systex | b6c4fa06f64461de5557aeead3bf4843b63d0309b40076297dab5025cdcb1c43

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 16:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-07_53d31c97419f12f52adc543c04236263_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Size 365KB
Sample260707-tpxtnsh14q
SHA256 b6c4fa06f64461de5557aeead3bf4843b63d0309b40076297dab5025cdcb1c43
MD5 53d31c97419f12f52adc543c04236263
SHA1 a09f438624fcb5cd17c06876bcdb2756d0587fd3
SHA512 9e0a989fa29db18093ba8143ddc32c91844ac80bbee97ebf930bf83c3b74975ddb367a455ac4684a02b0aff7190b65ca628ac26144c0ea516ffbb75d0f9221b4
SSDEEP 3072:9uxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:9uxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1AF847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
3704	jdbwtomgeywqojgb.exe
6000	CreateProcess.exe
5712	igeywigbyw.exe
4436	CreateProcess.exe
4252	jdbwtomgeywqojgb.sys
848	CreateProcess.exe
1308	i_igeywigbyw.exe
5948	gaytqlidbv.sys
5584	CreateProcess.exe
856	vtnlgaysql.exe
208	CreateProcess.exe
1396	CreateProcess.exe
4780	i_vtnlgaysql.exe
4736	nlfdavsnli.sys
2612	CreateProcess.exe
2716	kifavsqnif.exe
4212	CreateProcess.exe
4036	CreateProcess.exe
4784	i_kifavsqnif.exe
5456	snkfcxvpnk.sys
5992	CreateProcess.exe
3356	pnhfaxsnhf.exe
5604	CreateProcess.exe
4484	CreateProcess.exe
3440	i_pnhfaxsnhf.exe
2892	xvpnkfcaxs.sys
2040	CreateProcess.exe
4128	hfzxrpnhcz.exe
360	CreateProcess.exe
1588	CreateProcess.exe
3084	i_hfzxrpnhcz.exe
4700	pmhecxusmk.sys
5828	CreateProcess.exe
980	jhczurpmke.exe
1364	CreateProcess.exe
4056	CreateProcess.exe
4616	i_jhczurpmke.exe
4520	omkecwurmj.sys
4228	CreateProcess.exe
5768	mjebwuomje.exe
5456	CreateProcess.exe
2224	CreateProcess.exe
4932	i_mjebwuomje.exe
2636	rljgeywtol.sys
612	CreateProcess.exe
2256	wuomgeywro.exe
1176	CreateProcess.exe
5948	CreateProcess.exe
2812	i_wuomgeywro.exe
1512	trljgbywro.sys
4084	CreateProcess.exe
108	eywqoigbyt.exe
752	CreateProcess.exe
2856	CreateProcess.exe
2780	i_eywqoigbyt.exe
3152	tqoigaytql.sys
1700	CreateProcess.exe
620	tqoigbykid.exe
5128	CreateProcess.exe
4360	CreateProcess.exe
3984	i_tqoigbykid.exe
4932	ligaysqkig.sys
3576	CreateProcess.exe
2636	ifdxvtqlid.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2404_1193161199\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2404_1193161199\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2404_1488690432\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2404_1488690432\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2404_1488690432\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2404_29259317\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2404_1197515020\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2404_1197515020\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2404_1488690432\office_endpoints_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_causmkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwurmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbvtrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igeywigbyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhfaxsnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xsqkicavsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rojhbztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigayvqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifdxvtqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xsqkicavsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvtodywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhfaxsnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhczurpmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomgeywro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywqoigbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqoigbykid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlgaysql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnlgaysql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfzxrpnhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjebwuomje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causmkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigayvqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-07_53d31c97419f12f52adc543c04236263_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbwtomgeywqojgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhczurpmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifdxvtqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwurmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igeywigbyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfzxrpnhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywqoigbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfcxjhfzur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kfcxjhfzur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rojhbztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbvtrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kifavsqnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjebwuomje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqoigbykid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvtodywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kifavsqnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomgeywro.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3348	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2884	ipconfig.exe
4616	ipconfig.exe
1468	ipconfig.exe
2808	ipconfig.exe
5972	ipconfig.exe
1304	ipconfig.exe
4452	ipconfig.exe
2116	ipconfig.exe
2892	ipconfig.exe
5804	ipconfig.exe
5744	ipconfig.exe
5452	ipconfig.exe
3840	ipconfig.exe
3932	ipconfig.exe
1256	ipconfig.exe
5960	ipconfig.exe
5156	ipconfig.exe
2520	ipconfig.exe
4524	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134279189233179025"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-515251955-468707340-1782030364-1000\{969E7102-9012-44F3-944B-6C52A8921698}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4180	2026-07-07_53d31c97419f12f52adc543c04236263_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4180	2026-07-07_53d31c97419f12f52adc543c04236263_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4180	2026-07-07_53d31c97419f12f52adc543c04236263_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4180	2026-07-07_53d31c97419f12f52adc543c04236263_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4180	2026-07-07_53d31c97419f12f52adc543c04236263_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4180	2026-07-07_53d31c97419f12f52adc543c04236263_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4180	2026-07-07_53d31c97419f12f52adc543c04236263_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4180	2026-07-07_53d31c97419f12f52adc543c04236263_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4180	2026-07-07_53d31c97419f12f52adc543c04236263_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4180	2026-07-07_53d31c97419f12f52adc543c04236263_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4180	2026-07-07_53d31c97419f12f52adc543c04236263_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4180	2026-07-07_53d31c97419f12f52adc543c04236263_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4180	2026-07-07_53d31c97419f12f52adc543c04236263_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4180	2026-07-07_53d31c97419f12f52adc543c04236263_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4180	2026-07-07_53d31c97419f12f52adc543c04236263_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4180	2026-07-07_53d31c97419f12f52adc543c04236263_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4180	2026-07-07_53d31c97419f12f52adc543c04236263_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4180	2026-07-07_53d31c97419f12f52adc543c04236263_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4180	2026-07-07_53d31c97419f12f52adc543c04236263_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4180	2026-07-07_53d31c97419f12f52adc543c04236263_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4180	2026-07-07_53d31c97419f12f52adc543c04236263_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4180	2026-07-07_53d31c97419f12f52adc543c04236263_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4180	2026-07-07_53d31c97419f12f52adc543c04236263_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4180	2026-07-07_53d31c97419f12f52adc543c04236263_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4180	2026-07-07_53d31c97419f12f52adc543c04236263_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4180	2026-07-07_53d31c97419f12f52adc543c04236263_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4180	2026-07-07_53d31c97419f12f52adc543c04236263_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4180	2026-07-07_53d31c97419f12f52adc543c04236263_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4180	2026-07-07_53d31c97419f12f52adc543c04236263_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4180	2026-07-07_53d31c97419f12f52adc543c04236263_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4180	2026-07-07_53d31c97419f12f52adc543c04236263_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4180	2026-07-07_53d31c97419f12f52adc543c04236263_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4180	2026-07-07_53d31c97419f12f52adc543c04236263_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4180	2026-07-07_53d31c97419f12f52adc543c04236263_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4180	2026-07-07_53d31c97419f12f52adc543c04236263_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4180	2026-07-07_53d31c97419f12f52adc543c04236263_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4180	2026-07-07_53d31c97419f12f52adc543c04236263_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4180	2026-07-07_53d31c97419f12f52adc543c04236263_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4180	2026-07-07_53d31c97419f12f52adc543c04236263_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4180	2026-07-07_53d31c97419f12f52adc543c04236263_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3704	jdbwtomgeywqojgb.exe
4180	2026-07-07_53d31c97419f12f52adc543c04236263_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4180	2026-07-07_53d31c97419f12f52adc543c04236263_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3704	jdbwtomgeywqojgb.exe
4180	2026-07-07_53d31c97419f12f52adc543c04236263_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4180	2026-07-07_53d31c97419f12f52adc543c04236263_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3704	jdbwtomgeywqojgb.exe
3704	jdbwtomgeywqojgb.exe
4180	2026-07-07_53d31c97419f12f52adc543c04236263_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4180	2026-07-07_53d31c97419f12f52adc543c04236263_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3704	jdbwtomgeywqojgb.exe
3704	jdbwtomgeywqojgb.exe
4180	2026-07-07_53d31c97419f12f52adc543c04236263_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4180	2026-07-07_53d31c97419f12f52adc543c04236263_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3704	jdbwtomgeywqojgb.exe
3704	jdbwtomgeywqojgb.exe
3704	jdbwtomgeywqojgb.exe
4180	2026-07-07_53d31c97419f12f52adc543c04236263_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3704	jdbwtomgeywqojgb.exe
4180	2026-07-07_53d31c97419f12f52adc543c04236263_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4180	2026-07-07_53d31c97419f12f52adc543c04236263_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4180	2026-07-07_53d31c97419f12f52adc543c04236263_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3704	jdbwtomgeywqojgb.exe
3704	jdbwtomgeywqojgb.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe
2404	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	1308	i_igeywigbyw.exe
Token: SeDebugPrivilege	4780	i_vtnlgaysql.exe
Token: SeDebugPrivilege	4784	i_kifavsqnif.exe
Token: SeDebugPrivilege	3440	i_pnhfaxsnhf.exe
Token: SeDebugPrivilege	3084	i_hfzxrpnhcz.exe
Token: SeDebugPrivilege	4616	i_jhczurpmke.exe
Token: SeDebugPrivilege	4932	i_mjebwuomje.exe
Token: SeDebugPrivilege	2812	i_wuomgeywro.exe
Token: SeDebugPrivilege	2780	i_eywqoigbyt.exe
Token: SeDebugPrivilege	3984	i_tqoigbykid.exe
Token: SeDebugPrivilege	4804	i_ifdxvtqlid.exe
Token: SeDebugPrivilege	5484	i_xsqkicavsn.exe
Token: SeDebugPrivilege	5668	i_causmkhcau.exe
Token: SeDebugPrivilege	5888	i_kfcxjhfzur.exe
Token: SeDebugPrivilege	4308	i_ecwurmkecw.exe
Token: SeDebugPrivilege	1160	i_rojhbztrlj.exe
Token: SeDebugPrivilege	5432	i_jdbvtrljdb.exe
Token: SeDebugPrivilege	2676	i_dbvtodywqo.exe
Token: SeDebugPrivilege	2368	i_qoigayvqoi.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2404	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4180 wrote to memory of 3704	4180	2026-07-07_53d31c97419f12f52adc543c04236263_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	88
PID 4180 wrote to memory of 5896	4180	2026-07-07_53d31c97419f12f52adc543c04236263_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	89
PID 5896 wrote to memory of 2404	5896	iexplore.exe	90
PID 2404 wrote to memory of 2492	2404	msedge.exe	91
PID 2404 wrote to memory of 3348	2404	msedge.exe	93
PID 2404 wrote to memory of 5488	2404	msedge.exe	95
PID 2404 wrote to memory of 5488	2404	msedge.exe	95
PID 2404 wrote to memory of 4628	2404	msedge.exe	96
PID 2404 wrote to memory of 5604	2404	msedge.exe	144
PID 2404 wrote to memory of 4628	2404	msedge.exe	96
PID 2404 wrote to memory of 4628	2404	msedge.exe	96
PID 2404 wrote to memory of 5604	2404	msedge.exe	144
PID 2404 wrote to memory of 5604	2404	msedge.exe	144
PID 2404 wrote to memory of 1112	2404	msedge.exe	94
PID 2404 wrote to memory of 1112	2404	msedge.exe	94
PID 2404 wrote to memory of 1112	2404	msedge.exe	94
PID 2404 wrote to memory of 2088	2404	msedge.exe	98
PID 2404 wrote to memory of 3152	2404	msedge.exe	99
PID 2404 wrote to memory of 2088	2404	msedge.exe	98
PID 2404 wrote to memory of 2088	2404	msedge.exe	98
PID 2404 wrote to memory of 3152	2404	msedge.exe	99
PID 2404 wrote to memory of 3152	2404	msedge.exe	99
PID 2404 wrote to memory of 4788	2404	msedge.exe	149
PID 2404 wrote to memory of 4788	2404	msedge.exe	149
PID 3704 wrote to memory of 6000	3704	jdbwtomgeywqojgb.exe	102
PID 5712 wrote to memory of 4436	5712	igeywigbyw.exe	105
PID 2404 wrote to memory of 2808	2404	msedge.exe	110
PID 2404 wrote to memory of 3564	2404	msedge.exe	111
PID 2404 wrote to memory of 2808	2404	msedge.exe	110
PID 2404 wrote to memory of 3564	2404	msedge.exe	111
PID 2404 wrote to memory of 2668	2404	msedge.exe	113
PID 2404 wrote to memory of 3356	2404	msedge.exe	143
PID 2404 wrote to memory of 3356	2404	msedge.exe	143
PID 2404 wrote to memory of 2824	2404	msedge.exe	117
PID 2404 wrote to memory of 2824	2404	msedge.exe	117
PID 3704 wrote to memory of 848	3704	jdbwtomgeywqojgb.exe	119
PID 3704 wrote to memory of 5584	3704	jdbwtomgeywqojgb.exe	123
PID 856 wrote to memory of 208	856	vtnlgaysql.exe	125
PID 3704 wrote to memory of 1396	3704	jdbwtomgeywqojgb.exe	128
PID 3704 wrote to memory of 2612	3704	jdbwtomgeywqojgb.exe	132
PID 2716 wrote to memory of 4212	2716	kifavsqnif.exe	134
PID 3704 wrote to memory of 4036	3704	jdbwtomgeywqojgb.exe	137
PID 3704 wrote to memory of 5992	3704	jdbwtomgeywqojgb.exe	142
PID 3356 wrote to memory of 5604	3356	pnhfaxsnhf.exe	144
PID 3704 wrote to memory of 4484	3704	jdbwtomgeywqojgb.exe	147
PID 2404 wrote to memory of 4788	2404	msedge.exe	149
PID 2404 wrote to memory of 1204	2404	msedge.exe	150
PID 2404 wrote to memory of 2240	2404	msedge.exe	151
PID 3704 wrote to memory of 2040	3704	jdbwtomgeywqojgb.exe	154
PID 4128 wrote to memory of 360	4128	hfzxrpnhcz.exe	156
PID 3704 wrote to memory of 1588	3704	jdbwtomgeywqojgb.exe	159
PID 3704 wrote to memory of 5828	3704	jdbwtomgeywqojgb.exe	163
PID 980 wrote to memory of 1364	980	jhczurpmke.exe	165
PID 3704 wrote to memory of 4056	3704	jdbwtomgeywqojgb.exe	168
PID 3704 wrote to memory of 4228	3704	jdbwtomgeywqojgb.exe	172
PID 5768 wrote to memory of 5456	5768	mjebwuomje.exe	174
PID 3704 wrote to memory of 2224	3704	jdbwtomgeywqojgb.exe	177
PID 3704 wrote to memory of 612	3704	jdbwtomgeywqojgb.exe	181
PID 2256 wrote to memory of 1176	2256	wuomgeywro.exe	183
PID 3704 wrote to memory of 5948	3704	jdbwtomgeywqojgb.exe	186
PID 2404 wrote to memory of 1308	2404	msedge.exe	188
PID 2404 wrote to memory of 1308	2404	msedge.exe	188
PID 3704 wrote to memory of 4084	3704	jdbwtomgeywqojgb.exe	194
PID 108 wrote to memory of 752	108	eywqoigbyt.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-07-07_53d31c97419f12f52adc543c04236263_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-07_53d31c97419f12f52adc543c04236263_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4180
- C:\Temp\jdbwtomgeywqojgb.exe
  C:\Temp\jdbwtomgeywqojgb.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3704
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\igeywigbyw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6000
  - - C:\Temp\igeywigbyw.exe
      C:\Temp\igeywigbyw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5712
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4436
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4452
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_igeywigbyw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:848
  - - C:\Temp\i_igeywigbyw.exe
      C:\Temp\i_igeywigbyw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1308
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtnlgaysql.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5584
  - - C:\Temp\vtnlgaysql.exe
      C:\Temp\vtnlgaysql.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:856
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:208
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2884
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtnlgaysql.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1396
  - - C:\Temp\i_vtnlgaysql.exe
      C:\Temp\i_vtnlgaysql.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4780
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kifavsqnif.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2612
  - - C:\Temp\kifavsqnif.exe
      C:\Temp\kifavsqnif.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2716
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4212
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4616
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kifavsqnif.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4036
  - - C:\Temp\i_kifavsqnif.exe
      C:\Temp\i_kifavsqnif.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4784
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pnhfaxsnhf.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5992
  - - C:\Temp\pnhfaxsnhf.exe
      C:\Temp\pnhfaxsnhf.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3356
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5604
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1256
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pnhfaxsnhf.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4484
  - - C:\Temp\i_pnhfaxsnhf.exe
      C:\Temp\i_pnhfaxsnhf.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3440
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hfzxrpnhcz.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2040
  - - C:\Temp\hfzxrpnhcz.exe
      C:\Temp\hfzxrpnhcz.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4128
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:360
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5804
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hfzxrpnhcz.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1588
  - - C:\Temp\i_hfzxrpnhcz.exe
      C:\Temp\i_hfzxrpnhcz.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3084
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jhczurpmke.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5828
  - - C:\Temp\jhczurpmke.exe
      C:\Temp\jhczurpmke.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:980
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1364
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5960
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jhczurpmke.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4056
  - - C:\Temp\i_jhczurpmke.exe
      C:\Temp\i_jhczurpmke.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4616
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mjebwuomje.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4228
  - - C:\Temp\mjebwuomje.exe
      C:\Temp\mjebwuomje.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5768
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5456
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5744
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mjebwuomje.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2224
  - - C:\Temp\i_mjebwuomje.exe
      C:\Temp\i_mjebwuomje.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4932
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wuomgeywro.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:612
  - - C:\Temp\wuomgeywro.exe
      C:\Temp\wuomgeywro.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2256
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1176
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1468
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wuomgeywro.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5948
  - - C:\Temp\i_wuomgeywro.exe
      C:\Temp\i_wuomgeywro.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2812
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\eywqoigbyt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4084
  - - C:\Temp\eywqoigbyt.exe
      C:\Temp\eywqoigbyt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:108
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:752
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2808
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_eywqoigbyt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2856
  - - C:\Temp\i_eywqoigbyt.exe
      C:\Temp\i_eywqoigbyt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2780
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tqoigbykid.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1700
  - - C:\Temp\tqoigbykid.exe
      C:\Temp\tqoigbykid.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:620
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5128
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5972
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tqoigbykid.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4360
  - - C:\Temp\i_tqoigbykid.exe
      C:\Temp\i_tqoigbykid.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3984
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ifdxvtqlid.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3576
  - - C:\Temp\ifdxvtqlid.exe
      C:\Temp\ifdxvtqlid.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2636
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2324
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5452
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ifdxvtqlid.exe ups_ins
    3⤵
    PID:2420
  - - C:\Temp\i_ifdxvtqlid.exe
      C:\Temp\i_ifdxvtqlid.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4804
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xsqkicavsn.exe ups_run
    3⤵
    PID:1244
  - - C:\Temp\xsqkicavsn.exe
      C:\Temp\xsqkicavsn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1784
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2524
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5156
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xsqkicavsn.exe ups_ins
    3⤵
    PID:4060
  - - C:\Temp\i_xsqkicavsn.exe
      C:\Temp\i_xsqkicavsn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5484
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\causmkhcau.exe ups_run
    3⤵
    PID:2668
  - - C:\Temp\causmkhcau.exe
      C:\Temp\causmkhcau.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5692
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2580
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1304
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_causmkhcau.exe ups_ins
    3⤵
    PID:2836
  - - C:\Temp\i_causmkhcau.exe
      C:\Temp\i_causmkhcau.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5668
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kfcxjhfzur.exe ups_run
    3⤵
    PID:1928
  - - C:\Temp\kfcxjhfzur.exe
      C:\Temp\kfcxjhfzur.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2336
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3368
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3840
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kfcxjhfzur.exe ups_ins
    3⤵
    PID:1552
  - - C:\Temp\i_kfcxjhfzur.exe
      C:\Temp\i_kfcxjhfzur.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5888
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ecwurmkecw.exe ups_run
    3⤵
    PID:4932
  - - C:\Temp\ecwurmkecw.exe
      C:\Temp\ecwurmkecw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3944
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2272
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2116
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ecwurmkecw.exe ups_ins
    3⤵
    PID:3332
  - - C:\Temp\i_ecwurmkecw.exe
      C:\Temp\i_ecwurmkecw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4308
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rojhbztrlj.exe ups_run
    3⤵
    PID:2764
  - - C:\Temp\rojhbztrlj.exe
      C:\Temp\rojhbztrlj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5228
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4760
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2892
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rojhbztrlj.exe ups_ins
    3⤵
    PID:2812
  - - C:\Temp\i_rojhbztrlj.exe
      C:\Temp\i_rojhbztrlj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1160
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jdbvtrljdb.exe ups_run
    3⤵
    PID:2512
  - - C:\Temp\jdbvtrljdb.exe
      C:\Temp\jdbvtrljdb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2780
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1152
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2520
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jdbvtrljdb.exe ups_ins
    3⤵
    PID:6064
  - - C:\Temp\i_jdbvtrljdb.exe
      C:\Temp\i_jdbvtrljdb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5432
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbvtodywqo.exe ups_run
    3⤵
    PID:5324
  - - C:\Temp\dbvtodywqo.exe
      C:\Temp\dbvtodywqo.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3540
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5644
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4524
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbvtodywqo.exe ups_ins
    3⤵
    PID:5844
  - - C:\Temp\i_dbvtodywqo.exe
      C:\Temp\i_dbvtodywqo.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2676
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qoigayvqoi.exe ups_run
    3⤵
    PID:1764
  - - C:\Temp\qoigayvqoi.exe
      C:\Temp\qoigayvqoi.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5664
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2824
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3932
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qoigayvqoi.exe ups_ins
    3⤵
    PID:4076
  - - C:\Temp\i_qoigayvqoi.exe
      C:\Temp\i_qoigayvqoi.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2368
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffab23ac188,0x7ffab23ac194,0x7ffab23ac1a0
      4⤵
      PID:2492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2172,i,12044172292839535094,7491145140925568996,524288 --field-trial-handle=2540,i,7843856098608871595,11453693908357565510,262144 --variations-seed-version --mojo-platform-channel-handle=2928 /prefetch:11
      4⤵
      System Time Discovery
      PID:3348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1976,i,6997917827573708716,7156011715495750689,262144 --field-trial-handle=2540,i,7843856098608871595,11453693908357565510,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:2
      4⤵
      PID:1112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2564,i,4890142387924191487,9425990003846728756,524288 --field-trial-handle=2540,i,7843856098608871595,11453693908357565510,262144 --variations-seed-version --mojo-platform-channel-handle=3272 /prefetch:13
      4⤵
      PID:5488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,16969240068120180559,5717922410340739450,2097152 --field-trial-handle=2540,i,7843856098608871595,11453693908357565510,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
      4⤵
      PID:4628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,2805567231734149155,15196673596455704933,2097152 --field-trial-handle=2540,i,7843856098608871595,11453693908357565510,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
      4⤵
      PID:5604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,9627987012053407282,12481265521585730749,2097152 --field-trial-handle=2540,i,7843856098608871595,11453693908357565510,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:1
      4⤵
      PID:2088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,1137567344495283906,13047843937593000013,2097152 --field-trial-handle=2540,i,7843856098608871595,11453693908357565510,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:9
      4⤵
      PID:3152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,11858981445641921263,10524621405219618152,524288 --field-trial-handle=2540,i,7843856098608871595,11453693908357565510,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:14
      4⤵
      PID:4788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,18327028957611181072,6400543011814248304,524288 --field-trial-handle=2540,i,7843856098608871595,11453693908357565510,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:14
      4⤵
      PID:2808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5508,i,11596845951291716423,15151757432500755606,524288 --field-trial-handle=2540,i,7843856098608871595,11453693908357565510,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:14
      4⤵
      PID:3564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,2780344604631882772,4302140547812380749,524288 --field-trial-handle=2540,i,7843856098608871595,11453693908357565510,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:14
      4⤵
      PID:3776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,2780344604631882772,4302140547812380749,524288 --field-trial-handle=2540,i,7843856098608871595,11453693908357565510,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:14
      4⤵
      PID:2668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,2296164982071076802,5953428136654881798,524288 --field-trial-handle=2540,i,7843856098608871595,11453693908357565510,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:14
      4⤵
      PID:3356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6652,i,6708674154847853328,7879856914544448864,524288 --field-trial-handle=2540,i,7843856098608871595,11453693908357565510,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:14
      4⤵
      PID:2824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1312,i,16315457693066608759,15859477950217344596,524288 --field-trial-handle=2540,i,7843856098608871595,11453693908357565510,262144 --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:14
      4⤵
      PID:4788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1316,i,12933533468711708119,7310623148971072369,524288 --field-trial-handle=2540,i,7843856098608871595,11453693908357565510,262144 --variations-seed-version --mojo-platform-channel-handle=1436 /prefetch:14
      4⤵
      PID:1204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4216,i,5131018494365318860,17639819004329943355,524288 --field-trial-handle=2540,i,7843856098608871595,11453693908357565510,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:14
      4⤵
      PID:2240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5748,i,2373710163980467313,5504481935619774596,524288 --field-trial-handle=2540,i,7843856098608871595,11453693908357565510,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:14
      4⤵
      PID:1308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2772,i,14360332456457153735,17456078710814418640,524288 --field-trial-handle=2540,i,7843856098608871595,11453693908357565510,262144 --variations-seed-version --mojo-platform-channel-handle=1252 /prefetch:14
      4⤵
      PID:3368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4960,i,830018504779730855,8544299102946829742,524288 --field-trial-handle=2540,i,7843856098608871595,11453693908357565510,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:14
      4⤵
      PID:4560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,18294343516266589855,4652842940313994606,524288 --field-trial-handle=2540,i,7843856098608871595,11453693908357565510,262144 --variations-seed-version --mojo-platform-channel-handle=2772 /prefetch:14
      4⤵
      PID:4504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6188,i,16176597879373845785,10185169965617820525,262144 --field-trial-handle=2540,i,7843856098608871595,11453693908357565510,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:10
      4⤵
      PID:3456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6628,i,829521562243758804,13933629853410314604,524288 --field-trial-handle=2540,i,7843856098608871595,11453693908357565510,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
      4⤵
      PID:5424

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5452

C:\Temp\jdbwtomgeywqojgb.sys
C:\Temp\jdbwtomgeywqojgb.sys
1⤵
- Executes dropped EXE
PID:4252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3640

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2768

C:\Temp\gaytqlidbv.sys
C:\Temp\gaytqlidbv.sys
1⤵
- Executes dropped EXE
PID:5948

C:\Temp\nlfdavsnli.sys
C:\Temp\nlfdavsnli.sys
1⤵
- Executes dropped EXE
PID:4736

C:\Temp\snkfcxvpnk.sys
C:\Temp\snkfcxvpnk.sys
1⤵
- Executes dropped EXE
PID:5456

C:\Temp\xvpnkfcaxs.sys
C:\Temp\xvpnkfcaxs.sys
1⤵
- Executes dropped EXE
PID:2892

C:\Temp\pmhecxusmk.sys
C:\Temp\pmhecxusmk.sys
1⤵
- Executes dropped EXE
PID:4700

C:\Temp\omkecwurmj.sys
C:\Temp\omkecwurmj.sys
1⤵
- Executes dropped EXE
PID:4520

C:\Temp\rljgeywtol.sys
C:\Temp\rljgeywtol.sys
1⤵
- Executes dropped EXE
PID:2636

C:\Temp\trljgbywro.sys
C:\Temp\trljgbywro.sys
1⤵
- Executes dropped EXE
PID:1512

C:\Temp\tqoigaytql.sys
C:\Temp\tqoigaytql.sys
1⤵
- Executes dropped EXE
PID:3152

C:\Temp\ligaysqkig.sys
C:\Temp\ligaysqkig.sys
1⤵
- Executes dropped EXE
PID:4932

C:\Temp\vsqkicaxsq.sys
C:\Temp\vsqkicaxsq.sys
1⤵
PID:1040

C:\Temp\kicspnhfzx.sys
C:\Temp\kicspnhfzx.sys
1⤵
PID:2480

C:\Temp\khczxrpkhf.sys
C:\Temp\khczxrpkhf.sys
1⤵
PID:616

C:\Temp\ezxrpmkecw.sys
C:\Temp\ezxrpmkecw.sys
1⤵
PID:1472

C:\Temp\wromjecwuo.sys
C:\Temp\wromjecwuo.sys
1⤵
PID:796

C:\Temp\omgebomgeb.sys
C:\Temp\omgebomgeb.sys
1⤵
PID:1724

C:\Temp\geywqolgey.sys
C:\Temp\geywqolgey.sys
1⤵
PID:3248

C:\Temp\nlidavtnli.sys
C:\Temp\nlidavtnli.sys
1⤵
PID:3616

C:\Temp\yvpnlfdays.sys
C:\Temp\yvpnlfdays.sys
1⤵
PID:5720

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

gaytqlidbv.sys

Path C:\Temp\gaytqlidbv.sys
Size 293KB
SHA256 7e66d621cd91cfea9c5acca716632d405f401e7c86f7e3bae395ca1e2a386fc6
MD5 fd6124cc54f2d96541e3171c48622619
SHA1 ecbfd8c6e9c4c593c6b0385742a21e5aed822fe5
SHA512 13fcd8682b49684d6fd9bad7ed19859dd477ab7929ef5eb47824fbb7ba0a4217f24703e4823dd17a8923fc67422b9a036db71ad10d73773396b69b8f20109655
SSDEEP 3072:WtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:WIJjiJcbI03GBc3ucY5DCSj
TLSH
T138545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfzxrpnhcz.exe

Path C:\Temp\hfzxrpnhcz.exe
Size 365KB
SHA256 d0c50f3b0e2433040489d177a39d75f4eb3a4dd95ed715f067b55d5ae9c90b55
MD5 9c7eca2f9467c35b327b78e412be8d56
SHA1 97611da8ba2d141af424ae83ef22b68835c7a5b1
SHA512 ceed9dd08ce41f8c64d65005b5bcc38d2a2d095f405f8f7b8987f9fd4c92df7275e98210acbf727e1f7484ee31771bb36920eba629a2a58092095226ed714699
SSDEEP 3072:Auxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:AuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T189847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hfzxrpnhcz.exe

Path C:\Temp\i_hfzxrpnhcz.exe
Size 365KB
SHA256 35e924bc325999b2b8c32bf288890862b9cd05c2d91174f45375d793ca549229
MD5 ceae1ac1fe0df320d510e9070ddc4854
SHA1 d4a02fcd56bad23b9e061cdd4c4b739745bb7fa5
SHA512 1565461241ff02f372dfa1bfca2849bf2be69f174a2099c550580bb093ca64bbf4af3b1ae83cb131f8433b2ab061dff7af0a3debd51fa1c26b907231abbe658e
SSDEEP 3072:6uxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:6uxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C5847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_igeywigbyw.exe

Path C:\Temp\i_igeywigbyw.exe
Size 365KB
SHA256 a0227dd7385f0d1635abda6cb1bdfb8a4ff0acd1d751f425b1482a98ccf3c8a0
MD5 80035a8215e99078d0d0334f016aebfe
SHA1 17cbebb7a2417d038d5a23a375fbe6523bb3f083
SHA512 edf09aa8ea200b949a63ab6d0d8664f8b3961a47cc7024c4f509f60ed6eb7ef8531bb7579986134841b17b663190174eb5de2b10ba07f580c127a775af30bbe8
SSDEEP 3072:Nuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:NuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T14D847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_kifavsqnif.exe

Path C:\Temp\i_kifavsqnif.exe
Size 365KB
SHA256 688ffc641b0d9fef67dfb01059f0d4b705646fdf6559e8e56249c46e44ea6d3b
MD5 a7174fd79edc35891bb89e70840752a4
SHA1 73855755a0acb8ade720ec13db2b570c30d7edd3
SHA512 c450df1a995471ce039da3f419c72c1fdf9db43ffb5d43af6b6704413478ba8dc72cf8e1abb631a899b151883696fc00121ba1a8f333209766e195a3dc49c2c5
SSDEEP 3072:2uxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:2uxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A4847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pnhfaxsnhf.exe

Path C:\Temp\i_pnhfaxsnhf.exe
Size 365KB
SHA256 3bd2172b7ad872f33273e545cbbf2aa13d7c34e72f18d911b065d297603b81d1
MD5 fd6e64df48aa61026e6c2418ef2ebc3e
SHA1 39e40d4852f3e2a39c3b4626628b3f42d67f3533
SHA512 78c46d0943bf8bcc81d84ae523ed2dc67b7d0d1945a25391e82c22d228710e860cb0cd6f87d823a0b76b35bb9414921cb5c454d2851c1a5d4616a03c21c351a2
SSDEEP 3072:quxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:quxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T13C847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vtnlgaysql.exe

Path C:\Temp\i_vtnlgaysql.exe
Size 365KB
SHA256 836adc43fa74a581cae4baab2b2c5776b638aafa65a3b5564a582237ad46171b
MD5 4b072b66ed940603de3004840b220dfc
SHA1 09e292bdd0c9c9fc6edf5e1cb2c57d86162afd81
SHA512 c31bde3600f05d893ff5ed6e8f95df5b493f2b12e661a2d32db61ba505b4f8dfe014face480166cc4ab3a4c4b3e70e76a8f10bd7c1c0ad8c0d4205598e31b225
SSDEEP 3072:Yuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:YuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C1847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igeywigbyw.exe

Path C:\Temp\igeywigbyw.exe
Size 365KB
SHA256 d07e0b33cdd9ab01c88c39bdf763c7fd574f6b3ed071059da5e6fb9b2293a79c
MD5 f2f703ac35a283a71e3da3dc91d02563
SHA1 6b430f6b0cdcabd6e8ca0de54df806114bbb5913
SHA512 bb1a9967dd4161d08f8cec23b3f9e5e9d751cae0963d5dd76f8c167fb25a0ad81b3616c4004e04f197dc41e1dc280f7e9a123c415b22b0e30c17539d437100dd
SSDEEP 3072:huxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:huxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T152847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdbwtomgeywqojgb.exe

Path C:\Temp\jdbwtomgeywqojgb.exe
Size 365KB
SHA256 1f2851d3fbc005f1bb44c4b8c81f506b78825b3835899b1c1d987ae8ab156163
MD5 eef6f8385fe006731d4b42eb5ade05d9
SHA1 19a753b0c637d5794f8543935c333b6a39792aa3
SHA512 3ab94fe30d8bffdb9ac11b701e4e7f2b6c6382240ceac27bfe4c5014172b52736e62c90a65733d4ec5b6b5cd9d4d6cfba9d1ffe560581dedbb9b2caa4929611c
SSDEEP 3072:Vuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:VuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T131847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdbwtomgeywqojgb.sys

Path C:\Temp\jdbwtomgeywqojgb.sys
Size 293KB
SHA256 005fb5a272d20bfb2d1883640c8429e2e18ef20c1eecb47d57b634cc09ebbce6
MD5 42e372e92fb5690df7060dff8e53fc57
SHA1 3aa05a7141e5353f61fd9017a24883c87a10a459
SHA512 5c1f18cb2f1608e892ee379d80a05847337e308d15789aa5062a2c6074943c4e670bb3cc064be4a278832c64533b04f32fc4088b86e7a22bfc31fa037fe2072c
SSDEEP 3072:5tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:5IJjiJcbI03GBc3ucY5DCSj
TLSH
T1FD545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhczurpmke.exe

Path C:\Temp\jhczurpmke.exe
Size 365KB
SHA256 366bf390307dc29a3287f39726359a1b646ca48ed71f07b4305110f8408c6c11
MD5 0de7978dca626a06add0e6605b71eaad
SHA1 41e9cafd124081a861e8c54dd0e78e0843da0c61
SHA512 8c82b0c5683c8bb3fd7d5232a624428c29e5e148572cbe8bb9017ed8f77a5514380343524dd384122811cf42dc0f9ed5a4c2f253e4729a06b200d986c77debf0
SSDEEP 3072:Auxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:AuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D0847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kifavsqnif.exe

Path C:\Temp\kifavsqnif.exe
Size 365KB
SHA256 124596e95de6fab1387e386cf61f43257f49e0bdd56ed81196a0fc2f98c39437
MD5 67eca23263e73c874e8fdf4aabeefdfd
SHA1 620f1dd814a924fde47dfc0d6f4e9d45aabc2955
SHA512 84070f62c7cd72967962e80efa6745372b95bd5dd9fdd28ca50f7c675ae8d72fbc3b919d0591434ab4c050b6f7b01f0196c62edefca0c03c26cecd574f999c54
SSDEEP 3072:Luxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:LuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E1847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlfdavsnli.sys

Path C:\Temp\nlfdavsnli.sys
Size 293KB
SHA256 c64e0d258bdf2249af2ce733217d9f347dedb92ba4e2fe93287784e26254f5a7
MD5 bb577698e39dcda079191fb5b8705f95
SHA1 dc88afb155ab562132303c778386ec3b7b5492d1
SHA512 fd3c2d81bcc7b20c38330c4439c42815764274cfe39684bb364061f3b9cc896a6ac11f6f01466c2d9f643172ed54ab01b99b34773d805c66d6e4e71a5b626daf
SSDEEP 3072:ntKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:nIJjiJcbI03GBc3ucY5DCSj
TLSH
T10D545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmhecxusmk.sys

Path C:\Temp\pmhecxusmk.sys
Size 293KB
SHA256 7749752e9c451f7656f3f45b8da7c5ff3d6ead60716798041f2a535b5191d440
MD5 80354dd0b0c12fe5d213c8c7e64b4cd0
SHA1 397909e367c1b8cdada9a53d778a0b14b83354f6
SHA512 3a62a5d357870db9b2ba18ffa3ee2091712d50a399374545fe4b8b60d402fa254d27c7b19409cd0c7f62ceaa0d2119e453f2110918711274c6d9a64371af56af
SSDEEP 3072:UtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:UIJjiJcbI03GBc3ucY5DCSj
TLSH
T1C6545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnhfaxsnhf.exe

Path C:\Temp\pnhfaxsnhf.exe
Size 365KB
SHA256 ab755baab3d5559b6dc6e962c0e9492b7ab14cba96c8aeb22500ab174b5e01fa
MD5 c1d124cf7963b0a1fd945f36c2c0e310
SHA1 4169513995076a3b7a761c53a48167287843e00a
SHA512 6054d25398811543b1e99cddc4603c743566ef65e3e40b5b6a05558d6374f4f93c267c279166753de3d2ab526ddb5f41fcae2fc0abb3b0aa98cc688f6796c3a9
SSDEEP 3072:fuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:fuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C5847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snkfcxvpnk.sys

Path C:\Temp\snkfcxvpnk.sys
Size 293KB
SHA256 05198226feafb028dc220c6988d6d93ccbf5cc74e67c7aa0f1c2897423bb9a21
MD5 19cce7b6b7e794f882e50e2f631c6451
SHA1 9bbb5f108357bb738aa30490accba0857b790f21
SHA512 b497c85caf0cc84c0e68ba1f785096aa52d17d00ebf30333bb1587843a7df89ced61172a214d298e845265b262b2c3cc2fdaec9364149d509df43747aa3baa32
SSDEEP 3072:wtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:wIJjiJcbI03GBc3ucY5DCSj
TLSH
T16D545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtnlgaysql.exe

Path C:\Temp\vtnlgaysql.exe
Size 365KB
SHA256 19e43a54b85f8c1a8a52be0b23ce9069d53ae31c8920c2db01dae36b5af2cd14
MD5 c9751d0134f9b804e306ba35eca41c01
SHA1 f99be1ced8b92d69e275d816c1f69ff5830eee5b
SHA512 4f4245bb290432402989945b137f96f087c77738969d60c57e5a3b6a8ce9d7f7ca165612bebfc32d7f1e65d7283fa9b71adb7839b8c60352d44d1526f0763020
SSDEEP 3072:Quxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:QuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T139847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvpnkfcaxs.sys

Path C:\Temp\xvpnkfcaxs.sys
Size 293KB
SHA256 bbf0ddcf2c6b668858f1f334fecc2dc4602ec6ba45c47e6a69064e57d1d7059e
MD5 4a2548e3d43f5d7b37b7170c09d17c14
SHA1 a354b2dfee41da84059a539d0d5b62ea3f75f7e1
SHA512 1a9cb205610811ab5e69871a0ab4ef69a4384f45496916946dd56278f387dc512bdc3cdeb7f2fa85d17a6f98b9b029d1d07b7553e573b8049f1d9fceea14397f
SSDEEP 3072:HtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:HIJjiJcbI03GBc3ucY5DCSj
TLSH
T15E545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b2d903efec8d558eba6ee4ac12873ce1439014705e9d819ff4dfcffa10c4b270
MD5 d9964ad138b9b56ea7891b8576b8a6ce
SHA1 e8153c0a553b8b81a07f1bbc77037f1700b79956
SHA512 7028c8597edeb715bb44be72ae48ceb181161e73b5380897f449df22a8c2b5302f664d632f2373c4c7a712d85a4b0ca70a4a062d6af265eefcac45dd99a660f1
TLSH
T1FCD092A4BB40EC0ECA91287B25B69A19B6409831BC56061A8966B0F88C517831A1B0EE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c1d0eccd9de1dbbf6cbedcb541fa52903c78d66d4d260136bc73243b056beb74
MD5 12c06f300a4b88646d6fda378a48455e
SHA1 86d58840d0666ad8999198dad1983a8cfd61fd18
SHA512 76e813720fc8cd4d829570b1b32d711d2d751540dea1fcac581dd9a5963c4e3161cffa07350cc8d5477fa02d0eb7b1c29b8ffb567f85b5a94259654ff2af3928
TLSH
T118D092A8BB40ED0ECA91287B25B59A19B6509831FC56061A8866B0E88C517831A1B0FE
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 5a0f5a39fd6b9a62d404bd1dedb5d68f53994a323e53b097031aa5dd386c7b1a
MD5 40eace073787b3972a0507f3ecc73c76
SHA1 1689e55a672dc8389eac004e9bed5ae8ea0a7d03
SHA512 d6d297fe3e85044c818fc8abbdbfd7817c0f17a4f57e7e8d07d610bd4a53741bfb276bf7b669423627894b5af4f5db6f6b029f6e8a63e9035a4e429f024191fe
TLSH
T12D3187B883AE2EC2CB6049B1F3D2129F36389CD922C7AE150D44E07848F6B44541303C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 b13b7180c2f8b3a31f7a1d1329b965babe801499e3cc39115510e2a3ea8eab3c
MD5 a159f6aeb2b71a57c6915ae6a538d8b1
SHA1 3b99ba77f3f9bd0b1746b83075c6f9cda441b9d1
SHA512 43a05d49a576e7415b281db7d32a9377d77c7f0785f40812a556601d02596eeb4d764d57e07f405d99e22e811962988dd8ac17f735482adfb6d9bbf86aa05849
TLSH
T13D41BDF3C3E4856E890196F4AA187E2FCE1D0915432C3D5AC9E4EF5B93E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 b3ed3182a19e0d0b7fc97d913dfd0c9949c7caacc527bdffe977462769262a7b
MD5 2a2aaf3cd407c1f7a0f8e17d439a4051
SHA1 67b2ce3eeb4b25bb37af285f2ff3ea979b28ec71
SHA512 5d2873520591d1e465abf324f3677227e6d4249f3c3eaff0489421796947fd3788d91bd7647e7b04ee281f9ce6ef2d3298c5bad253a1dd0ec6d314c31549a2fd
SSDEEP 192:sxRXRtyM/jK1Ml8wCk/f5sA11kZhruzoA8p9UI/g6+WNCU5o0Z/YnkctnG7aIgtJ:sxRXN8k/f5sADalTaI/5bq0Z/XcI63
TLSH
T1BE62D8166A3499779CDBD309FA517F53D6F81472E2901E44AAFCCA1C01E7ADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 b13e4f73106b6948fafe46da32c022394430117e34837e5fdb1da92fa2ce79d9
MD5 efa7472d63c0df116af811767d99bb0c
SHA1 4d67fb51cc4dda6778b71d2b0dc112d32ddcd8b7
SHA512 652a8dbf0567e61763117a8d0427a090ea5d6a1c308c260da36f19b41f91d090a7c9c6530a7606838078452ab1e95352c04e43c63e45b543de3ddbc51de3e736
SSDEEP 192:sxRwRtyM/jK1Ml8UQGcCk/f5s41HkZhruzoA8prUI/g6+WNCU5o0Z/YnkZtnG7a0:sxRwNqIk/f5s4JalTII/5bq0Z/XzI60
TLSH
T17062C9166A3459779CDBD309FA51BF53D6F81472E2901E44AAFCCA1C01E76DD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 6a4cb8a61326fedc3c6c2667bc5e08db508bc7ddb0a2f8e2d845f5e0366e4d1b
MD5 9d955f0b54bbcf1747746bc066a46550
SHA1 c4f9c75010161359b8d54b1a4d4cac398f1e3176
SHA512 d0f91e048380ed0f1836cbbf0f767c0bf1ce8ec3c326c0aa72e47e9e7e44ce831cf8c3faea66a6b0d07fca1c11395af1d6e21fb09441af1756d050ddb50663a3
SSDEEP 192:sxRwRtyM/jK1Ml8wCk/f5s411kZhruzoA8p9UI/g6+WNCU5o0Z/YnkctnG7aIgD2:sxRwN8k/f5s4DalTaI/5bq0Z/XcI6q
TLSH
T1F262D8166A3499779CDBD309FA51BF53D6F81472E2901E44AAFCCA1C01E7ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 ac8b6ec1e72e7e58f43c860a3e5adf3d5ee3828e06fe41ad4b26667b00669af2
MD5 f93704f3a863b5a12c398d2bf5165002
SHA1 d82f72eb505aaf24051b36fd86c8ef785c3057fd
SHA512 a99fd9ee5832916e639e8fc74c4799164a98180f64534b96d7a9a2ca90cd3724c2db3fedd04ba765f7e5407202e465113a7647353a95af19ec58a25499253c4f
SSDEEP 768:Jl6hhs7pLuL7b2WgqcfHw8F1+UoAYDCx9Tuqh0VfUC9xbog/OVan3XguProM/VBY:Jl6hhQE7b2WgqcfHwu1jaRn3QucM/4
TLSH
T1A8E2DB3B780CCB7E4F804A9CEC29798A6DE801CB96D8CD5447FA994C03C66EB511B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 c5549acceb9c5ab5fe803934c6621e2d4debb9fac51ffeb3af89f87b9d04c755
MD5 91ae437890a89e279debd2e849cd9691
SHA1 4c4794f5f92aa62c5bb0d3333a48ed913fa2e9c5
SHA512 d7b013353d37b46b6fd469d07db2ee22b9f462e7e738a1a60d76d63c83699babb8fb5fa7ad427d18436d9a15bda858e704be840e17ac36fb342cbeeaed063170
SSDEEP 96:KRFSr/VPTXWbAOgHXK42gZXc9lYrj8HLURlTp5FWtC4gNFK40gjFcrzKtZoRrR6y:CFSr/VPTmbAvHN2gZM9lYrj8HLURlTpY
TLSH
T10E914445747B06803C3E395990558967A2C27072311EB8BFBBA912F21F67E029DFF8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

334dbb7f-3a46-4655-8f32-d25fb9d93b70.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\334dbb7f-3a46-4655-8f32-d25fb9d93b70.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 2da60b82cb26f9717ee1f4494d355e3fc2d77d7bb1bf2d01928d6f13e5d76576
MD5 328c3a7faaf0b32a6ed2d5f9ed962eb6
SHA1 fef30f6de7be6a33c83d13d28f260aab0fc1d08c
SHA512 09b6a54b609e4af5ff1bbba42f67d50987610fb5d502dec365fd04174e8aa2f1e113810c68e3e934ee5e2e18bf7e99d2c7d02ca3f2486fa3101bec9e29232476
SSDEEP 768:Vrv+4UNbda3wmYreNSLfLfyX7DGFzoqPcNMCNZseVH1SkM:Vbsb430pfLfy3WkqPauEH1Y
TLSH
T17C03BFB5A8B445374CE3C685B74B3A177FF4025356840B94D8ED2F0E879F5AD130BA2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 f08c4ab351d6faebdfee8aae96bcdffe2b7af1f830bba3e20ba266ec418dcae3
MD5 1abe906fab86b7fcb0086d099fdaacd7
SHA1 f0c12a3beec3cdb82ce5bdc8706fa4b6dd3303d6
SHA512 14af647f7f89b743cd0688eebed64c76f92499fcecfcf917165dfb809f913771c68d95345c1138357d1b320840ae7df40514ba09025d1e7768b166b0ebc4cf9e
SSDEEP 768:uj+9p30JjtYreNSLfLf7fFX7DGFzoqPcNMCNFyb9MG:N9p35pfLf7fF3WkqPa4b+G
TLSH
T1F6F2BFB4EC715D274CE7C289B75B3F4BAEF0066795841F48D8D96F0E468B2AD030792A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 69e40a7822aaf219ca83d25183e01be99b59567bd4cda9e96a7a0f51ae713d39
MD5 e615d23c258fcdc48570b060cb50526e
SHA1 dab332c2fc1ad21016660542445a2d757c8f61af
SHA512 616538ecac72c105c53e29874b2119a45f594074f80a7e09b2d800558852590303a81d3502a24a0b20b7ca8f926976e1e5329df8f3fd889bcadae51441ca76f4
SSDEEP 768:xF1j+9B3swgSJeKVfLf7faX7DGFzoqPcNMCNFyb9MG:Q9B33fLf7fa3WkqPa4b+G
TLSH
T1211318F598E38936D8AE8787A73E2E469EFCC153B5841984BBD41E0DCD871BFC206815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

49492cb3-2720-4145-a5b1-910b8f22fbc9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\49492cb3-2720-4145-a5b1-910b8f22fbc9.tmp
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

60a28b45-fc02-4cc5-8cf6-51d850113d69.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\60a28b45-fc02-4cc5-8cf6-51d850113d69.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2404_1700183583\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 f65f52721ef0a755aa7eee80eb4bfdac85f361805da41ae7037b3b39d20bbb03
MD5 6e5248b0c7893bcd03e1682c492a5a0d
SHA1 22ccb52043cc59f0688e3dedfd807b3a3f2420f4
SHA512 fd6ff5c687a2222c4222ce4f61bf19794f238f8c5949b20b4257e96fab2ac85b2772254d3bde3468a8354d78ea6a22c8b53f70cf7211d00961c2ef16738f5d7b
TLSH
T12E71238357A8D5B3C1DE5BF002835204F6FF223C072370200B91594AEB30A7A64B8F08
MD5 SHA1 SHA512 TLSH

Submit Download

memory/616-438-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/616-416-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/796-449-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1040-392-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1472-437-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1512-338-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1724-470-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2480-412-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2480-433-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2636-323-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2892-281-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3152-343-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3248-474-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3616-486-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3704-500-0x0000000000920000-0x0000000000980000-memory.dmp

Download

memory/4252-70-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4520-319-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4700-294-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4736-244-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4932-372-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5456-269-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5720-504-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5948-197-0x0000000000010000-0x00000000000AB000-memory.dmp

Download