systex | f0027169f9a0f1c78a9421317a1daf340bb2432b10f158bc378ff7b8343c8134

Analysis

max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 04:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-30_52b03da3b653f72434a694cb70341290_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Size 376KB
Sample260701-fmlfzagx41
SHA256 f0027169f9a0f1c78a9421317a1daf340bb2432b10f158bc378ff7b8343c8134
MD5 52b03da3b653f72434a694cb70341290
SHA1 1ea329eb11f8b35534f206f36e93642ea358a686
SHA512 fa8401b94c2636ea473eb701b2a0c97b580f7398986bed3673009d2b63457c402281cb5cf4fbbec50b8dc0ecff0fbf150066b70d38194ad7e7d31563c8ab3a19
SSDEEP 3072:KViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:KViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T131847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
2776	zxrpkhczxrpjhczx.exe
4176	zxrpkhczxrpjhczx.sys
5968	CreateProcess.exe
716	hecxupnhez.exe
2348	CreateProcess.exe
820	CreateProcess.exe
4664	i_hecxupnhez.exe
4736	bzurmkecwu.sys
4812	CreateProcess.exe
1228	pjhbzurmje.exe
4648	CreateProcess.exe
3036	CreateProcess.exe
5336	i_pjhbzurmje.exe
2496	omjebwuomg.sys
748	CreateProcess.exe
5352	oljhbztrmj.exe
2576	CreateProcess.exe
3344	CreateProcess.exe
5584	i_oljhbztrmj.exe
5544	ywqoigbywt.sys
1388	CreateProcess.exe
4628	ywqoljgbyt.exe
3396	CreateProcess.exe
5188	CreateProcess.exe
6044	i_ywqoljgbyt.exe
2096	bvtnlgdywt.sys
2952	CreateProcess.exe
2180	ywqoigbysq.exe
2132	CreateProcess.exe
1460	CreateProcess.exe
2760	i_ywqoigbysq.exe
1252	tnlfdyvqoi.sys
3616	CreateProcess.exe
5292	aysqlidays.exe
2940	CreateProcess.exe
2768	CreateProcess.exe
3280	i_aysqlidays.exe
2624	dxvqnifays.sys
5628	CreateProcess.exe
3836	aysqkidavt.exe
672	CreateProcess.exe
2728	CreateProcess.exe
1712	i_aysqkidavt.exe
4248	faxsqkicav.sys
4492	CreateProcess.exe
3420	axsqkicaus.exe
2632	CreateProcess.exe
5364	CreateProcess.exe
788	i_axsqkicaus.exe
568	upmkhczxrp.sys
6108	CreateProcess.exe
5800	pjhczusmke.exe
4840	CreateProcess.exe
5336	CreateProcess.exe
932	i_pjhczusmke.exe
4268	upmhfzxrpj.sys
6024	CreateProcess.exe
5272	hezxrpjhbz.exe
5756	CreateProcess.exe
1376	CreateProcess.exe
3968	i_hezxrpjhbz.exe
4304	mkhbzwuomh.sys
992	CreateProcess.exe
2584	jhbzwurmje.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1932_142778702\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1932_9624295\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1932_1823891001\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1932_1823891001\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1932_1823891001\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1932_213873622\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1932_142778702\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1932_9624295\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1932_1823891001\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhczusmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cxupnkifzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkecwupmhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkecwupmhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgecwtroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqlidays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbvqoigby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czurmkecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oljhbztrmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywqoigbysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqlidays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjebwtomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjebwtomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-30_52b03da3b653f72434a694cb70341290_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hecxupnhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axsqkicaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hezxrpjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vqnifdbysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vqnifdbysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oljhbztrmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywqoljgbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqkidavt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upnhfdxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hecxupnhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhbzurmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axsqkicaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhbzwurmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxvqnlfdys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrpkhczxrpjhczx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqoljgbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhczusmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbvqoigby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dxvqnlfdys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czurmkecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhbzwurmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhbzurmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqoigbysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqkidavt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hezxrpjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_upnhfdxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxupnkifzx.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5252	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
8	ipconfig.exe
1316	ipconfig.exe
4924	ipconfig.exe
3576	ipconfig.exe
2316	ipconfig.exe
2612	ipconfig.exe
6048	ipconfig.exe
3484	ipconfig.exe
3524	ipconfig.exe
4808	ipconfig.exe
5608	ipconfig.exe
2592	ipconfig.exe
4264	ipconfig.exe
5400	ipconfig.exe
5108	ipconfig.exe
5908	ipconfig.exe
976	ipconfig.exe
2812	ipconfig.exe
4536	ipconfig.exe
4672	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2132828192-1552876075-2324613956-1000\{B8D54F59-C672-4BF9-8FC7-FF57422A0C08}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3464	2026-06-30_52b03da3b653f72434a694cb70341290_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3464	2026-06-30_52b03da3b653f72434a694cb70341290_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3464	2026-06-30_52b03da3b653f72434a694cb70341290_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3464	2026-06-30_52b03da3b653f72434a694cb70341290_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3464	2026-06-30_52b03da3b653f72434a694cb70341290_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3464	2026-06-30_52b03da3b653f72434a694cb70341290_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3464	2026-06-30_52b03da3b653f72434a694cb70341290_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3464	2026-06-30_52b03da3b653f72434a694cb70341290_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3464	2026-06-30_52b03da3b653f72434a694cb70341290_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3464	2026-06-30_52b03da3b653f72434a694cb70341290_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3464	2026-06-30_52b03da3b653f72434a694cb70341290_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3464	2026-06-30_52b03da3b653f72434a694cb70341290_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3464	2026-06-30_52b03da3b653f72434a694cb70341290_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3464	2026-06-30_52b03da3b653f72434a694cb70341290_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3464	2026-06-30_52b03da3b653f72434a694cb70341290_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3464	2026-06-30_52b03da3b653f72434a694cb70341290_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3464	2026-06-30_52b03da3b653f72434a694cb70341290_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3464	2026-06-30_52b03da3b653f72434a694cb70341290_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3464	2026-06-30_52b03da3b653f72434a694cb70341290_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3464	2026-06-30_52b03da3b653f72434a694cb70341290_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3464	2026-06-30_52b03da3b653f72434a694cb70341290_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3464	2026-06-30_52b03da3b653f72434a694cb70341290_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3464	2026-06-30_52b03da3b653f72434a694cb70341290_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3464	2026-06-30_52b03da3b653f72434a694cb70341290_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3464	2026-06-30_52b03da3b653f72434a694cb70341290_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3464	2026-06-30_52b03da3b653f72434a694cb70341290_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3464	2026-06-30_52b03da3b653f72434a694cb70341290_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3464	2026-06-30_52b03da3b653f72434a694cb70341290_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3464	2026-06-30_52b03da3b653f72434a694cb70341290_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3464	2026-06-30_52b03da3b653f72434a694cb70341290_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3464	2026-06-30_52b03da3b653f72434a694cb70341290_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3464	2026-06-30_52b03da3b653f72434a694cb70341290_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3464	2026-06-30_52b03da3b653f72434a694cb70341290_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3464	2026-06-30_52b03da3b653f72434a694cb70341290_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3464	2026-06-30_52b03da3b653f72434a694cb70341290_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3464	2026-06-30_52b03da3b653f72434a694cb70341290_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3464	2026-06-30_52b03da3b653f72434a694cb70341290_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3464	2026-06-30_52b03da3b653f72434a694cb70341290_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3464	2026-06-30_52b03da3b653f72434a694cb70341290_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3464	2026-06-30_52b03da3b653f72434a694cb70341290_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3464	2026-06-30_52b03da3b653f72434a694cb70341290_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3464	2026-06-30_52b03da3b653f72434a694cb70341290_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3464	2026-06-30_52b03da3b653f72434a694cb70341290_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3464	2026-06-30_52b03da3b653f72434a694cb70341290_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3464	2026-06-30_52b03da3b653f72434a694cb70341290_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3464	2026-06-30_52b03da3b653f72434a694cb70341290_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3464	2026-06-30_52b03da3b653f72434a694cb70341290_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3464	2026-06-30_52b03da3b653f72434a694cb70341290_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3464	2026-06-30_52b03da3b653f72434a694cb70341290_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3464	2026-06-30_52b03da3b653f72434a694cb70341290_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3464	2026-06-30_52b03da3b653f72434a694cb70341290_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3464	2026-06-30_52b03da3b653f72434a694cb70341290_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3464	2026-06-30_52b03da3b653f72434a694cb70341290_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3464	2026-06-30_52b03da3b653f72434a694cb70341290_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3464	2026-06-30_52b03da3b653f72434a694cb70341290_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3464	2026-06-30_52b03da3b653f72434a694cb70341290_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2776	zxrpkhczxrpjhczx.exe
2776	zxrpkhczxrpjhczx.exe
2776	zxrpkhczxrpjhczx.exe
2776	zxrpkhczxrpjhczx.exe
2776	zxrpkhczxrpjhczx.exe
2776	zxrpkhczxrpjhczx.exe
2776	zxrpkhczxrpjhczx.exe
2776	zxrpkhczxrpjhczx.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe
1932	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	4664	i_hecxupnhez.exe
Token: SeDebugPrivilege	5336	i_pjhbzurmje.exe
Token: SeDebugPrivilege	5584	i_oljhbztrmj.exe
Token: SeDebugPrivilege	6044	i_ywqoljgbyt.exe
Token: SeDebugPrivilege	2760	i_ywqoigbysq.exe
Token: SeDebugPrivilege	3280	i_aysqlidays.exe
Token: SeDebugPrivilege	1712	i_aysqkidavt.exe
Token: SeDebugPrivilege	788	i_axsqkicaus.exe
Token: SeDebugPrivilege	932	i_pjhczusmke.exe
Token: SeDebugPrivilege	3968	i_hezxrpjhbz.exe
Token: SeDebugPrivilege	2284	i_jhbzwurmje.exe
Token: SeDebugPrivilege	932	i_mjebwtomge.exe
Token: SeDebugPrivilege	5248	i_jdbvqoigby.exe
Token: SeDebugPrivilege	3888	i_vqnifdbysq.exe
Token: SeDebugPrivilege	3376	i_dxvqnlfdys.exe
Token: SeDebugPrivilege	1988	i_upnhfdxvpn.exe
Token: SeDebugPrivilege	3708	i_cxupnkifzx.exe
Token: SeDebugPrivilege	2536	i_czurmkecwu.exe
Token: SeDebugPrivilege	4888	i_mkecwupmhe.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1932	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3464 wrote to memory of 2776	3464	2026-06-30_52b03da3b653f72434a694cb70341290_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 3464 wrote to memory of 564	3464	2026-06-30_52b03da3b653f72434a694cb70341290_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 564 wrote to memory of 1932	564	iexplore.exe	90
PID 1932 wrote to memory of 1868	1932	msedge.exe	91
PID 1932 wrote to memory of 3052	1932	msedge.exe	92
PID 1932 wrote to memory of 5252	1932	msedge.exe	93
PID 1932 wrote to memory of 3052	1932	msedge.exe	92
PID 1932 wrote to memory of 3052	1932	msedge.exe	92
PID 1932 wrote to memory of 5884	1932	msedge.exe	94
PID 1932 wrote to memory of 5884	1932	msedge.exe	94
PID 1932 wrote to memory of 4796	1932	msedge.exe	96
PID 1932 wrote to memory of 4796	1932	msedge.exe	96
PID 1932 wrote to memory of 4796	1932	msedge.exe	96
PID 1932 wrote to memory of 3716	1932	msedge.exe	97
PID 1932 wrote to memory of 3716	1932	msedge.exe	97
PID 1932 wrote to memory of 3716	1932	msedge.exe	97
PID 1932 wrote to memory of 2700	1932	msedge.exe	98
PID 1932 wrote to memory of 1652	1932	msedge.exe	99
PID 1932 wrote to memory of 2700	1932	msedge.exe	98
PID 1932 wrote to memory of 2700	1932	msedge.exe	98
PID 1932 wrote to memory of 1652	1932	msedge.exe	99
PID 1932 wrote to memory of 1652	1932	msedge.exe	99
PID 1932 wrote to memory of 5676	1932	msedge.exe	100
PID 1932 wrote to memory of 5676	1932	msedge.exe	100
PID 2776 wrote to memory of 5968	2776	zxrpkhczxrpjhczx.exe	104
PID 1932 wrote to memory of 5040	1932	msedge.exe	105
PID 1932 wrote to memory of 3516	1932	msedge.exe	106
PID 1932 wrote to memory of 5040	1932	msedge.exe	105
PID 1932 wrote to memory of 3516	1932	msedge.exe	106
PID 1932 wrote to memory of 5984	1932	msedge.exe	110
PID 716 wrote to memory of 2348	716	hecxupnhez.exe	111
PID 1932 wrote to memory of 3604	1932	msedge.exe	114
PID 1932 wrote to memory of 3604	1932	msedge.exe	114
PID 1932 wrote to memory of 3396	1932	msedge.exe	115
PID 1932 wrote to memory of 3396	1932	msedge.exe	115
PID 2776 wrote to memory of 820	2776	zxrpkhczxrpjhczx.exe	118
PID 2776 wrote to memory of 4812	2776	zxrpkhczxrpjhczx.exe	122
PID 1228 wrote to memory of 4648	1228	pjhbzurmje.exe	124
PID 2776 wrote to memory of 3036	2776	zxrpkhczxrpjhczx.exe	127
PID 2776 wrote to memory of 748	2776	zxrpkhczxrpjhczx.exe	131
PID 5352 wrote to memory of 2576	5352	oljhbztrmj.exe	133
PID 2776 wrote to memory of 3344	2776	zxrpkhczxrpjhczx.exe	136
PID 2776 wrote to memory of 1388	2776	zxrpkhczxrpjhczx.exe	141
PID 4628 wrote to memory of 3396	4628	ywqoljgbyt.exe	143
PID 2776 wrote to memory of 5188	2776	zxrpkhczxrpjhczx.exe	146
PID 1932 wrote to memory of 1824	1932	msedge.exe	148
PID 1932 wrote to memory of 2904	1932	msedge.exe	149
PID 1932 wrote to memory of 3908	1932	msedge.exe	150
PID 2776 wrote to memory of 2952	2776	zxrpkhczxrpjhczx.exe	153
PID 2180 wrote to memory of 2132	2180	ywqoigbysq.exe	155
PID 2776 wrote to memory of 1460	2776	zxrpkhczxrpjhczx.exe	158
PID 2776 wrote to memory of 3616	2776	zxrpkhczxrpjhczx.exe	162
PID 5292 wrote to memory of 2940	5292	aysqlidays.exe	164
PID 2776 wrote to memory of 2768	2776	zxrpkhczxrpjhczx.exe	167
PID 2776 wrote to memory of 5628	2776	zxrpkhczxrpjhczx.exe	171
PID 3836 wrote to memory of 672	3836	aysqkidavt.exe	173
PID 2776 wrote to memory of 2728	2776	zxrpkhczxrpjhczx.exe	176
PID 2776 wrote to memory of 4492	2776	zxrpkhczxrpjhczx.exe	180
PID 3420 wrote to memory of 2632	3420	axsqkicaus.exe	182
PID 2776 wrote to memory of 5364	2776	zxrpkhczxrpjhczx.exe	185
PID 1932 wrote to memory of 924	1932	msedge.exe	187
PID 1932 wrote to memory of 924	1932	msedge.exe	187
PID 2776 wrote to memory of 6108	2776	zxrpkhczxrpjhczx.exe	193
PID 5800 wrote to memory of 4840	5800	pjhczusmke.exe	195

C:\Users\Admin\AppData\Local\Temp\2026-06-30_52b03da3b653f72434a694cb70341290_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-30_52b03da3b653f72434a694cb70341290_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3464
- C:\Temp\zxrpkhczxrpjhczx.exe
  C:\Temp\zxrpkhczxrpjhczx.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2776
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hecxupnhez.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5968
  - - C:\Temp\hecxupnhez.exe
      C:\Temp\hecxupnhez.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:716
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2348
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:8
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hecxupnhez.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:820
  - - C:\Temp\i_hecxupnhez.exe
      C:\Temp\i_hecxupnhez.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4664
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pjhbzurmje.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4812
  - - C:\Temp\pjhbzurmje.exe
      C:\Temp\pjhbzurmje.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1228
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4648
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5908
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pjhbzurmje.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3036
  - - C:\Temp\i_pjhbzurmje.exe
      C:\Temp\i_pjhbzurmje.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5336
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\oljhbztrmj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:748
  - - C:\Temp\oljhbztrmj.exe
      C:\Temp\oljhbztrmj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5352
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2576
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3576
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_oljhbztrmj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3344
  - - C:\Temp\i_oljhbztrmj.exe
      C:\Temp\i_oljhbztrmj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5584
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ywqoljgbyt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1388
  - - C:\Temp\ywqoljgbyt.exe
      C:\Temp\ywqoljgbyt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4628
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3396
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2316
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ywqoljgbyt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5188
  - - C:\Temp\i_ywqoljgbyt.exe
      C:\Temp\i_ywqoljgbyt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6044
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ywqoigbysq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2952
  - - C:\Temp\ywqoigbysq.exe
      C:\Temp\ywqoigbysq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2180
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2132
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2612
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ywqoigbysq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1460
  - - C:\Temp\i_ywqoigbysq.exe
      C:\Temp\i_ywqoigbysq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2760
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\aysqlidays.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3616
  - - C:\Temp\aysqlidays.exe
      C:\Temp\aysqlidays.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5292
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2940
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3484
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_aysqlidays.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2768
  - - C:\Temp\i_aysqlidays.exe
      C:\Temp\i_aysqlidays.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3280
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\aysqkidavt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5628
  - - C:\Temp\aysqkidavt.exe
      C:\Temp\aysqkidavt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3836
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:672
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:976
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_aysqkidavt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2728
  - - C:\Temp\i_aysqkidavt.exe
      C:\Temp\i_aysqkidavt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1712
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\axsqkicaus.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4492
  - - C:\Temp\axsqkicaus.exe
      C:\Temp\axsqkicaus.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3420
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2632
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3524
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_axsqkicaus.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5364
  - - C:\Temp\i_axsqkicaus.exe
      C:\Temp\i_axsqkicaus.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:788
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pjhczusmke.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6108
  - - C:\Temp\pjhczusmke.exe
      C:\Temp\pjhczusmke.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5800
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4840
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2812
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pjhczusmke.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5336
  - - C:\Temp\i_pjhczusmke.exe
      C:\Temp\i_pjhczusmke.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:932
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hezxrpjhbz.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6024
  - - C:\Temp\hezxrpjhbz.exe
      C:\Temp\hezxrpjhbz.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5272
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5756
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1316
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hezxrpjhbz.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1376
  - - C:\Temp\i_hezxrpjhbz.exe
      C:\Temp\i_hezxrpjhbz.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3968
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jhbzwurmje.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:992
  - - C:\Temp\jhbzwurmje.exe
      C:\Temp\jhbzwurmje.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2584
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4528
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4808
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jhbzwurmje.exe ups_ins
    3⤵
    PID:4868
  - - C:\Temp\i_jhbzwurmje.exe
      C:\Temp\i_jhbzwurmje.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2284
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mjebwtomge.exe ups_run
    3⤵
    PID:2812
  - - C:\Temp\mjebwtomge.exe
      C:\Temp\mjebwtomge.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2260
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:700
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6048
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mjebwtomge.exe ups_ins
    3⤵
    PID:5944
  - - C:\Temp\i_mjebwtomge.exe
      C:\Temp\i_mjebwtomge.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:932
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jdbvqoigby.exe ups_run
    3⤵
    PID:1236
  - - C:\Temp\jdbvqoigby.exe
      C:\Temp\jdbvqoigby.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5368
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2432
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4924
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jdbvqoigby.exe ups_ins
    3⤵
    PID:1044
  - - C:\Temp\i_jdbvqoigby.exe
      C:\Temp\i_jdbvqoigby.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5248
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vqnifdbysq.exe ups_run
    3⤵
    PID:3116
  - - C:\Temp\vqnifdbysq.exe
      C:\Temp\vqnifdbysq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2564
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4696
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5608
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vqnifdbysq.exe ups_ins
    3⤵
    PID:1112
  - - C:\Temp\i_vqnifdbysq.exe
      C:\Temp\i_vqnifdbysq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3888
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dxvqnlfdys.exe ups_run
    3⤵
    PID:5696
  - - C:\Temp\dxvqnlfdys.exe
      C:\Temp\dxvqnlfdys.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5636
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4876
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2592
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dxvqnlfdys.exe ups_ins
    3⤵
    PID:3056
  - - C:\Temp\i_dxvqnlfdys.exe
      C:\Temp\i_dxvqnlfdys.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3376
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\upnhfdxvpn.exe ups_run
    3⤵
    PID:6004
  - - C:\Temp\upnhfdxvpn.exe
      C:\Temp\upnhfdxvpn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5852
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:712
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4536
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_upnhfdxvpn.exe ups_ins
    3⤵
    PID:5248
  - - C:\Temp\i_upnhfdxvpn.exe
      C:\Temp\i_upnhfdxvpn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1988
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cxupnkifzx.exe ups_run
    3⤵
    PID:2452
  - - C:\Temp\cxupnkifzx.exe
      C:\Temp\cxupnkifzx.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1136
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5092
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4264
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cxupnkifzx.exe ups_ins
    3⤵
    PID:5908
  - - C:\Temp\i_cxupnkifzx.exe
      C:\Temp\i_cxupnkifzx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3708
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\czurmkecwu.exe ups_run
    3⤵
    PID:3636
  - - C:\Temp\czurmkecwu.exe
      C:\Temp\czurmkecwu.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2392
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2680
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4672
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_czurmkecwu.exe ups_ins
    3⤵
    PID:1780
  - - C:\Temp\i_czurmkecwu.exe
      C:\Temp\i_czurmkecwu.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2536
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mkecwupmhe.exe ups_run
    3⤵
    PID:6064
  - - C:\Temp\mkecwupmhe.exe
      C:\Temp\mkecwupmhe.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4080
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6112
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5400
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mkecwupmhe.exe ups_ins
    3⤵
    PID:5540
  - - C:\Temp\i_mkecwupmhe.exe
      C:\Temp\i_mkecwupmhe.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4888
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\omgecwtroj.exe ups_run
    3⤵
    PID:2408
  - - C:\Temp\omgecwtroj.exe
      C:\Temp\omgecwtroj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4272
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1248
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5108
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffb4616c188,0x7ffb4616c194,0x7ffb4616c1a0
      4⤵
      PID:1868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,3740546154130972202,10696246827503884043,262144 --field-trial-handle=2268,i,8575283645571887147,14404289687441507793,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:2
      4⤵
      PID:3052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,15530992665406454177,5568295850380684436,524288 --field-trial-handle=2268,i,8575283645571887147,14404289687441507793,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:11
      4⤵
      System Time Discovery
      PID:5252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2352,i,2389824256705522915,7737681054698091953,524288 --field-trial-handle=2268,i,8575283645571887147,14404289687441507793,262144 --variations-seed-version --mojo-platform-channel-handle=2888 /prefetch:13
      4⤵
      PID:5884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,11512021030700922748,3929629778729390186,2097152 --field-trial-handle=2268,i,8575283645571887147,14404289687441507793,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
      4⤵
      PID:4796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,7249295708307543111,18124902162025277974,2097152 --field-trial-handle=2268,i,8575283645571887147,14404289687441507793,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
      4⤵
      PID:3716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4196,i,9508108701269806163,17217631966977927254,2097152 --field-trial-handle=2268,i,8575283645571887147,14404289687441507793,262144 --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:1
      4⤵
      PID:2700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4208,i,9381991560879423599,11669378006700192369,2097152 --field-trial-handle=2268,i,8575283645571887147,14404289687441507793,262144 --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:9
      4⤵
      PID:1652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,4855663290272654809,13668756776106364456,524288 --field-trial-handle=2268,i,8575283645571887147,14404289687441507793,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:14
      4⤵
      PID:5676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,8629810766170161716,850514596358905291,524288 --field-trial-handle=2268,i,8575283645571887147,14404289687441507793,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:14
      4⤵
      PID:5040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,14094639372225518580,6220784985852812825,524288 --field-trial-handle=2268,i,8575283645571887147,14404289687441507793,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:14
      4⤵
      PID:3516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,4625573759952524737,5596769988060779336,524288 --field-trial-handle=2268,i,8575283645571887147,14404289687441507793,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:14
      4⤵
      PID:3036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,4625573759952524737,5596769988060779336,524288 --field-trial-handle=2268,i,8575283645571887147,14404289687441507793,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:14
      4⤵
      PID:5984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,15285202680821110557,8454912685982666183,524288 --field-trial-handle=2268,i,8575283645571887147,14404289687441507793,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
      4⤵
      PID:3604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6688,i,2565450680608975356,5894218551307500881,524288 --field-trial-handle=2268,i,8575283645571887147,14404289687441507793,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:14
      4⤵
      PID:3396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4796,i,2090047382491454152,13303541139374376832,524288 --field-trial-handle=2268,i,8575283645571887147,14404289687441507793,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:14
      4⤵
      PID:1824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4816,i,8041100788609953767,17056098985684928620,524288 --field-trial-handle=2268,i,8575283645571887147,14404289687441507793,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:14
      4⤵
      PID:2904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4788,i,17205660950215437220,2088313473286965408,524288 --field-trial-handle=2268,i,8575283645571887147,14404289687441507793,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:14
      4⤵
      PID:3908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5664,i,13610417869387430267,1843822583421379907,524288 --field-trial-handle=2268,i,8575283645571887147,14404289687441507793,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:14
      4⤵
      PID:924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,5810787855828809351,12950351843980931979,524288 --field-trial-handle=2268,i,8575283645571887147,14404289687441507793,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:14
      4⤵
      PID:4612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3388,i,14996183432030981955,3481605095865834397,524288 --field-trial-handle=2268,i,8575283645571887147,14404289687441507793,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:14
      4⤵
      PID:6064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,11550108441180618606,11270287189075199543,524288 --field-trial-handle=2268,i,8575283645571887147,14404289687441507793,262144 --variations-seed-version --mojo-platform-channel-handle=3388 /prefetch:14
      4⤵
      PID:1396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6736,i,57211181297681066,8290277160762933309,262144 --field-trial-handle=2268,i,8575283645571887147,14404289687441507793,262144 --variations-seed-version --mojo-platform-channel-handle=3388 /prefetch:10
      4⤵
      PID:1320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,3310027557397802814,11336604074905186538,524288 --field-trial-handle=2268,i,8575283645571887147,14404289687441507793,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:14
      4⤵
      PID:2412

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:852

C:\Temp\zxrpkhczxrpjhczx.sys
C:\Temp\zxrpkhczxrpjhczx.sys
1⤵
- Executes dropped EXE
PID:4176

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5724

C:\Temp\bzurmkecwu.sys
C:\Temp\bzurmkecwu.sys
1⤵
- Executes dropped EXE
PID:4736

C:\Temp\omjebwuomg.sys
C:\Temp\omjebwuomg.sys
1⤵
- Executes dropped EXE
PID:2496

C:\Temp\ywqoigbywt.sys
C:\Temp\ywqoigbywt.sys
1⤵
- Executes dropped EXE
PID:5544

C:\Temp\bvtnlgdywt.sys
C:\Temp\bvtnlgdywt.sys
1⤵
- Executes dropped EXE
PID:2096

C:\Temp\tnlfdyvqoi.sys
C:\Temp\tnlfdyvqoi.sys
1⤵
- Executes dropped EXE
PID:1252

C:\Temp\dxvqnifays.sys
C:\Temp\dxvqnifays.sys
1⤵
- Executes dropped EXE
PID:2624

C:\Temp\faxsqkicav.sys
C:\Temp\faxsqkicav.sys
1⤵
- Executes dropped EXE
PID:4248

C:\Temp\upmkhczxrp.sys
C:\Temp\upmkhczxrp.sys
1⤵
- Executes dropped EXE
PID:568

C:\Temp\upmhfzxrpj.sys
C:\Temp\upmhfzxrpj.sys
1⤵
- Executes dropped EXE
PID:4268

C:\Temp\mkhbzwuomh.sys
C:\Temp\mkhbzwuomh.sys
1⤵
- Executes dropped EXE
PID:4304

C:\Temp\ljebwuomge.sys
C:\Temp\ljebwuomge.sys
1⤵
PID:1776

C:\Temp\trlbytqljg.sys
C:\Temp\trlbytqljg.sys
1⤵
PID:5544

C:\Temp\eywqoigbyt.sys
C:\Temp\eywqoigbyt.sys
1⤵
PID:480

C:\Temp\igayvqnifa.sys
C:\Temp\igayvqnifa.sys
1⤵
PID:4464

C:\Temp\ayvpnifays.sys
C:\Temp\ayvpnifays.sys
1⤵
PID:2424

C:\Temp\zxspnhfzxu.sys
C:\Temp\zxspnhfzxu.sys
1⤵
PID:4760

C:\Temp\nhfzxupnhf.sys
C:\Temp\nhfzxupnhf.sys
1⤵
PID:2828

C:\Temp\pmjecwurmk.sys
C:\Temp\pmjecwurmk.sys
1⤵
PID:5924

C:\Temp\ojgecwurlj.sys
C:\Temp\ojgecwurlj.sys
1⤵
PID:3944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aysqlidays.exe

Path C:\Temp\aysqlidays.exe
Size 376KB
SHA256 f6ae353fe6cd9740b86fa6f7ec755dfa6f47cb694fc7606d7883a8600154f21a
MD5 53bf8bfaeb0e501f7af8e1461ed6dda9
SHA1 c3474a78bcb493326c7649ffe4040c20999a5afd
SHA512 3307744ab4d84b3234204fb88d3ac95e07047e6a9a67e08e046e034e2d4152a3870ed6efe428de6a92634e40d4d74471ebaa05b3ac52d3eeae1469708b6864f5
SSDEEP 3072:CViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:CViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T12E847C04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bvtnlgdywt.sys

Path C:\Temp\bvtnlgdywt.sys
Size 293KB
SHA256 f05e11cbb2b10bbfa0485fe5c8b13467731171666e5bb4e42bf2f1a44b145903
MD5 8fc51e2e8e6122a829aa86dacdbeda5a
SHA1 cd6ededfd4610da072624235a2d6a20c8d2026c7
SHA512 113157aec6a28ffae73b6d5092f450a3b33e6de2cd958d825b14d77fc714ba09fad10aee1db3513091fc0479d5ea0318d5e5def73c4499e4f91ff6b6e6626477
SSDEEP 3072:qtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:qIJjiJcbI03GBc3ucY5DCSj
TLSH
T16F545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bzurmkecwu.sys

Path C:\Temp\bzurmkecwu.sys
Size 293KB
SHA256 a670108278b189980252cc310356f307cc43c4e5f311adf413d566da29695966
MD5 cf7515c8d1fc3f72c466ba7e3d17112e
SHA1 a2a92c693b8f59bd392d48d8b79ea9c876528e5f
SHA512 7fbc80d5caef4bc6fcea1dcb58d7cb02c92541228e685a60b7d5462f18b081d73d35e4df9027fe04712989720e0dee3106f6ee9f6560c2eb9316103dc2cf81af
SSDEEP 3072:utKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:uIJjiJcbI03GBc3ucY5DCSj
TLSH
T1A2545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hecxupnhez.exe

Path C:\Temp\hecxupnhez.exe
Size 376KB
SHA256 f311c3e5b211aaf34e5981addf4ad53421cd51d439e176856521b9c0128af6fc
MD5 a6a5bc10e997e47aa425977ab8fd3fb5
SHA1 1b8c883da926516b64cae1f33dbc8678c6cb2dda
SHA512 51379edf3a1c0c2cae70e44509e5c2cbd13f0c4f10aa2ded03ef560c906403acb3b20cb68d63f49b55967cf193c4e12e3811132d5d72f993c2048efff7c336a3
SSDEEP 3072:9ViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:9ViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F4847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hecxupnhez.exe

Path C:\Temp\i_hecxupnhez.exe
Size 376KB
SHA256 7488d7d25540a44c68e0465157a475d70fc447a9fd6507efe27a98d56d6dc877
MD5 a879bd5143017303f441058f688953b5
SHA1 e35af5b2c83f4b7042c5f7c0019ff7e088eae1d8
SHA512 3f987dc0b0d9767176bb63f5fed5d014caf2ba61a1e7333059ba5809fe5dbb92553ef8c640c4be19f39b3dca227c9c676d492f9c6b790b1af12835ac56c2ab0c
SSDEEP 3072:IViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:IViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T105847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_oljhbztrmj.exe

Path C:\Temp\i_oljhbztrmj.exe
Size 376KB
SHA256 40729caefcaf1b2b99ea0519ff9e658a6f990455f73bfef9597ba4dbbf7d6f2e
MD5 4b1422c65257b5d6c337f89bb8ae0a18
SHA1 92de64a5711d41da0eb1b4a9ac716528e877d807
SHA512 7cf24a63bd12bfbdecf29527acdfbc73ca7d1f2e4f8d45a1d0d2778ff452eb992abed647601f5d4e03d9d9c462c732d29be289e920ac14293d326fb8bb2cec0f
SSDEEP 3072:iViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:iViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C9847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pjhbzurmje.exe

Path C:\Temp\i_pjhbzurmje.exe
Size 376KB
SHA256 4218df66db81ae25a434ee80b9675209f0d6b503ae57ae45a26835d77467e223
MD5 3b71e00b3c0b494d2cb2915247a7a574
SHA1 e2e9a4a877283fe2399b4a33049c264c601f7bbb
SHA512 fc0efc32e9e4a3d0822a92ce111e36f4ed6116d52cf818200a61928b6fbd38ab2e063bbd24f60aafffeffb0a436a4843968ff4c318d6969bd9abbfac7106ae15
SSDEEP 3072:0ViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:0ViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T12A847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ywqoigbysq.exe

Path C:\Temp\i_ywqoigbysq.exe
Size 376KB
SHA256 82f985705f154c8591160821fc6fdbd4d113c157dace980c97b658602cbfec23
MD5 352b2d5cf536c323279efc48b10cf6bf
SHA1 e41c80d642309a0457c451d60133cb8bdd3f4056
SHA512 daa4ec207b8d741c7623d9f2629f667e3611538bde8f09301fc08c4a9ebc418af7269dbeff85c765988e8c42531a72b0c38168232417cf89d7241cbe472253f4
SSDEEP 3072:GwViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLL:1ViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T124847C04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ywqoljgbyt.exe

Path C:\Temp\i_ywqoljgbyt.exe
Size 376KB
SHA256 a43e52c5b135dbbe92b1d1df9f93137e51bac43b2e4468ee40c5c835f4afc15a
MD5 8bd86514e9b323d9d2d1cacb72c29966
SHA1 62fc9f20b739fc725b90f6ba27210fad71ee6f06
SHA512 50afde3e632f2c95fc69576db5da737178f85fb56b601f53b2c1fc81454f19609d4449b5bede0a1f69a0f7ab5697903e1b794d8de61add8eb66810f602ef56bc
SSDEEP 3072:pViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:pViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T199847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oljhbztrmj.exe

Path C:\Temp\oljhbztrmj.exe
Size 376KB
SHA256 59e30b29eafbeedc4595b943ae1d9923d97d68bb372a45e871d534d6b854b55f
MD5 c5fe727c576d0b396fa257d6276b2552
SHA1 ae2f9daf3964704f30925ec9bdc545cc10d78c7f
SHA512 a1a35500f4abae225b724daef4ce206ce58e44dcd34dc8e3fcd05243afb7e120af1d789ebe618fdf4351be70907250cef12f2932d4c5ec3c8675513e9fbc29c4
SSDEEP 3072:BViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:BViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T116847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omjebwuomg.sys

Path C:\Temp\omjebwuomg.sys
Size 293KB
SHA256 a1809121b467357b1020cd862358fe733352049660d70ae8ae183278197fda7d
MD5 726ae2bf8fd3b807cff170fd4dd38011
SHA1 15cdd6af2150bd9ab60210ecd0d7604abff6adca
SHA512 75a0ec1508646d7864efa5e2cab857cd0c2b2c5be1058f2a2395e2ec01964f240e8f48e0fc9a705a0ea1cd30665756f9c514762bfb06d6a2480e7752c8b43ffa
SSDEEP 3072:mtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:mIJjiJcbI03GBc3ucY5DCSj
TLSH
T1AB545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pjhbzurmje.exe

Path C:\Temp\pjhbzurmje.exe
Size 376KB
SHA256 e052bf51aa2c515130bc7df84aa0b35236b4001944da73566f038444bf1c8a0b
MD5 af449018098f786b0d00efbe59ee10e0
SHA1 343beb1048bc9f8ff9f16ad2840623e0508d6ef2
SHA512 4907892cb523698ed71ef363e5aa30c4d7baaa4729423f51b19a3b671568488dc34f45209172c96b9f1b0ff0e0b68be4fc7ee9d4f72c8946476f0413cfdd470d
SSDEEP 3072:jViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:jViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T160847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnlfdyvqoi.sys

Path C:\Temp\tnlfdyvqoi.sys
Size 293KB
SHA256 ec97750a670590926ec4f3299bd2490c27814ef51aa5129dd5576a3cd4b8d2f3
MD5 d29f0f46287e3d487afe96ad739603d0
SHA1 8fd818126363f5961f3348c510f1abff009e62b1
SHA512 58e0ae9b84be43d5c285b07013152b0ed563064f57e2180fefb5033057b293588c8e6f679bb38aae96d8d293b3a275e97fac1037685f54e06912808e73137b36
SSDEEP 3072:gtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:gIJjiJcbI03GBc3ucY5DCSj
TLSH
T1A0545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywqoigbysq.exe

Path C:\Temp\ywqoigbysq.exe
Size 376KB
SHA256 bbbdd52954286059c12e7721bc2fd1d5dcf643f0fe5f13cf1507e1ee52a6ecde
MD5 946a2689a2adebc0a314b9a9d49bff2f
SHA1 b77a68c7fb28ef2cf3661d988c9cdc8fc449196b
SHA512 428a0316320c5be3f8237a80b7fdd59996a39ac71a76c975845cc1cfccad3a516370f59ca0bff270031ab756784e46b88be613e2e1b839d3845706ceebed8a72
SSDEEP 3072:gViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:gViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T14F847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywqoigbywt.sys

Path C:\Temp\ywqoigbywt.sys
Size 293KB
SHA256 3707b5597f0854248572ae142c0f8b63c51037d2ffc7d7ffaa5af3bbf6521f9c
MD5 db818f43330b20d99eafb8fdc8347f44
SHA1 28c34f334f0c58bb3c460dac2a2025217d306d10
SHA512 d9e1f3ae0d88955929141b6ca2fbf8c0f498ee775f074cf3333d7f12b0394a21473015988a4e54851d490536c7ded07938d165eb5e33dc70f6eb692c5ea0b90d
SSDEEP 3072:ptKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:pIJjiJcbI03GBc3ucY5DCSj
TLSH
T155545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywqoljgbyt.exe

Path C:\Temp\ywqoljgbyt.exe
Size 376KB
SHA256 95a0935c08f3bc18717c632214492f3752a9e88e061d03128b2f5fb6ea7e8a46
MD5 19e89f1ce024ce5da170422fd137929c
SHA1 e0a1c869b415d36197be81e4dcd78f17b917fcaf
SHA512 70e18d883581b3b6c7fb510451e959b2a8423996f2ef500844ac27a913279550098d669819c1b8a0984e8efdd043eee27b8e9f2388033824044b9e84125d3f7f
SSDEEP 3072:cViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:cViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T127847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxrpkhczxrpjhczx.exe

Path C:\Temp\zxrpkhczxrpjhczx.exe
Size 376KB
SHA256 33ce14c85719fc2d4e403edfba9b5926f2b59b683bb9c0e0d5607b6310b08fb6
MD5 8238a7fab1e5c8e4f9c9e537c3d219f1
SHA1 0133eebc8c2c57cd44a3694069490cfc9a7d817f
SHA512 03f5da6f47f17489f5581b4d2fc9da54abb73e85f04f3f1ceb52649ad6e8dab1ca60d37cdae9ada9dc2387ddd20e5aae28aadccdd73a304c917e012f83d7c1cf
SSDEEP 3072:DViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:DViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T116847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxrpkhczxrpjhczx.sys

Path C:\Temp\zxrpkhczxrpjhczx.sys
Size 293KB
SHA256 7760d6574c9c32dad2f7ff5a9d74b6bb19e6371c517678eb714f0c7560fb1c42
MD5 105c5a52912ef4f7ea0b2f75a96ff6a6
SHA1 f9c1542abffb2112f2a19578c624cc1ac100b794
SHA512 876c38d879d4b97bafe429c7c923cf0687872e30e37b262f02cb25f2ee9464f6308d80dcefbca4f3a73236562d5829556bd4de4e3800ca713136fd734ea96d6e
SSDEEP 3072:DtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:DIJjiJcbI03GBc3ucY5DCSj
TLSH
T1C2545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 27eeefdbc28c4562b0f7961dbf8ecc36dc6cdfdb8dba90b92fab4f8d38495733
MD5 02240668b330773d82eb39ca82064ff3
SHA1 da6a7c95e21b04cb7aa5296fa464996f592a9476
SHA512 850ad2cbde9cda49998ffee162ecf4a7e854604619f29434682d460d4b33049219c253cb3208a75d43cda1a23a05ad280b0f98228e3cc9146d1a22b246e53b30
TLSH
T1E2D08011379CFC09C945303658515751F5155861145F8F445064D41DDC755D313570DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 bea28d9638dac59990bdc6b9fece9f477f8d28c508c1a253fd1565bbc9fc4ae3
MD5 f10d65bdc736c03466ef52fb3e973cc6
SHA1 1553d68481be544f8fcd8f4f31978854061662fb
SHA512 1789433df7c4cb6b8c6af88635e9335389bfe36da7d8457f3b16e6d774ad9e050c045de056bbf16dcb7c5f7f882bdde6345ed9e7f12c4d6295e169346b1bbbf7
TLSH
T186D08015378CFC09C945303258515751F5255861645F8F445064D41DDC755D313570DF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b70b8230bafe0da3fcd2f72809ba6021f4c0d0cb887f287be5f53bcf647d2ed2
MD5 7a7b3b5ed37bb228f3f6e902ce6608b4
SHA1 62540981a7eba894314d918844ad3cd536d07119
SHA512 0a119f65b0aa654c2951004570ddb24883fd8cd48f8bb98e0f61ac7aea162deadfad247927bbbf0057a2330c7a5eb20c6d743d267e9dfcb840bcfb12b3d65515
TLSH
T11161A3A133A23AC2FB9548B553F2A0C97BB4E0DEC903FE8458D583386B1B7349351807
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 95cdd22b3182295341fbaa1e03b877b4f900eb1073f428d24afcfb55bdcff2c2
MD5 e7a3736a621e5306baabb25228d89583
SHA1 e79a9d0a37f99ce24597dea1b98aa70ab05c602d
SHA512 83cdc4ae7008b7eb9b63e5f9edf3979855ff94f0883d598fd62ea939f01f06a416d0bce3a7234fcbdc11718720e5d217a31b78af8f64d15e9f3324593e45671a
TLSH
T10E51CEF7C7E8866DC91156F0BB187E2BCE2D0914832C3D5A89E4AF1B93E2471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 fc9ae5f86396dd60ae2d33909ad91b17182fade8d4dc88a7515672b6f1495415
MD5 e11ad9d3bb61f7b379ef2b9f67e75917
SHA1 8b096eace8383ae8f1e84058a36dcef4c374ae33
SHA512 31b4977a7bd26adc4252a5abc199b61c4c7ff4e7e939cc67cbfca1facf34e6c756b97ff842af97e995ad4c0d565226fe1c7796831d9414052efef2d907d1cc03
SSDEEP 192:sxRVQRI7yM/jK1Ml8wca/fKGsYOsWVZLCAaGKIzoA8p9Ve/g6+WNCVP6/YTljVlR:sxRegCa/fdsjBbLya/5h/yCYr
TLSH
T14C62EA066A2859378CDBD209F645BF53D6F81573E2901E44AAFC8B0C05E77ED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 d89a67d0c66f5c7a38475d87ba969560091e7eb25b4f7a837045881c1f819d78
MD5 0c7a1e74dd40e08975c85ed18a8b8a67
SHA1 a8d2df4d863b293fcd12953657b0f3be11ef7a57
SHA512 35534f279c289c409c70725c85f419560192c993bf7577c024ed9585092dfa0842ecd35cb4a6f6b6be528b3c6b367ad3c8f9a3e3a0464d087d514aa10bedd28b
SSDEEP 192:sxRwQRI7yM/jK1Ml8wca/fKGsCsWVZLCAaGKIzoA8p9Ve/g6+WNCVP6/YTljVlES:sxR1gCa/fdsCBbLya/5h/yCY3
TLSH
T10A62EA166A285937CCDBD209FA45BF53D6F81573E2901E44AAFC8A0C05E77ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 f4c6d6db471c444e39a9ebaa967bc532877c767eaa5f132cde3d631a2962c008
MD5 91983503ae3e9fe9375391096725fe77
SHA1 a22cf2f2c5a92459b67114594d89ab5b338da7d2
SHA512 8e9eca9fcfa01785aa58f380f1228f27a66f4642f98a2f8a9fb51747d4fbff232c12383b38adeb9065c85d57a4849c287e176aa0e81fc692a7481d212e81777e
SSDEEP 192:sxRVQRI7yM/jK1Ml8UQYZca/fKGsYOsWVZLCAaGKIzoA8prVe/g6+WNCVP6/YTl7:sxRegqxa/fdsjBbLy4/5h/mCYr
TLSH
T1B462F9066A285937CCDBD209FA45BB53D2F81573E2901E44AAFC8B0C01E77ED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 41ba9b04eb8fc6d1d001f0dd2255edffeb2fe494637faea78c5430e8542bb5fe
MD5 21155600fa96d390f1bd85d98bc27445
SHA1 1b091f1f34eb6e85da2c956e812df838b46eaa2b
SHA512 48807c3768b0bdd1e5ff4400275e8b90cac036c71e1de627e68f0457369a25a1544100cd6165c6f5d6122c907d4e4cfb1d2b57a2188a8bedc3e06b180cd2f465
SSDEEP 768:RGqOBJ7pLuL7CrWgTvfiX8F1+UoAYDCx9Tuqh0VfUC9xbog/OV0wDzFYgro/8H:RGqOBfE7CrWgTvfiXu1jafwDRYr/0
TLSH
T176E2EB7B680CCB7E4F804A9CEC29BD8E6DE801CB56D88D5447EA854C03C67FB511A5EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 7a19be3c06b3c847b9e8fc98d87acbf254ade59bb6e62c6195d1d62a1c978d2e
MD5 e2bd47596efea6de2c0379cda6b95aaf
SHA1 3a78598cfdca9de4259e10838a56607b21cbece0
SHA512 3ce3b2f83d3f467ffd394f6abeb30cc7ec8746e45b957293e60a3f303828082fca092febbc6e6987b4771117d169f001ffca23f4ce7110f2c53a83ad31fd59f7
SSDEEP 96:Kk8oKJySqIgKpCr0VAE+imkWivPgMkK4BgGkckEP+k5HCHuC0Ud:yfHO0VAE+imbiv4MYBgGLkEP+k5HCHuw
TLSH
T185919E5533373784383E3A4D8255E45E428270A73015B47A3BF991E62BABE12CEFE4C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

14002807-fb0b-4572-bcd1-9d8161c325bf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\14002807-fb0b-4572-bcd1-9d8161c325bf.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 47a1592fa2113a8f69dd3338b3834c9835fa064509f588f5deff510047097f70
MD5 bfd89cf4c5a8bc37a911a60669ea68cb
SHA1 8bb511314b84f7a4e8f95ebcfe1dab0b40e2e5bb
SHA512 da0acba10a37b744acd52d2e7c4c5878076803de29345c356a5cb5f603d4df2f9cc51c24ee10928d79d93dc8494b5a9b5b30c5f210464ccbae2ff04955a06188
SSDEEP 768:Ej+9D3w3IB6tdPtXodOiIyN8Y1M1fmBnZnc8Kza3Js:T9D3wQItXodI11sctza3Js
TLSH
T1DDF2B0729D62CD674CE6818CB6173786AEF052A3DAC52F54D6E86B0D04877FE330B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 324fc947211fbb60303707a66f8ef31ccec2d1225357370ab8b5bdd313781337
MD5 3c707cd02a0a9bdd0972e060d2d60d93
SHA1 62cd8d14d81702b719b6c67e1eb5746472cc0e56
SHA512 e5eec689891b833cc28a0de591751dac7f08f78f02a90cd030f730b689fb26573ec971327fc2ecfb8e3adc2f091a5a29183c7377e96d3606e3492aafc5a22336
SSDEEP 768:NF1j+9D3Lwgl3IB6841LXodOiIyN8Y1M1fmBnZnc8Kza3Js:E9D3vQyLXodI11sctza3Js
TLSH
T1FC1329F288D38937D8AE4787A73E2E469DFCC1A3B5845994B7D45D0CCC862BFD20A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a98e87a8-58e2-4ded-a8ba-525987aecec3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a98e87a8-58e2-4ded-a8ba-525987aecec3.tmp
Size 38KB
SHA256 ef279496325c6c349f4d8460a3d13ffa5d96ae00346815b559eb767a1fe79f04
MD5 b757bf490144a689d27effa8e178f0ca
SHA1 8f588cf08d88e029b0851ded1da0a5973d4979df
SHA512 abdc402c1ca8858eaab29569a9d2661d3c273e7f799346b9226a3ce28527486587bdc79750db07e00136d1a2b83a92d223031423c6b358da6503ecb675c7ce5a
SSDEEP 768:Yrv+4UNbdj3g6NrfXodOiIyN8Y1M1fmBnlnv0B:Ybsbl3gcXodI11k8
TLSH
T1C103CF32E864D5778CF28288F10772437FF491939BC50B94C9DD6B4E854BAEE230B856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

995f4ee7-597f-4e4f-908e-7c4732bc785b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\995f4ee7-597f-4e4f-908e-7c4732bc785b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1932_668316301\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 f80ecf614e7d1f142dedd183c110657a7871531a4bb1d595306a0af2b83c6668
MD5 3334d1bbdad0d4e6186d36e8104f59e1
SHA1 d1a2b062a41207b7c52f4a7907528a93b839c4f4
SHA512 20157004bac287548668c8175edb7eb7a7b390fd622501576ecadc0426110835d50de9b589bc029da9c70974624af9c8638c19df3b82e4e7c6f3501b749b2da0
TLSH
T1E271008366A9DAF2C1DA5FF002835644F1BB227C0773202147555986AA30A3A54B8F08
MD5 SHA1 SHA512 TLSH

Submit Download

memory/480-418-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/568-341-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1252-297-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1776-394-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2096-281-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2424-450-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2496-244-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2624-322-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2828-475-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3944-504-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4176-64-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4248-326-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4268-345-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4304-374-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4464-439-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4736-197-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4760-471-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5544-435-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5544-269-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5544-414-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5924-487-0x0000000000010000-0x00000000000AB000-memory.dmp

Download