c8b8c0c8f68bbe52697f59b4242f3566749d7420ca9388f6af0161b68636e7b491b63cad9ef011fe0a2e89fe8354
SSDEEP 3072:lO6UF5toCvty8dsaMj4ygtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ug:M6QtpouIJjiJcbI03GBc3ucY5DCSjX
TLSH
T17C847B00BAA4F0F6D995043800EFAF36A67E74281B26CBC3E754CE5D99513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gezwuomgbz.exe

Path C:\Temp\gezwuomgbz.exe
Size 384KB
SHA256 2863dcd1f8eac3818a049126be45ca6b5bebbe9a16b5e14dcfb257a34cc8ec55
MD5 31fc97f41a2a4bdd44622ee42c87f869
SHA1 0b5d0832cab71f99450c64a444c4a9a63f3dfc28
SHA512 8ccf2e13bdd73d9b56a62e549cff5aff7b35936c63fd247571d272fd4d014c59541ada2dfe503b7b06bb93ed2dcfd56f4b87522c53ba1d3f49894800fa44afb8
SSDEEP 3072:SO6UF5toCvty8dsaMj4ygtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ug:r6QtpouIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1BD847B00BAA4F0F6D995043800EFAF36A67E74281B26CBC3E754CE5D99513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gdyvqoigay.exe

Path C:\Temp\i_gdyvqoigay.exe
Size 384KB
SHA256 3bab81a6329082da3bd68c8ad56c109aa53bb177af67f7327c142f3f7b689cc3
MD5 4b80556d09745d1e1533ef4e1478b823
SHA1 b0a876505a5a916cdbeabf82d0634ab5cbfd9187
SHA512 e597ed15242ff7c487ce2d0e492bfe92a30a5c9d478e2aebb826e6471b1198ba5825b5978e544c6e2c4317a7d76b6216514589e4151674eeb75419d8b7b25d5f
SSDEEP 3072:0O6UF5toCvty8dsaMj4ygtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ug:F6QtpouIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1AD847B00BAA4F0F6D995043800EFAF36A67E74281B26CBC3E754CE5D99513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gezwuomgbz.exe

Path C:\Temp\i_gezwuomgbz.exe
Size 384KB
SHA256 7d058b9f0a717aca89da83ee8b895a058490535ed2971203e3aaa51de6e0b254
MD5 b060d720536435fa1cf5f3a5123a2b94
SHA1 eef6e6c5c6f3136fb20e974644a17eeb0fc2004a
SHA512 2dc2da15f038f1c02bcc53e1270efe45e4620f41447de87c683752d48e57eeaaedff4d2f718506661822055addd97244e3c8bb797dfceaae81383e39a758f2ff
SSDEEP 3072:6O6UF5toCvty8dsaMj4ygtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ug:T6QtpouIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1DC847B00BAA4F0F6D995043800EFAF36A67E74281B26CBC3E754CE5D99513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qnifdxvqni.exe

Path C:\Temp\i_qnifdxvqni.exe
Size 384KB
SHA256 8160a6cfebe02f276cf8564e2a288f4bc97fb536f5f8d3f65b1acb945499ee4c
MD5 2ceaf88ab2a7e40a0c6b5153ac6f1ecc
SHA1 7036d7af2ea602636c1f1a2a28f03cf72de9f894
SHA512 c23ed61fd08e3f91a8431ec0e44faf3e94b76f2930ef090f6b9ed54fc23dd5f87408d5c0562589450ff560f0ab8154ab07256f0ca2af5d0e26d1ac04960e9440
SSDEEP 3072:NO6UF5toCvty8dsaMj4ygtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ug:06QtpouIJjiJcbI03GBc3ucY5DCSjX
TLSH
T167847B00BAA4F0F6D995043800EFAF36A67E74281B26CBC3E754CE5D99513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_trojdbztrl.exe

Path C:\Temp\i_trojdbztrl.exe
Size 384KB
SHA256 96238efc8bb63ab6cb2067b2f93edc70a0ffb8a9e030cf3c61e5aa13d2b546ae
MD5 c398b2c827b5b8d825b9682337a6c35e
SHA1 71c1cbf97b11b9f9936cee53aada73224e28078f
SHA512 7f7d69ce0da51c63d61e8f9ed5fade6e7df80746c00412881487ed5ac3aa50798b5ad2445b143eeb6fafbcb09530c2e95b24ac6ddecce5cb9193bc214bfe476f
SSDEEP 3072:lO6UF5toCvty8dsaMj4ygtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ug:M6QtpouIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C2847B00BAA4F0F6D995043800EFAF36A67E74281B26CBC3E754CE5D99513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zusmkecwup.exe

Path C:\Temp\i_zusmkecwup.exe
Size 384KB
SHA256 3def0b2973c399f819f545a1dac38028ce4ebbd909e4650d1dddcd1ddb52e271
MD5 cf9d1fcaa7faa6c48319f8fe82ede348
SHA1 5b18dc70dfb5c1e4a3b08d3224cf740236397fff
SHA512 0c562802e91ec5a6d65346eb99bf402bb8d81435c2b66e0b181a9ce3f9af52ba19274719636320c4ec0325c18e3a2a66e7012c79e18e463b49ba0b39eb9916e6
SSDEEP 3072:BO6UF5toCvty8dsaMj4ygtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ug:I6QtpouIJjiJcbI03GBc3ucY5DCSjX
TLSH
T103847B00BAA4F0F6D995043800EFAF36A67E74281B26CBC3E754CE5D99513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ifaysqkica.sys

Path C:\Temp\ifaysqkica.sys
Size 293KB
SHA256 608cbd66358e6545ac8f4caa03d1eeb97601ab6171f4c14bb3fb00d45cf9f8f4
MD5 6a4a120eb92a00cd7eff206ee2314ba3
SHA1 8535309983abfe89fa2f7cf8b7ee4dc874ddb286
SHA512 b7b9f518670aaa09d973a22ca585668952e9522a96fa08dbfbe090feb0ffc4290c62c5472e1149b68cc795fa3ba51e2d7d90c3ad9cd7601e238d0c0d83590798
SSDEEP 3072:FtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:FIJjiJcbI03GBc3ucY5DCSj
TLSH
T1E9545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mjecwuomje.sys

Path C:\Temp\mjecwuomje.sys
Size 293KB
SHA256 e01442171a5275e410803ea003e948ca4f734780bb819720005479e92af68a42
MD5 06c3474c67ee060fffc01ea358ef43e7
SHA1 401d8a10d51ecfee2151fe92bb3957bdb204e6bb
SHA512 a5bea931434fef790842f167f5c650457fdc4c3dff4b087977123dddf691b04bb012a281820824286abde031bc8a3561bc0f645294c3722398adde8a9e890bdd
SSDEEP 3072:ZtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:ZIJjiJcbI03GBc3ucY5DCSj
TLSH
T131545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qnifdxvqni.exe

Path C:\Temp\qnifdxvqni.exe
Size 384KB
SHA256 55444bed772540c343903b544300b658ff857bd83ffe72c45d8797279e00f814
MD5 ee71e38d33e334f566261927dcf5206c
SHA1 f592d7c2d31bb865d406a6c00fea9fbccaf70455
SHA512 b825616e4c616fb6938432e1d1d1528a4444e1cd7bb89873eeb3bcdee301ad74ea94a03f645d03017ab46f2199a6d4b678e9d5936ded38b977a97bd3befeb074
SSDEEP 3072:3O6UF5toCvty8dsaMj4ygtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ug:+6QtpouIJjiJcbI03GBc3ucY5DCSjX
TLSH
T104847B00BAA4F0F6D995043800EFAF36A67E74281B26CBC3E754CE5D99513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tolgebwtrl.sys

Path C:\Temp\tolgebwtrl.sys
Size 293KB
SHA256 267c635a7333fabd22c24fd212ea9c66e63866bb4239c64deea12a3904efc829
MD5 c340fdaca6e76d3dc9ce34792e378262
SHA1 d260604567079968de53439b2ccf4e431debed97
SHA512 8bb775c6305de542b11fd54483a9896a7cdc051a4291b6f9fcea87ffdf74a060c3242d8398c285d07c3dc6a87c9636351ca458551f564a2a15e20bc9d3987095
SSDEEP 3072:8tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:8IJjiJcbI03GBc3ucY5DCSj
TLSH
T1A2545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trojdbztrl.exe

Path C:\Temp\trojdbztrl.exe
Size 384KB
SHA256 8d2d2c810107ceaff626f1e04eca48ca4c1df9a03320b7b9c55d89aa5ac9d9ba
MD5 75aebe51cfacfa3fcd17ca265d68e9ae
SHA1 7405d03c0b2aa125bab351955af7d31792564a18
SHA512 4cb7f8dcf7b96091e6a7e49e55a547e6a8b43f86f81471a4460c3a13755b68f67c8de4da774a208afdfaa2c07fb74e6d91537d1398ed4f186e9e7b8cbc7a1e9c
SSDEEP 3072:nO6UF5toCvty8dsaMj4ygtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ug:O6QtpouIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D4847B00BAA4F0F6D995043800EFAF36A67E74281B26CBC3E754CE5D99513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wlgeywqoig.sys

Path C:\Temp\wlgeywqoig.sys
Size 293KB
SHA256 c4bcaa217f7d89e00f6ad8a2ae834fd4796d1660e01ad2bd06c24c0fdbe6fe2d
MD5 f8cc9790de311d26d6764a9ebc72c883
SHA1 075cb8e4b25fc7c3a829573a0ea3cf1cce659983
SHA512 7806fbd7a757b922029f7be54cbf518f3bab7ac30f2870b4719385b866fe3256a606f1f0800b1feafcf49806b4c2ba3821ce7e44d8ef94f13749267d6bff412f
SSDEEP 3072:itKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:iIJjiJcbI03GBc3ucY5DCSj
TLSH
T1AC545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xrpjhbzurmkecwuo.exe

Path C:\Temp\xrpjhbzurmkecwuo.exe
Size 384KB
SHA256 fe3c14f79cf7bdd48e13af87e71d37d79eb86138aa6ff35a2f79d1e12f4303d4
MD5 776768961e511df354ae47be4f235583
SHA1 120778593493136887f260bedddfedbbf26c4707
SHA512 5fad5f9eef703ee891eb820143b5bd95d7ef8a7962be5dcbd343f3473b16004e6a113530b104eb31834f1af7a9ebfa36c1e3a9ab4504403e4a05be2109731e3f
SSDEEP 3072:hO6UF5toCvty8dsaMj4ygtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ug:o6QtpouIJjiJcbI03GBc3ucY5DCSjX
TLSH
T182847B00BAA4F0F6D995043800EFAF36A67E74281B26CBC3E754CE5D99513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xrpjhbzurmkecwuo.sys

Path C:\Temp\xrpjhbzurmkecwuo.sys
Size 293KB
SHA256 ef6099457a4e9c36a74a6bdc5dc72d4a8b574665cf2be69de2edcd8dd5e85dc5
MD5 04b50dbfc30e4b8d740e2189bbe3e491
SHA1 944435226eda0594218a16c9c7d90dc66b880b6a
SHA512 6fb027213429c808b947f14bdfcbca3f26098b5177eb4cade03fff99364a6770602c920d257ae76b0476263264f215036297392af1cf2c9f227cbedb97e70793
SSDEEP 3072:0tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:0IJjiJcbI03GBc3ucY5DCSj
TLSH
T1E4545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zusmkecwup.exe

Path C:\Temp\zusmkecwup.exe
Size 384KB
SHA256 d20235561f77ea02f6a6879ff9c62202a572296538ac665fbd2c861007bc1325
MD5 8aadc2b98f167dfda553a44efcd97855
SHA1 4263a633b6d0bf18d3f9007bf7853d924593b928
SHA512 835d247fd57c04ec909b4f41a461566734c86a9ae7206f7227848ccd1536616e4c3fb700c7e15651e1a81883441eda41f50517e8cd6e63500635b2493693e3ed
SSDEEP 3072:lO6UF5toCvty8dsaMj4ygtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ug:M6QtpouIJjiJcbI03GBc3ucY5DCSjX
TLSH
T197847B00BAA4F0F6D995043800EFAF36A67E74281B26CBC3E754CE5D99513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 18a644ba613d5b4137dabc346f57eca622b6888922eaec751025ab3c0a002fd5
MD5 5eddc74c05def624cfd47ea0a7e304a5
SHA1 b5f795fcc3846bb781e66e0373fce119975b2659
SHA512 1c777d774c154e89b80817ce7344495d83eecf133c36e0ad7c60dd14d76e628697535cc3fc379ca4eeb776f3bea5096f94d0fd76a2394ecd2e52f5ca8dc0053f
TLSH
T133D09B5672455C4CD641343224E55217E3008821654546194353F0768DD668717ABD9A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 da739d58d61b2ac7b5d9bb7ad60982cb15b364d9c7c9297fd0c9719c271cd985
MD5 2d2e0ac0da9a175b4b6a8be7c9d51cce
SHA1 ff15c8a5ff11faefae3f7491c7968a2163702b81
SHA512 0ae78f15909f04e1a81109917b8eeb5b8062a49558d8a40f15c02076b087f36e82b88b329e9d984fc68c62cb15408123b9db7f705f2745bfefc30b5aa2e164e6
TLSH
T1EAD09B5A72455D4CD641343224E55217E3108821754546194253F0768DD668717ABD9E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c11bbf0eebeab9a20370796441051595d0c68618ec2d55d7517b39374ec6591b
MD5 3389fa4c3e373c34505b8302999a2074
SHA1 ce848691e66f0eb929e5831791f2f461bb212f08
SHA512 2757bcb0a6d18bc6b22921081247118c195e924fd48c044bc9d0382347b0875aaf32900b51003126e769f7829d552dedc14283d5a23e81feeb07ebcfbe67523d
TLSH
T1C45162A38325CFF9DB1585B371E1588C36F084B523876E12A04BAEB69966F1C72D1133
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe597768.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe597768.TMP
Size 3KB
SHA256 c646681e8f34c759b3812ac26618526d8d28e357a7d5ad031549945c7103ff0f
MD5 eed6fffdc926420a6d7a1349d08396b7
SHA1 e1c418745b30162dff3ada83c3689af04d6d0173
SHA512 a57c480072dc9a7e70aeb2f7e9910aebb7ce16040dc9ef7ef34328a8ecd32f730f55e5377afc68787cf26fd2a98b507802bc593227ac4cd4349d633503915020
TLSH
T1225162A38325CFE9D71584B375E1588C36F484B523476E13A04BAEB69967F1C72D1133
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7bd30575-4f6f-43bd-ba75-aaea63eb0fca.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\7bd30575-4f6f-43bd-ba75-aaea63eb0fca.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 df11b27b0ac5ad604f418ea09de8d5545cb3813629cf18b88a661be6d6066a2c
MD5 516b410f2253ab3f8a7241253d7599ae
SHA1 55a54c5114637fe3a106cbc82b1aaa3a55f79e0d
SHA512 5ba017eb3fef9af0fc4c52a16b71c1d8ee9b0377c03947ed4b1d0c6da5066ff5b427e3de1041f5c9df87a588e4369bb486c400988d2a7457ca04c741df22549d
TLSH
T158419EF783F4956E890156F0AA147E1FCE2C0515432C7D5AC9E4AE2B93F3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 96d94d86dec9f87a88acb4c21f8323561c029b9b711fc81a2dfcad8d0849fbef
MD5 a5fad10cd6d940bb48e586b63efbc997
SHA1 9ea37f461f82508742234d4bc9a42c2d241d516c
SHA512 75d991708937b6fba4868d2e5c63751412a7ad796860e910e4ab968b53d93004ac91a28464e7916cfcd69c4c411373ea8e372949b600c9a3d8402226a9ad1b57
SSDEEP 192:sxRQRYC6/fisU4TkpQYCbKzoA8p9x/g6+WNCVi/YEuAk3wGbvIgV63J:sxRQ56/fisXTkpQPHX/5X/6JPe
TLSH
T17C42C8156E28A93B5CC7E219BB15BF53E7F81033A1911E48EAFD8A1C04EB6DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 b2b8ad0154a0187065d79553451947a82a4fb55c4675e3d77a64f938ca9f0d31
MD5 f971730b48a646cf1a30d5c51968729b
SHA1 7ea8aab4e7badefbed3c179fbe20252f16dfee6d
SHA512 2e42d2043f5d83df5fa0c850dd0091889871876d1459dc0fcb90148a7d4593fd2f6894f9473637529406eb8f84e414b1587d249f7cb59db79ae024517107c42c
SSDEEP 192:sxRLRYC6/fis04TgpQrZWWxbzoA8p9x/g6+WNCVi/YEuya3wGbvIgDt63J:sxRL56/fis3TgpQFTx6X/5X/6fPS
TLSH
T12642B715AE28A97B5CC7E219BB157F53E3F8603391911E48EAFD8A1C04EB6DD620340F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 70a52c04aa0a72325d9774c6b8e79674c450d6f0e84ba091e12cb37b2bc5c96d
MD5 0947cc8536f12ada37b71de085d0b243
SHA1 3dcb27f0fdedb1ab6cb1dd5a2579a4b315bb80b9
SHA512 e392865a667565ce201e060cbc59a03988f2c3dc247ca9bfc6f14e5146544ecdd589470d668f629681137974bbcd5864493d02c9ad67ff1d0ee329282fc7a111
SSDEEP 192:sxRLRYC6/fis04TkpQYCbKzoA8p9x/g6+WNCVi/YEuAk3wGbvIgDf63J:sxRL56/fis3TkpQPHX/5X/6JP0
TLSH
T1BF42C8156E28A93B5CC7E219BB55BF53E7F81033A1911E48EAFC8A1C04EB6DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 cfecd579595d3e4744f09a8a9ccc14ec73eb413d175455aa2aa33bbfe0d9fa7a
MD5 5a143c7b334b56a106893d8d16325c02
SHA1 fbd2b5fdf09a0c5d94f5e76e142dfaa69badc839
SHA512 2c7bdc43fc2db07457ec8a2c9d45b55836e4e0374bc5b359a8d3ab07af209ba8ae63ab306c846ad8a8efe29905d169896f903544532f36f1e8f6402a7138902f
SSDEEP 768:40Dk6DJQD8xF7pLuL7N0DbWgQ6DjfIQDF8F1+UoAYDCx9Tuqh0VfUC9xbog/OV8E:40Dk6DJQD8xTE7N0DbWgQ6DjfIQDFu13
TLSH
T170C2D97B640CCB7F4F804ADDAD197A8A6DA802CB56D8CD8047FE991C02C7BEE51194DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a7ec9f6071c190a8789ce5f4e6072c3346b58ac3f095822cc2a8e76a43e07ef6
MD5 489bc6dbc5314296ca358d94915ce09a
SHA1 73ef7665db7219266471bb093408e2b21030a1df
SHA512 4069eb857a16aa6966f8ca4f0545d0ef58a46dfd7d9658ebe468f83edb85ae8fbbecc71669094f31e971f74cdff3bdbadb6f05442ec3ccde4223895f0578ffbc
SSDEEP 96:KRgRkQiOCYWm7LgYYK49gKYcY4rKQ1HfItpfd9xWJmsgRxK44g/xcnvOR09KKGbj:CgRkQiOCPm7UY89gK3Y4rKQ1HfItpfdl
TLSH
T11D919684367E02413C7E654C91ED9D1B53C238B235BCA46B7BAA01A54FA7E064EFDCD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d790a842-eb58-4c41-8f70-574fd0837ca1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\d790a842-eb58-4c41-8f70-574fd0837ca1.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 ee898adb3ce96abbb1557b2594bb29b3a53e95c2c36120540acb4f20cfc96994
MD5 651eaa671136e409ee552f2b81d2ab63
SHA1 eb26a81d39aab5b2391049394601437f3f3223fe
SHA512 c089d056ff5778d46462fd43669656ffd9a8a3edcf7d506e2e9d14eee96c15561a4890f62dbb37f5b7c6ff870f78a65cabfddeb7c27eab81801f644f1d70f68b
SSDEEP 768:uFQ63/wgivRfwnZ/+l1t0eX6+qTko0u229a4vsTPPi9PMs:F63Iv4UvVTVKa4WP0
TLSH
T16C2338F198D38977D8AE9783633D2E469EBCD063B5845984BBC99D0CCC461BFC70A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 1d57770e5137369ffd618b13727959d5feb5e64afd10aa651f92654e846202a3
MD5 eb0a01e921276a335fc5163c502b0d7e
SHA1 4e71706d89e22402af57ee377f08a3612bb9534b
SHA512 1d53552cbd6b4daad5a3d9708e88e31b40b1ea60bf0511793724f712b06319d45399194e22f457149c8e7b0e385e647241d51d77a4396c5e2c50b036a156a5ce
SSDEEP 768:Erv+4UNbd+3P2nqvDTd+Z/+l1t4eX6+qTko0u229a4vsTPeVH1Sdq:EbsbA3P2j2vVTVKa4WEH1R
TLSH
T17313CF31E8689D7388E6D784714776876FB82173C6C40B98D9DEAB4D064B19C270FD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 32b39c7ba17ba319b6f25842650e9f90d3f11072f6d2e14600fc24cf60150d6d
MD5 f455496201e6cd4675908322c912e582
SHA1 fe856a27da81a3513936618efe61c17608b016ad
SHA512 705ef0c0b072d56c0f21a9c963def0bfed48208cc56d30ec78ea51f3c459029278e09612ab651898536d0bb8f6025cf69744e69c9596ec14e797b1c326440f3e
SSDEEP 768:prv+4UNbdG30aNDTd+Z/+keX6+qTko0u229a4vsDueVH1SdW:pbsbU3oevVTVKa4HEH1h
TLSH
T18B03CF32E8A98A778CE6D784714775472EB92173C7C80B90D8ED6F4D025B5AC270BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 d5d118b142cd32ff8ed8cf30bcba8648cf3a0a87e8cbca0b5eb747cf07cd96aa
MD5 a8378e8a9f306e8926ec081ffe45b24b
SHA1 8c0248d375af8a5319d65d955f0a0806de7a9a95
SHA512 8177bde7781d9b17a09fec7046e77d0e8a5433e75885d702760020cd286cc52e2d4b1fd3f43489a361a61bc6baa8f8ea527fb1479c80e283e4c2ac7d94af8c6d
SSDEEP 768:Drv+4UNbdG3Z7xDTd+Z/+l1tbeX6+qTko0u229a4vsSPeVH1SdW:DbsbU38RvVTVKa4tEH1h
TLSH
T12103BF31E4699E7389E6D784714772472FB921B3CAC40F94D8DEAB4D064B19C2B0F92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 e60ffc3dd64932555b4e42dfd67354aacd0fd8a4df7a5820c7ede2624f55ebbe
MD5 a9a685ddfef03e272486490d16412737
SHA1 89348dfdc70716888123b56ac95e54e391709962
SHA512 b4dea66532ebdada865df5e7ebaa24161b1d16cd464569e9d157a1efd39f4a72a7d13808343218af9869772aa9b0fd7a56e91e15d7b5748e649572a2bed8efe8
SSDEEP 768:gx3CvRdvDTd+Z/+l1t4eX6+qTko0u229a4vsTPPi9PMs:gx3Cvo2vVTVKa4WP0
TLSH
T10DF2BF70F8659D6388EAE784725732436EF92173D6C41E58E9DDEB0D054B1AC1B0BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4368_908163090\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 0dcf10d09147fc52d5ee4069eb00626cbdfd3d1b257d1b0f40968a0395fd9729
MD5 ce9b2a5b2609af066a89d477a52dae5c
SHA1 dcdee279d5aac81fbbc6d1213fa3a22b6d007c60
SHA512 e4aaa5066065b05797a515b03e919d646f0188b7a29498c07021fb9a689711ab0979519709752682212c925b6a9e702486b98f4c627ca150b6782eb9ffaab639
TLSH
T1A771238356B8D9F2C1DA5BF002835248F1FF22380723707507555686AB30ABA58B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1316-195-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1508-148-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1576-446-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1912-415-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1924-472-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2928-61-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2968-322-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3192-493-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3404-259-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3748-273-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4128-318-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4332-390-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4332-411-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4492-451-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5504-337-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5720-310-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5768-435-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5780-370-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5836-410-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5872-341-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5880-476-0x0000000000010000-0x00000000000AB000-memory.dmp

Download