systex | 44f7000389b365bb5c78d864bb8f33427988d808bacf246b061b88d53cc440a6

Analysis

max time kernel
149s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 02:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_94286d250e501d2b54f9c140979189ea_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Size 365KB
Sample260707-cm98jsfz2t
SHA256 44f7000389b365bb5c78d864bb8f33427988d808bacf246b061b88d53cc440a6
MD5 94286d250e501d2b54f9c140979189ea
SHA1 c522091103fac5d3efebe2a3c684d006547eb299
SHA512 5f1559fdd548ad7c463a5d27550c9a10fe26a7e5eb69de15eba723b388ed75046719e7fb8635ffb7ca040180b460b0aab09c5ccbc0470f766ab8e2760cc0be1c
SSDEEP 3072:UuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:UuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T17F847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
3376	tomgeywqojgbztrl.exe
1664	tomgeywqojgbztrl.sys
968	CreateProcess.exe
4156	tqomgbywqo.exe
2152	CreateProcess.exe
4468	CreateProcess.exe
2016	i_tqomgbywqo.exe
5196	dbytjdbvtq.sys
5528	CreateProcess.exe
2208	qligdyvqnl.exe
768	CreateProcess.exe
780	CreateProcess.exe
1880	i_qligdyvqnl.exe
6020	lgdywqoiga.sys
1240	CreateProcess.exe
2956	avtnifaysq.exe
5236	CreateProcess.exe
6100	CreateProcess.exe
3828	i_avtnifaysq.exe
2584	gaysqnifda.sys
4716	CreateProcess.exe
5360	avsqnifdxv.exe
2464	CreateProcess.exe
1520	CreateProcess.exe
1080	i_avsqnifdxv.exe
2300	usnkfcxvsn.sys
3168	CreateProcess.exe
908	nkicausnhf.exe
2356	CreateProcess.exe
3208	CreateProcess.exe
3952	i_nkicausnhf.exe
1196	pfzxrpnkec.sys
2684	CreateProcess.exe
4308	fzxusmkhfz.exe
1860	CreateProcess.exe
5500	CreateProcess.exe
4120	i_fzxusmkhfz.exe
612	upmkecwusm.sys
3800	CreateProcess.exe
5280	urpjhurmke.exe
988	CreateProcess.exe
2844	CreateProcess.exe
2840	i_urpjhurmke.exe
1044	wtrmjecwup.sys
5064	CreateProcess.exe
2304	wurmjezwro.exe
5720	CreateProcess.exe
2300	CreateProcess.exe
540	i_wurmjezwro.exe
4728	romgebzwqo.sys
2952	CreateProcess.exe
5888	omgeywqomg.exe
2240	CreateProcess.exe
5972	CreateProcess.exe
2548	i_omgeywqomg.exe
3588	trljdbwtom.sys
1528	CreateProcess.exe
1276	jgbytrlgdy.exe
3988	CreateProcess.exe
1752	CreateProcess.exe
5524	i_jgbytrlgdy.exe
3924	olgdyvtnlg.sys
1452	CreateProcess.exe
2288	igdyvtqoig.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4560_466851744\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4560_1383182436\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4560_1383182436\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4560_1861801580\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4560_1861801580\smart_switch_list.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4560_1438172549\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4560_1438172549\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4560_1861801580\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4560_1861801580\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxusmkhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgbytrlgdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsnlfdxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhfaxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ukecwurmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtrmjhecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qligdyvqnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxusmkhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkicausnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urpjhurmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wurmjezwro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgbytrlgdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsnlfdxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_avtnifaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_avsqnifdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wurmjezwro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrmjhbzurp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bytrljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-06_94286d250e501d2b54f9c140979189ea_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tomgeywqojgbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkicausnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgeywqomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtrmjhecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bytrljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_olgdywqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqomgbywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qligdyvqnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urpjhurmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgeywqomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqnigdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lfdbysqoli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqomgbywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avtnifaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avsqnifdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igdyvtqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igdyvtqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqnigdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrmjhbzurp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	olgdywqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhfaxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ukecwurmke.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2024	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1196	ipconfig.exe
3240	ipconfig.exe
4308	ipconfig.exe
6124	ipconfig.exe
3212	ipconfig.exe
4228	ipconfig.exe
5300	ipconfig.exe
3176	ipconfig.exe
2424	ipconfig.exe
5276	ipconfig.exe
5708	ipconfig.exe
3888	ipconfig.exe
2828	ipconfig.exe
4108	ipconfig.exe
1576	ipconfig.exe
5556	ipconfig.exe
4192	ipconfig.exe
4424	ipconfig.exe
5344	ipconfig.exe
1196	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2532687178-1633831978-1202193935-1000\{16C3FB31-F1BC-44D2-935B-FF8F18F6BBC5}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3236	2026-07-06_94286d250e501d2b54f9c140979189ea_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3236	2026-07-06_94286d250e501d2b54f9c140979189ea_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3236	2026-07-06_94286d250e501d2b54f9c140979189ea_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3236	2026-07-06_94286d250e501d2b54f9c140979189ea_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3236	2026-07-06_94286d250e501d2b54f9c140979189ea_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3236	2026-07-06_94286d250e501d2b54f9c140979189ea_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3236	2026-07-06_94286d250e501d2b54f9c140979189ea_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3236	2026-07-06_94286d250e501d2b54f9c140979189ea_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3236	2026-07-06_94286d250e501d2b54f9c140979189ea_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3236	2026-07-06_94286d250e501d2b54f9c140979189ea_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3236	2026-07-06_94286d250e501d2b54f9c140979189ea_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3236	2026-07-06_94286d250e501d2b54f9c140979189ea_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3236	2026-07-06_94286d250e501d2b54f9c140979189ea_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3236	2026-07-06_94286d250e501d2b54f9c140979189ea_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3236	2026-07-06_94286d250e501d2b54f9c140979189ea_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3236	2026-07-06_94286d250e501d2b54f9c140979189ea_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3236	2026-07-06_94286d250e501d2b54f9c140979189ea_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3236	2026-07-06_94286d250e501d2b54f9c140979189ea_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3236	2026-07-06_94286d250e501d2b54f9c140979189ea_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3236	2026-07-06_94286d250e501d2b54f9c140979189ea_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3236	2026-07-06_94286d250e501d2b54f9c140979189ea_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3236	2026-07-06_94286d250e501d2b54f9c140979189ea_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3236	2026-07-06_94286d250e501d2b54f9c140979189ea_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3236	2026-07-06_94286d250e501d2b54f9c140979189ea_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3236	2026-07-06_94286d250e501d2b54f9c140979189ea_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3236	2026-07-06_94286d250e501d2b54f9c140979189ea_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3236	2026-07-06_94286d250e501d2b54f9c140979189ea_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3236	2026-07-06_94286d250e501d2b54f9c140979189ea_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3236	2026-07-06_94286d250e501d2b54f9c140979189ea_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3236	2026-07-06_94286d250e501d2b54f9c140979189ea_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3236	2026-07-06_94286d250e501d2b54f9c140979189ea_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3236	2026-07-06_94286d250e501d2b54f9c140979189ea_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3236	2026-07-06_94286d250e501d2b54f9c140979189ea_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3236	2026-07-06_94286d250e501d2b54f9c140979189ea_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3236	2026-07-06_94286d250e501d2b54f9c140979189ea_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3236	2026-07-06_94286d250e501d2b54f9c140979189ea_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3236	2026-07-06_94286d250e501d2b54f9c140979189ea_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3236	2026-07-06_94286d250e501d2b54f9c140979189ea_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3236	2026-07-06_94286d250e501d2b54f9c140979189ea_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3236	2026-07-06_94286d250e501d2b54f9c140979189ea_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3236	2026-07-06_94286d250e501d2b54f9c140979189ea_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3236	2026-07-06_94286d250e501d2b54f9c140979189ea_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3236	2026-07-06_94286d250e501d2b54f9c140979189ea_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3236	2026-07-06_94286d250e501d2b54f9c140979189ea_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3236	2026-07-06_94286d250e501d2b54f9c140979189ea_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3236	2026-07-06_94286d250e501d2b54f9c140979189ea_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3236	2026-07-06_94286d250e501d2b54f9c140979189ea_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3236	2026-07-06_94286d250e501d2b54f9c140979189ea_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3236	2026-07-06_94286d250e501d2b54f9c140979189ea_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3236	2026-07-06_94286d250e501d2b54f9c140979189ea_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3236	2026-07-06_94286d250e501d2b54f9c140979189ea_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3236	2026-07-06_94286d250e501d2b54f9c140979189ea_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3236	2026-07-06_94286d250e501d2b54f9c140979189ea_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3376	tomgeywqojgbztrl.exe
3236	2026-07-06_94286d250e501d2b54f9c140979189ea_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3376	tomgeywqojgbztrl.exe
3236	2026-07-06_94286d250e501d2b54f9c140979189ea_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3236	2026-07-06_94286d250e501d2b54f9c140979189ea_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3376	tomgeywqojgbztrl.exe
3376	tomgeywqojgbztrl.exe
3376	tomgeywqojgbztrl.exe
3376	tomgeywqojgbztrl.exe
3376	tomgeywqojgbztrl.exe
3376	tomgeywqojgbztrl.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	2016	i_tqomgbywqo.exe
Token: SeDebugPrivilege	1880	i_qligdyvqnl.exe
Token: SeDebugPrivilege	3828	i_avtnifaysq.exe
Token: SeDebugPrivilege	1080	i_avsqnifdxv.exe
Token: SeDebugPrivilege	3952	i_nkicausnhf.exe
Token: SeDebugPrivilege	4120	i_fzxusmkhfz.exe
Token: SeDebugPrivilege	2840	i_urpjhurmke.exe
Token: SeDebugPrivilege	540	i_wurmjezwro.exe
Token: SeDebugPrivilege	2548	i_omgeywqomg.exe
Token: SeDebugPrivilege	5524	i_jgbytrlgdy.exe
Token: SeDebugPrivilege	4796	i_igdyvtqoig.exe
Token: SeDebugPrivilege	3936	i_aysqnigdxv.exe
Token: SeDebugPrivilege	6104	i_vsnlfdxvpn.exe
Token: SeDebugPrivilege	4120	i_pnhfaxvpnh.exe
Token: SeDebugPrivilege	2672	i_ukecwurmke.exe
Token: SeDebugPrivilege	3176	i_xrmjhbzurp.exe
Token: SeDebugPrivilege	920	i_wtrmjhecwu.exe
Token: SeDebugPrivilege	3592	i_bytrljdbvt.exe
Token: SeDebugPrivilege	5600	i_olgdywqoig.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4560	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3236 wrote to memory of 3376	3236	2026-07-06_94286d250e501d2b54f9c140979189ea_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	87
PID 3236 wrote to memory of 4628	3236	2026-07-06_94286d250e501d2b54f9c140979189ea_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	88
PID 4628 wrote to memory of 4560	4628	iexplore.exe	89
PID 4560 wrote to memory of 2460	4560	msedge.exe	90
PID 4560 wrote to memory of 1540	4560	msedge.exe	91
PID 4560 wrote to memory of 2024	4560	msedge.exe	92
PID 4560 wrote to memory of 1540	4560	msedge.exe	91
PID 4560 wrote to memory of 1540	4560	msedge.exe	91
PID 4560 wrote to memory of 2144	4560	msedge.exe	93
PID 4560 wrote to memory of 2144	4560	msedge.exe	93
PID 4560 wrote to memory of 5020	4560	msedge.exe	94
PID 4560 wrote to memory of 5020	4560	msedge.exe	94
PID 4560 wrote to memory of 5020	4560	msedge.exe	94
PID 4560 wrote to memory of 2748	4560	msedge.exe	95
PID 4560 wrote to memory of 2748	4560	msedge.exe	95
PID 4560 wrote to memory of 2748	4560	msedge.exe	95
PID 4560 wrote to memory of 1124	4560	msedge.exe	97
PID 4560 wrote to memory of 3096	4560	msedge.exe	98
PID 4560 wrote to memory of 1124	4560	msedge.exe	97
PID 4560 wrote to memory of 1124	4560	msedge.exe	97
PID 4560 wrote to memory of 3096	4560	msedge.exe	98
PID 4560 wrote to memory of 3096	4560	msedge.exe	98
PID 4560 wrote to memory of 2696	4560	msedge.exe	99
PID 4560 wrote to memory of 2696	4560	msedge.exe	99
PID 3376 wrote to memory of 968	3376	tomgeywqojgbztrl.exe	103
PID 4560 wrote to memory of 1656	4560	msedge.exe	105
PID 4560 wrote to memory of 1656	4560	msedge.exe	105
PID 4560 wrote to memory of 1728	4560	msedge.exe	106
PID 4560 wrote to memory of 1728	4560	msedge.exe	106
PID 4156 wrote to memory of 2152	4156	tqomgbywqo.exe	108
PID 4560 wrote to memory of 2648	4560	msedge.exe	112
PID 4560 wrote to memory of 2548	4560	msedge.exe	113
PID 4560 wrote to memory of 2548	4560	msedge.exe	113
PID 4560 wrote to memory of 5928	4560	msedge.exe	116
PID 4560 wrote to memory of 5928	4560	msedge.exe	116
PID 3376 wrote to memory of 4468	3376	tomgeywqojgbztrl.exe	117
PID 3376 wrote to memory of 5528	3376	tomgeywqojgbztrl.exe	121
PID 2208 wrote to memory of 768	2208	qligdyvqnl.exe	123
PID 3376 wrote to memory of 780	3376	tomgeywqojgbztrl.exe	126
PID 3376 wrote to memory of 1240	3376	tomgeywqojgbztrl.exe	130
PID 2956 wrote to memory of 5236	2956	avtnifaysq.exe	132
PID 3376 wrote to memory of 6100	3376	tomgeywqojgbztrl.exe	135
PID 3376 wrote to memory of 4716	3376	tomgeywqojgbztrl.exe	139
PID 5360 wrote to memory of 2464	5360	avsqnifdxv.exe	141
PID 3376 wrote to memory of 1520	3376	tomgeywqojgbztrl.exe	144
PID 4560 wrote to memory of 6088	4560	msedge.exe	146
PID 4560 wrote to memory of 1204	4560	msedge.exe	147
PID 4560 wrote to memory of 4800	4560	msedge.exe	148
PID 3376 wrote to memory of 3168	3376	tomgeywqojgbztrl.exe	151
PID 908 wrote to memory of 2356	908	nkicausnhf.exe	153
PID 3376 wrote to memory of 3208	3376	tomgeywqojgbztrl.exe	156
PID 3376 wrote to memory of 2684	3376	tomgeywqojgbztrl.exe	160
PID 4308 wrote to memory of 1860	4308	fzxusmkhfz.exe	162
PID 3376 wrote to memory of 5500	3376	tomgeywqojgbztrl.exe	165
PID 3376 wrote to memory of 3800	3376	tomgeywqojgbztrl.exe	169
PID 5280 wrote to memory of 988	5280	urpjhurmke.exe	171
PID 3376 wrote to memory of 2844	3376	tomgeywqojgbztrl.exe	174
PID 3376 wrote to memory of 5064	3376	tomgeywqojgbztrl.exe	178
PID 2304 wrote to memory of 5720	2304	wurmjezwro.exe	180
PID 3376 wrote to memory of 2300	3376	tomgeywqojgbztrl.exe	183
PID 4560 wrote to memory of 260	4560	msedge.exe	185
PID 4560 wrote to memory of 260	4560	msedge.exe	185
PID 3376 wrote to memory of 2952	3376	tomgeywqojgbztrl.exe	191
PID 5888 wrote to memory of 2240	5888	omgeywqomg.exe	193

C:\Users\Admin\AppData\Local\Temp\2026-07-06_94286d250e501d2b54f9c140979189ea_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_94286d250e501d2b54f9c140979189ea_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3236
- C:\Temp\tomgeywqojgbztrl.exe
  C:\Temp\tomgeywqojgbztrl.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3376
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tqomgbywqo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:968
  - - C:\Temp\tqomgbywqo.exe
      C:\Temp\tqomgbywqo.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4156
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2152
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1196
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tqomgbywqo.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4468
  - - C:\Temp\i_tqomgbywqo.exe
      C:\Temp\i_tqomgbywqo.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2016
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qligdyvqnl.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5528
  - - C:\Temp\qligdyvqnl.exe
      C:\Temp\qligdyvqnl.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2208
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:768
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3240
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qligdyvqnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:780
  - - C:\Temp\i_qligdyvqnl.exe
      C:\Temp\i_qligdyvqnl.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1880
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\avtnifaysq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1240
  - - C:\Temp\avtnifaysq.exe
      C:\Temp\avtnifaysq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2956
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5236
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4308
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_avtnifaysq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6100
  - - C:\Temp\i_avtnifaysq.exe
      C:\Temp\i_avtnifaysq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3828
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\avsqnifdxv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4716
  - - C:\Temp\avsqnifdxv.exe
      C:\Temp\avsqnifdxv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5360
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2464
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6124
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_avsqnifdxv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1520
  - - C:\Temp\i_avsqnifdxv.exe
      C:\Temp\i_avsqnifdxv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1080
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nkicausnhf.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3168
  - - C:\Temp\nkicausnhf.exe
      C:\Temp\nkicausnhf.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:908
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2356
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5556
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nkicausnhf.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3208
  - - C:\Temp\i_nkicausnhf.exe
      C:\Temp\i_nkicausnhf.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3952
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fzxusmkhfz.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2684
  - - C:\Temp\fzxusmkhfz.exe
      C:\Temp\fzxusmkhfz.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4308
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1860
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4192
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fzxusmkhfz.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5500
  - - C:\Temp\i_fzxusmkhfz.exe
      C:\Temp\i_fzxusmkhfz.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4120
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\urpjhurmke.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3800
  - - C:\Temp\urpjhurmke.exe
      C:\Temp\urpjhurmke.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5280
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:988
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5708
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_urpjhurmke.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2844
  - - C:\Temp\i_urpjhurmke.exe
      C:\Temp\i_urpjhurmke.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2840
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wurmjezwro.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5064
  - - C:\Temp\wurmjezwro.exe
      C:\Temp\wurmjezwro.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2304
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5720
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3888
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wurmjezwro.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2300
  - - C:\Temp\i_wurmjezwro.exe
      C:\Temp\i_wurmjezwro.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:540
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\omgeywqomg.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2952
  - - C:\Temp\omgeywqomg.exe
      C:\Temp\omgeywqomg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5888
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2240
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4424
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_omgeywqomg.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5972
  - - C:\Temp\i_omgeywqomg.exe
      C:\Temp\i_omgeywqomg.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2548
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jgbytrlgdy.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1528
  - - C:\Temp\jgbytrlgdy.exe
      C:\Temp\jgbytrlgdy.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1276
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3988
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4228
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jgbytrlgdy.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1752
  - - C:\Temp\i_jgbytrlgdy.exe
      C:\Temp\i_jgbytrlgdy.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5524
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\igdyvtqoig.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1452
  - - C:\Temp\igdyvtqoig.exe
      C:\Temp\igdyvtqoig.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2288
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3880
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3212
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_igdyvtqoig.exe ups_ins
    3⤵
    PID:6020
  - - C:\Temp\i_igdyvtqoig.exe
      C:\Temp\i_igdyvtqoig.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4796
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\aysqnigdxv.exe ups_run
    3⤵
    PID:1680
  - - C:\Temp\aysqnigdxv.exe
      C:\Temp\aysqnigdxv.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3204
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2052
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5300
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_aysqnigdxv.exe ups_ins
    3⤵
    PID:5708
  - - C:\Temp\i_aysqnigdxv.exe
      C:\Temp\i_aysqnigdxv.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3936
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vsnlfdxvpn.exe ups_run
    3⤵
    PID:6012
  - - C:\Temp\vsnlfdxvpn.exe
      C:\Temp\vsnlfdxvpn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1404
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3924
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3176
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vsnlfdxvpn.exe ups_ins
    3⤵
    PID:6060
  - - C:\Temp\i_vsnlfdxvpn.exe
      C:\Temp\i_vsnlfdxvpn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6104
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pnhfaxvpnh.exe ups_run
    3⤵
    PID:4552
  - - C:\Temp\pnhfaxvpnh.exe
      C:\Temp\pnhfaxvpnh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4316
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6000
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2828
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pnhfaxvpnh.exe ups_ins
    3⤵
    PID:3340
  - - C:\Temp\i_pnhfaxvpnh.exe
      C:\Temp\i_pnhfaxvpnh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4120
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ukecwurmke.exe ups_run
    3⤵
    PID:4128
  - - C:\Temp\ukecwurmke.exe
      C:\Temp\ukecwurmke.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3892
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3344
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4108
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ukecwurmke.exe ups_ins
    3⤵
    PID:2940
  - - C:\Temp\i_ukecwurmke.exe
      C:\Temp\i_ukecwurmke.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2672
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xrmjhbzurp.exe ups_run
    3⤵
    PID:4272
  - - C:\Temp\xrmjhbzurp.exe
      C:\Temp\xrmjhbzurp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2308
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4944
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5344
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xrmjhbzurp.exe ups_ins
    3⤵
    PID:3928
  - - C:\Temp\i_xrmjhbzurp.exe
      C:\Temp\i_xrmjhbzurp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3176
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wtrmjhecwu.exe ups_run
    3⤵
    PID:5736
  - - C:\Temp\wtrmjhecwu.exe
      C:\Temp\wtrmjhecwu.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3960
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4852
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2424
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wtrmjhecwu.exe ups_ins
    3⤵
    PID:6004
  - - C:\Temp\i_wtrmjhecwu.exe
      C:\Temp\i_wtrmjhecwu.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:920
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bytrljdbvt.exe ups_run
    3⤵
    PID:5208
  - - C:\Temp\bytrljdbvt.exe
      C:\Temp\bytrljdbvt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4188
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2448
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1196
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bytrljdbvt.exe ups_ins
    3⤵
    PID:2744
  - - C:\Temp\i_bytrljdbvt.exe
      C:\Temp\i_bytrljdbvt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3592
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\olgdywqoig.exe ups_run
    3⤵
    PID:692
  - - C:\Temp\olgdywqoig.exe
      C:\Temp\olgdywqoig.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6028
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2476
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1576
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_olgdywqoig.exe ups_ins
    3⤵
    PID:3872
  - - C:\Temp\i_olgdywqoig.exe
      C:\Temp\i_olgdywqoig.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5600
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lfdbysqoli.exe ups_run
    3⤵
    PID:3492
  - - C:\Temp\lfdbysqoli.exe
      C:\Temp\lfdbysqoli.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1516
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:684
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5276
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x1dc,0x208,0x2f8,0x204,0x300,0x7ffe42a4c188,0x7ffe42a4c194,0x7ffe42a4c1a0
      4⤵
      PID:2460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1712,i,12901275495310449314,2118385608488399000,262144 --field-trial-handle=2420,i,11830212176763724712,859986836282912372,262144 --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:2
      4⤵
      PID:1540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1920,i,4183644619107287001,1085113283485303917,524288 --field-trial-handle=2420,i,11830212176763724712,859986836282912372,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:11
      4⤵
      System Time Discovery
      PID:2024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2472,i,2023271247448510292,8577257692084857282,524288 --field-trial-handle=2420,i,11830212176763724712,859986836282912372,262144 --variations-seed-version --mojo-platform-channel-handle=3120 /prefetch:13
      4⤵
      PID:2144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3592,i,7913883786881902932,2889059129500079525,2097152 --field-trial-handle=2420,i,11830212176763724712,859986836282912372,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
      4⤵
      PID:5020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3596,i,6490217830498987198,3124831461634865837,2097152 --field-trial-handle=2420,i,11830212176763724712,859986836282912372,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
      4⤵
      PID:2748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4288,i,2566435596865320657,6013207729852453578,2097152 --field-trial-handle=2420,i,11830212176763724712,859986836282912372,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:1
      4⤵
      PID:1124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4348,i,3096623185823066868,7725419218409516339,2097152 --field-trial-handle=2420,i,11830212176763724712,859986836282912372,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:9
      4⤵
      PID:3096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3784,i,4414566264122645582,17653224909485426775,524288 --field-trial-handle=2420,i,11830212176763724712,859986836282912372,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:14
      4⤵
      PID:2696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5564,i,163123808390598793,7029828966879763535,524288 --field-trial-handle=2420,i,11830212176763724712,859986836282912372,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:14
      4⤵
      PID:1656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5568,i,5759941914482875262,4522427150502622675,524288 --field-trial-handle=2420,i,11830212176763724712,859986836282912372,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:14
      4⤵
      PID:1728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,18268154433823729699,4862730604765812306,524288 --field-trial-handle=2420,i,11830212176763724712,859986836282912372,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
      4⤵
      PID:6020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,18268154433823729699,4862730604765812306,524288 --field-trial-handle=2420,i,11830212176763724712,859986836282912372,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
      4⤵
      PID:2648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,8305222027010132869,14550870075214439723,524288 --field-trial-handle=2420,i,11830212176763724712,859986836282912372,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:14
      4⤵
      PID:2548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,4679301466837614363,12204892502847209558,524288 --field-trial-handle=2420,i,11830212176763724712,859986836282912372,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:14
      4⤵
      PID:5928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4364,i,10999943451008473717,12170593495547990909,524288 --field-trial-handle=2420,i,11830212176763724712,859986836282912372,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:14
      4⤵
      PID:6088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4892,i,12508837189387865999,1932342929250472086,524288 --field-trial-handle=2420,i,11830212176763724712,859986836282912372,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:14
      4⤵
      PID:1204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3684,i,6411270848000821659,10844952548588321587,524288 --field-trial-handle=2420,i,11830212176763724712,859986836282912372,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
      4⤵
      PID:4800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,2132076392302558633,13867576504091632269,524288 --field-trial-handle=2420,i,11830212176763724712,859986836282912372,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:14
      4⤵
      PID:260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,5365958970208719345,4631712230134752379,524288 --field-trial-handle=2420,i,11830212176763724712,859986836282912372,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:14
      4⤵
      PID:4676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,2256258690259055520,4325656695715080653,524288 --field-trial-handle=2420,i,11830212176763724712,859986836282912372,262144 --variations-seed-version --mojo-platform-channel-handle=928 /prefetch:14
      4⤵
      PID:3216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6836,i,6172276459839556602,1601563852357653227,524288 --field-trial-handle=2420,i,11830212176763724712,859986836282912372,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:14
      4⤵
      PID:5992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6344,i,17304739591781812851,13352658671587948109,262144 --field-trial-handle=2420,i,11830212176763724712,859986836282912372,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:10
      4⤵
      PID:1504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,14240354148900577441,16424687296582667100,524288 --field-trial-handle=2420,i,11830212176763724712,859986836282912372,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:14
      4⤵
      PID:5004

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3888

C:\Temp\tomgeywqojgbztrl.sys
C:\Temp\tomgeywqojgbztrl.sys
1⤵
- Executes dropped EXE
PID:1664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5452

C:\Temp\dbytjdbvtq.sys
C:\Temp\dbytjdbvtq.sys
1⤵
- Executes dropped EXE
PID:5196

C:\Temp\lgdywqoiga.sys
C:\Temp\lgdywqoiga.sys
1⤵
- Executes dropped EXE
PID:6020

C:\Temp\gaysqnifda.sys
C:\Temp\gaysqnifda.sys
1⤵
- Executes dropped EXE
PID:2584

C:\Temp\usnkfcxvsn.sys
C:\Temp\usnkfcxvsn.sys
1⤵
- Executes dropped EXE
PID:2300

C:\Temp\pfzxrpnkec.sys
C:\Temp\pfzxrpnkec.sys
1⤵
- Executes dropped EXE
PID:1196

C:\Temp\upmkecwusm.sys
C:\Temp\upmkecwusm.sys
1⤵
- Executes dropped EXE
PID:612

C:\Temp\wtrmjecwup.sys
C:\Temp\wtrmjecwup.sys
1⤵
- Executes dropped EXE
PID:1044

C:\Temp\romgebzwqo.sys
C:\Temp\romgebzwqo.sys
1⤵
- Executes dropped EXE
PID:4728

C:\Temp\trljdbwtom.sys
C:\Temp\trljdbwtom.sys
1⤵
- Executes dropped EXE
PID:3588

C:\Temp\olgdyvtnlg.sys
C:\Temp\olgdyvtnlg.sys
1⤵
- Executes dropped EXE
PID:3924

C:\Temp\bvqnigdxvt.sys
C:\Temp\bvqnigdxvt.sys
1⤵
PID:2828

C:\Temp\xvpnifdxus.sys
C:\Temp\xvpnifdxus.sys
1⤵
PID:5224

C:\Temp\vsnkfcxupn.sys
C:\Temp\vsnkfcxupn.sys
1⤵
PID:2424

C:\Temp\usmkfcaxrp.sys
C:\Temp\usmkfcaxrp.sys
1⤵
PID:5324

C:\Temp\urpjhezxrp.sys
C:\Temp\urpjhezxrp.sys
1⤵
PID:3016

C:\Temp\ztrmjebwur.sys
C:\Temp\ztrmjebwur.sys
1⤵
PID:5544

C:\Temp\jebzwuoljg.sys
C:\Temp\jebzwuoljg.sys
1⤵
PID:5808

C:\Temp\oigaytqljd.sys
C:\Temp\oigaytqljd.sys
1⤵
PID:3692

C:\Temp\igayvtnlgd.sys
C:\Temp\igayvtnlgd.sys
1⤵
PID:3884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

avsqnifdxv.exe

Path C:\Temp\avsqnifdxv.exe
Size 365KB
SHA256 ec192867273e773734cf3ad4d2575dfb798555ad4b0b649c07764d8d1f4d9700
MD5 45c5f7cbe4bb760c7d5844608a03f957
SHA1 0708a4d001de79162d030bd5774e070afb2628e3
SHA512 703d60261f40e6127c56b1696059211cbd5f8cd1cb118461db4c6a538d00bfc62be5fe1bd86ae0c2296a06545cb0b1c3343bddcfef46ea0204a32ecda22f042b
SSDEEP 3072:UuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:UuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1AB847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

avtnifaysq.exe

Path C:\Temp\avtnifaysq.exe
Size 365KB
SHA256 eb11ae2caca53097f8a71436a906bb5714b674a1d3eb1254cf1e07fe9c8b5c0f
MD5 b925e5c0439eee032c2743681aaeb342
SHA1 037b9cc479b8d9294a540c1fe9878a8afb6225b8
SHA512 30e00781a2ccf911177e18953f9f9dad19cdb541bcfc6fc247f55e82a70306b2155218dba2d8efea4b1164e55cc3f638016013762792b949e34b802239a3593d
SSDEEP 3072:juxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:juxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T137847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbytjdbvtq.sys

Path C:\Temp\dbytjdbvtq.sys
Size 293KB
SHA256 e86bbe14bd7dabc20aa7d347e1eda3fb88b1024f5b8a4fbfae69a18ee7a062a9
MD5 02e00dac6017dc4a0dffe8f16d64ac11
SHA1 3e83ed0981e745fb24d8d77a514f8fe9d6e676f5
SHA512 815012f3813b41c34cb3ee694afd07297269788ebd3ed6b924870ec8ddbb4877be0c0852b9c5b332509a50c1606b16c4e52b1360d144ec64108b462840d0ce72
SSDEEP 3072:+tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:+IJjiJcbI03GBc3ucY5DCSj
TLSH
T1F2545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fzxusmkhfz.exe

Path C:\Temp\fzxusmkhfz.exe
Size 365KB
SHA256 3d9ab1219081d6f98e8378ff178aff26f1b7b18899e893d7554d2e45c7b2c1fa
MD5 e959fbc472993aea1a386e877a03af01
SHA1 dcb762284b9f2128428bff957c717219f3b3db21
SHA512 1597daf9d543f46f6f0c300f25b505ba46c93f4a56983739758117020df9f558778c6b19cd8ff9237dd7247ef2f8ca4a193c0f0192faf0daac19b25077b5a777
SSDEEP 3072:0uxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:0uxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T115847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gaysqnifda.sys

Path C:\Temp\gaysqnifda.sys
Size 293KB
SHA256 1b532ab483f1e0f45af24122a8a7de3ffec05c635ccf966b424ab5ccd41ea49a
MD5 f8641fd61946bf1357d4b314c62c4e48
SHA1 cb4e0348cd3d8ac2c637a2e41666d0f7d00c04c9
SHA512 26f60db8a66810f2815e06258905f3c928a46c7cbbaf4d079a18cc03a88dd2d3ecacbced432ef038235653eecae5c2223f544c8f16fb6f2beb2cd87edc7d7adb
SSDEEP 3072:WtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:WIJjiJcbI03GBc3ucY5DCSj
TLSH
T119545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_avsqnifdxv.exe

Path C:\Temp\i_avsqnifdxv.exe
Size 365KB
SHA256 588462249b3e7a3be439ab7bfe401ab8490f80c0de7e56239d1d2130c0e4cd16
MD5 5f98a7f48680f658334766541c2de608
SHA1 1b5614135e8ced87fa43593cef12b62b6cef9c8c
SHA512 40b0c696af1126739eee1e55302f832cc75846240a900ea5e8bbe4ed51d8e2ea1d2f94fcd9af2be42b7ba04c63acc6c40fba7adb63064b35e22e859c49fc4244
SSDEEP 3072:QuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:QuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1AF847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_avtnifaysq.exe

Path C:\Temp\i_avtnifaysq.exe
Size 365KB
SHA256 987c3f28b68cb5067c309b358f4cc81f031c1cf835f7534a2f627656495b11ef
MD5 dede7de55c100d4256fdd7c7daf65c37
SHA1 7edafcd22bd3b38ffb328abdc6a18a85424ee732
SHA512 af5169139cf3f3b72537d77f2045470b6e0655c577b960a9f64d15b2db1051ed058a02857e3897ed439843466d9aa29b615714631557458843fd356b6c734c0e
SSDEEP 3072:+uxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:+uxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T19D847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nkicausnhf.exe

Path C:\Temp\i_nkicausnhf.exe
Size 365KB
SHA256 45b4dbad73476b71432c05f51fa58f4d05c84af1ecd6e32c6889e46a73794806
MD5 5b59a74119cb8533ae73a21eaeece954
SHA1 e6ef455315bbe81e0ec75bb5bf64079c603087b1
SHA512 5e31894048194642e4da385d5d81aeb1db4b92643de7f3f34afefd6d3212f531b1fb2ba83200607f502b0c7489708feb6a2ebf0d14309d2e082ff57ec3a03f0f
SSDEEP 3072:/uxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:/uxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T153847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qligdyvqnl.exe

Path C:\Temp\i_qligdyvqnl.exe
Size 365KB
SHA256 e009bf6ac7e1a91219d18207b0c0fd0062433f071946a72a94cadb79ddef0637
MD5 0e628ab59bf61c4a462a1eeb453a3ce5
SHA1 0e687eeec9c429cb30294d0f7f018cc6fde412e4
SHA512 e2c74c28442412ae97b248a0de81b36cf17f73381f4bb0b1fe8bc9df19e6847136a472f5828f6130e06da2fd2c5fa824c410fa94b01008ab15f0937ce2fcf667
SSDEEP 3072:2uxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:2uxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T145847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tqomgbywqo.exe

Path C:\Temp\i_tqomgbywqo.exe
Size 365KB
SHA256 b0a9c34d778955a528f9b827311367c7e3956c1e9440edbf0301ef1511234091
MD5 5827bb9ce3ae6d451e25bc04ec76a2ce
SHA1 1f6140963e2cbc5824c79963896e0ebd8724f4cc
SHA512 88636f21f149bbfa043d75616eedff74ea15d44980d9a32566e7673777a48c56931a706ea5c2f63be7d239467208030d54dad9fa82102dd19981574841bc6d26
SSDEEP 3072:YuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:YuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T188847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgdywqoiga.sys

Path C:\Temp\lgdywqoiga.sys
Size 293KB
SHA256 2e567ff6a2dd8b9a22cc3cb9c64ff15285aa84db9bf41bc2045ee4ea16415802
MD5 615ee754084c9eaee6fcb72b1c3d554a
SHA1 1d0348d8babf17bf02cbca62581f8bafd7cd94b4
SHA512 5e43a723c8e773a2df33949d94fb755153d33adeb8df026b039bca3b966f54c2a515c46af735aaa1b1e5af280773dd760774bdd5501c2f07b070b9b2546dc67f
SSDEEP 3072:/tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:/IJjiJcbI03GBc3ucY5DCSj
TLSH
T132545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nkicausnhf.exe

Path C:\Temp\nkicausnhf.exe
Size 365KB
SHA256 c0fbef21efe57db93f99e8927affa99b9446f6ac0d1577f88598652fcd748573
MD5 5aff8412a132f8ed85b72f4701bdaa27
SHA1 752854dd1e5835a7801fac623774f7ab7e795914
SHA512 d1a30000e44bdff1287d936f94c455985b11f34c1cf1d9a88520b6d54018436f6111d1cf99acf9a77944d550d07d6cce5a053c742a4899b537359cb9f2999791
SSDEEP 3072:2uxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:2uxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1CB847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pfzxrpnkec.sys

Path C:\Temp\pfzxrpnkec.sys
Size 293KB
SHA256 806c002fc27ca000da64905730a0ad01218782138961459ed8d2c71d58bb426a
MD5 782a481459e5297c6dc4c4100a796a82
SHA1 87d8f7c9d6a76b04cf712c76ffa7d5743ddb09ad
SHA512 5b1e5f8197f578a0f0e39d6b9ecf8fcb0506de966449b7c89f2cd1aea2f27f83616a41c338f26483c6cfa31ad3ed8a3226f20dbbe857f4cf832c5c6e084a240a
SSDEEP 3072:ztKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:zIJjiJcbI03GBc3ucY5DCSj
TLSH
T140545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qligdyvqnl.exe

Path C:\Temp\qligdyvqnl.exe
Size 365KB
SHA256 933ae6ba419c81752e5de650b0fbc8b6135731a8db21232f21de1a36324fb296
MD5 5ea4fc7d6a39a1ae1b519240c7fd1fbf
SHA1 f3f1c1d5dccbefe1e20e1179c111d53fe2628682
SHA512 5be5595ef8e62874b1215ef7f94035479ef20e0930f841b64b9e9b55f4d8b87060e5b3b82a2ea2507963ca4aff0c5c8234ebe111c558e5cebbf53591c113280e
SSDEEP 3072:GuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:GuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B4847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tomgeywqojgbztrl.exe

Path C:\Temp\tomgeywqojgbztrl.exe
Size 365KB
SHA256 016c5127de160225212aabc23eaca52d79974ffbf931c4b0b60e758fca0cc5d6
MD5 f1ab1bb658c2d1afa188272487f97c51
SHA1 e45ba004d826dba90f2ccde4e085cef4cc70bbeb
SHA512 d4244fbf5244a5932fc673cf2bb7c1998ffbb391a91035056fcf02a0493041f53f0887897fbba2dd0464c4eaf53943b3c53b45c586285265655259a820a93823
SSDEEP 3072:3uxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:3uxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1FA847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tomgeywqojgbztrl.sys

Path C:\Temp\tomgeywqojgbztrl.sys
Size 293KB
SHA256 e59434183c4738ba7fef2dd06f75e0b3a5b62178e26e494498185728c4afb42d
MD5 a1a3ca6b90a1910430831464f33be0eb
SHA1 87a18af37223b738c5cc5a6f1bb277f11e722cf9
SHA512 78e0d7d5635fe08c1e6c3ae886d8d7136e848411a084b7babb5868c43421f997b27baab187819c35e23284692c19419feb0a463c371d1a4149b94b3105e3a1a3
SSDEEP 3072:ltKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:lIJjiJcbI03GBc3ucY5DCSj
TLSH
T139545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tqomgbywqo.exe

Path C:\Temp\tqomgbywqo.exe
Size 365KB
SHA256 69c2e3f325a681b304da1a030a3d4a104a80d07a5383b6fc7d0d8a80cfa74d47
MD5 4d01a7edb334ea57f5bd574cc7b5d837
SHA1 215fd794fdc01712f973021672f965c2d264b5b4
SHA512 ce6fc6bac220073e83d66ddb79b8eb95ce9375b20cd4934599833b046bffcfcd698142d0850e7347151169932d25f4457c3d9ec33c60fe4df1af1067245aa93a
SSDEEP 3072:6uxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:6uxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T116847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usnkfcxvsn.sys

Path C:\Temp\usnkfcxvsn.sys
Size 293KB
SHA256 0aea25dd343e3c9e2b108b341fefe29d93ca0933e426f008198dda51b65cde1d
MD5 6d268e5eda34c0ecdc75dbf1358f2f59
SHA1 cfdb4a0699a3db296c67c318875116b6911f9bfe
SHA512 f9dc92d2ed53d0ab382cc069600cf7ae3952d8ec190376028cbc02daaccc95f91e1cf3c2878619230f451e43005808ad8c5f2f3e9a0ee77a4b09cbaaffe6bb5b
SSDEEP 3072:ytKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:yIJjiJcbI03GBc3ucY5DCSj
TLSH
T165545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f2f36159b1a73a0ea0e59f51f1f373932375016885fcf17933887e7d1b2c3016
MD5 2dd00ee0ca93975f2038728e856681d5
SHA1 24fcfdb6befe18bca66bab129cd0fba4ad709e15
SHA512 d734e4919f2bc11b3e1a733c99b812ac0c7d2d76c45401d957b2b60a896b0bfc172f211ec13501d83d82cd3445e59aa5e9e4a25b2d71ff9d2f99bdb12460b4e4
TLSH
T10FD09BE56640D94DC58020721593D555F5705931D40553C85101B43DDC952C703574DB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 99348710dfa24f06e3cc9e5d66d99b450d2606932193b821d1cccbb1b0382494
MD5 99dd082560f2d99883b896493c6f1a16
SHA1 8c1328ed9b1727d8e368914ffd96b9d8d9882e17
SHA512 2eac54e4bf6c56c6a86be1ac66b75e47cf5afa02dca24674366691d2eae08e023308cf9c0e790eecff6d37160a3b4bc6aa0d7b2cbe2bf4b7074898f149ff8bfb
TLSH
T11DD09BE56640D94DC58020721593D555F5705931D80553C85001743DDC952C703574EF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 def8ce1f35142351e4db138489b0529399dddd1a3a4c08e409e70e7cde323f0b
MD5 4d6bbda28a86eec4ae57be8de1c2d45e
SHA1 fb078cafbc8e1c7091e836de789b2d7c90af4d88
SHA512 2f1abd37113a9eb2cff6e58d296915ad9cb40680ae8db412eb4aad95c7d88f052f8b2a4dc4a62f2a638a6c88d34e79855554d21414f211e9218e8b24bce45721
TLSH
T10961E95347740FE9F3298E7361E1D8D23A31BBFA414BAF132474B178F91A755681A234
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59b155.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59b155.TMP
Size 3KB
SHA256 976e0e220d5868a0564a7bea883309aa99a2dfade8fc77aa6fb6b810c111ab93
MD5 713fe6c9a968af794647496e44961325
SHA1 4795c86a18839cb3ebecfefc18bd9ae240e60f75
SHA512 0fbc92c994440c1f6e4dbf55d618c147b7eddc149ca6c3afe439d9cc419c36368fa616e26a59baf1c8d49fe0a47951a4cecefc9700e14a50aa3b1d9abe971798
TLSH
T1A161095343740FE9F3298E7361E1C8D63A31BBFA0147AF132074B178F91A755681A234
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f2bfdc215209010b5970f53ce2d9d69d32806dae7986f7acc3f5c6427b71a33d
MD5 17291be24c822e42d7689b4f250490db
SHA1 d1be4bdda07b9bfbf2d8103c26f6db40abb917d6
SHA512 4a315ae40dc55d9f06bafb60b188f4dddbea61228467c50fa38f18641d4ff92276b17dbb7372c4c8c2800479b0aad519c1ed9397e4a360a4d5a818a2615c78cb
TLSH
T14C51CEF3C7E9966DC9115AF0AB187E2BCE1D0914832C3D5AC8E4AF1B93E3471E14199E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 9801451a21908b11babe460d6f6731c2738e4ab3ca867f5cd26036d9daf3aad0
MD5 ec8be998ece125b28896d54b9357b3ab
SHA1 e1e18716027a7086ebe39474495a4f3b04490bed
SHA512 7ed9e121be51a000c472c671c43b5bdf50019a81a8254fea5f8325b24ab3a95f1c5f9b550e7bbb4b0458b0508a91e892094284a56a63d00b00a1fd54cef13920
SSDEEP 192:sxRHRfyM/jK1Ml8wCc/fYs3DcpZgdzoA8p9n/g6+WNCYB/YPKdlqGJIgtJ:sxRHd8c/fYs3YngQ1/5j/HJ3
TLSH
T11962C8166A3499778CDBD20DFA957F53D6F81573A2501E44A9FCCA0C01E76ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 57a09bb45b958fb9d2a8991ceef69f8b7b96ba4dcc3d56a56529986658ac794f
MD5 74361e7c69a17be0127c43ba5b1e88a9
SHA1 00b2b6e7acce6aedf8eb7077b30599909341914d
SHA512 9771a8a073f187e3bebd58344248df65646f8ae630d87a799d1980045f080a7783d073fd2266683fa7791d5b304c2e587811162a80d0ca9beb579a37a104b59c
SSDEEP 192:sxRkRfyM/jK1Ml8wCc/fYsMDcpZgdzoA8p9n/g6+WNCYB/YPKdlqGJIgD8J:sxRkd8c/fYsMYngQ1/5j/HJE
TLSH
T14E62B8166A3499778CDBD219FA957F53D6F81472A2901E44AAFCCB0C01E76ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 2b7f9fdf59de4710c6558ee5390802acae551ded36e9ad3201a17aa63acf24a8
MD5 86b3da517ce31f3e6cf4b803e1466e6b
SHA1 a52ec85d644444d8a9e57e10d8369971253a0bf7
SHA512 f0485cb9f3a859ca3377fd8565a503b848ecabcd345340ebc9809c6c2aededdd56d7d2a6aa248245fa664b30c670fc87e3f4eb1eea1ea5b7518ffd4e2e1f68cb
SSDEEP 192:sxRQRfyM/jK1Ml8wCc/fYsMDcpZgdzoA8p9n/g6+WNCYB/YPkdlqGJIgD8J:sxRQd8c/fYsMYngQ1/5j/vJE
TLSH
T1ED62C8166A3499778CDBD219FA957B63D6F81472A2501E44AAFCCB0C01E76ED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 10f2d39132678e26396565c90e6f94f1375c471776df434e5878d43a3fc15bd4
MD5 c01ac6ed0c2245d84ce1c5bed810b8ab
SHA1 abe9236d2b817e772cec651ec3f2ea0862450db4
SHA512 e8ea8d7902c16905f2830b78cb79ecc96c32b439795f9bf3f3ccde76bd7e05545d3b976679967cda20c8179647fb1386dcdc869166042aeeb465c985922aa5ce
SSDEEP 192:sxRQRfyM/jK1Ml8UQ9Cc/fYsMDcpZgdzoA8prn/g6+WNCYB/YPkdlqGJIgD8J:sxRQdq8c/fYsMYngQb/5j/vJE
TLSH
T18A62C8166A3499778CDBD21DFA957B63D6F81472A2501E44AAFCCB0C01E76ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 614dfb31a154a4cbecab33483238bc52b38faef58e502b7d6e71301a2052f87e
MD5 f5a1b6d9a87cb5d754ecd3e9049dc4bb
SHA1 d0f3c608e23a6e17a9f7c466a708000cdc94b83e
SHA512 3b46a510deaac3c8c79d444a6b33133720e0f054ebf837e28dad237b0aa5615cccfb0fbdd12a0635f623fe2dff2bc43fa0dcad52d696365b4e14376f057c92aa
SSDEEP 768:5+McBM7pLuL7MpWgFZfsl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVZkfj/eIroVXD:5+McBwE7MpWgFZfslu1jaOkfTezVXD
TLSH
T10AE2EC3B680CCB7F4F804A9CEC297D9A6DE801CF9698895447FA850C03C66EF561B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 520f019ad99486625dc88f5828d676df036f58c2a054d5ed67da9c5a12d7e332
MD5 b7678dd26d45de90e510f3f72b430f62
SHA1 517684f9f4136418fae5388ac3b64b2e267e855e
SHA512 16caa760d7193a9950fbc9fb5d8916608c770ae653a00c5d18d7188319b18ac932aecb6efd5d168fddfca8d89b020bfc1d9a89fbbe2f3e454858486511259306
SSDEEP 96:KRHQ1xHF1ZWBu0g5ZK4wg3Zc/32p1qHeTieYgQGWAltgeGK4DgcGcW+9M+wBUAyC:CHQ1xHF1UBuF5Twg3m/32p1qHeTieYgn
TLSH
T1F091F414713A12C53C3F29499469D86785C6B2533019743F7BA903E25B6BE028EFF9DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 76796650a914a06739210c24dae1052d818f6fa8e475165725e142851fa2cad6
MD5 0d90b1357425d4f80ec16bc906b9d243
SHA1 c7f6c5dd53b0856f28c2c2aa9860b91e70bd61aa
SHA512 febcf6b24d38a196374975801a474d2e7162e69d7ee1dce214c0291e4acaa81f2b2e39bd649db85cc551cd7e92ca962645efafdd79c39d092b360bb9d5d61ebb
SSDEEP 768:hhj+943g505JGkMf5x/q5WFbxsz56f0+ynobQb9Mv:h8943Ktf//q5WkQ58b+v
TLSH
T181F2BE31A8229DB34DE3D699B3AB378BBEF416B3D6D00D88D5DD6B0D0583A9C5707812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 14fe9bf13354dc56c9126093e4c986669a8a484f83698712dbc1e14260931718
MD5 b1ffa237247f33ce3a31be8edcb38555
SHA1 2188a47f40173254d1bd3f5d00da94d642d6f331
SHA512 40dbc8b47e32222bbe76e2bcabbbd67ada73a51a2375b0808268875980470051e24626520e8bdb2a83d89ab8ec116f834497d5da0a6416865e750e45829bf1d3
SSDEEP 768:Dirv+4UNbdl3tvmTJGkMf5xh5WFbxsz56f0+ynobyUixK:Dibsbr3V9f/h5WkQ5+UX
TLSH
T1AD03CF36A82499B78EF3D685B28B76477FB81163D6C00E98C9DD3B0C469B45D2307D63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 d35df24b8eb229ada7fad494e895ca2b24b21627350407f39284db0fd86810b3
MD5 496d5962e4c7009f028ed96d73e99eef
SHA1 a8337c35fbb5c2cb3eb4274a51958b6a3f435505
SHA512 0fff76a03a05b47529e82fb96c7e1fd00d17c0ce69e2a5a8a39b15f7116a86bd34d9e14d1eca25b01467e6d7a0848a75563817a116f66a6b2a652ff537d9a666
SSDEEP 768:Zjj+943/5U4if5x/v5WFbxsz56f0+ynobQb9Mv:Zm943R6f//v5WkQ58b+v
TLSH
T1D01329F598E39973C99E8787A37E7E46ADBCD163B5840888B7D85E0CCC8257FC606811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

ec68981b-5762-413f-bbe2-6c2e02383110.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ec68981b-5762-413f-bbe2-6c2e02383110.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4560_1161451707\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 99bafc9baf79ae9fa0a9ec1c68e3f6182ee6086a76ad33ca47d2b18f26099b2a
MD5 55a6ebfa0d6b0b5d6ebbc407ed338c57
SHA1 8ad4f25e75af9e4d51aaf5ea47b1ac837ced2520
SHA512 cc5cee10d1510f80914689bc4c9e4bcb374ccdc4831ac109b4763731d947a0025fbb70d792ed246724484abe9b815dfd1f5336daa1cf9da009ca6d4ecbdbedac
TLSH
T19571274357BDD5B3C1DA5BF103835104F6FB12780B2370240BA15546F730A752478F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/612-320-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1044-324-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1196-303-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1664-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2300-283-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2424-410-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2584-266-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2828-386-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3016-441-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3588-337-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3692-478-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3884-495-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3924-366-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4728-333-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5196-191-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5224-406-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5324-430-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5544-462-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5808-466-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6020-238-0x0000000000010000-0x00000000000AB000-memory.dmp

Download