systex | 9deadbb622c791dbda88f9c79dccdb4f82848dfa1cad48c14cc0547f3114410b

Analysis

max time kernel
148s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 12:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_d4e5694813bdb761b24d089a8b57e69b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Size 376KB
Sample260714-pp7xescy3q
SHA256 9deadbb622c791dbda88f9c79dccdb4f82848dfa1cad48c14cc0547f3114410b
MD5 d4e5694813bdb761b24d089a8b57e69b
SHA1 fe3a5e4bec924ef8f8b440063842a44b9fb9dd6a
SHA512 7080fede23d4d97e8db1e071b5013547b02d685f5250640e18339843dc1b4141fd9cc62bac264b712d4726297f4786f1e8d4863edadb693fb93c32224e5ee874
SSDEEP 3072:qViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:qViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T111847C04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
1468	gdyvqoigaytqlidb.exe
4564	gdyvqoigaytqlidb.sys
1488	CreateProcess.exe
2548	dyvtqlgdbv.exe
4800	CreateProcess.exe
836	CreateProcess.exe
2272	i_dyvtqlgdbv.exe
5752	fdxvpnifay.sys
3956	CreateProcess.exe
3936	ysqkidxsqk.exe
5660	CreateProcess.exe
3144	CreateProcess.exe
4336	i_ysqkidxsqk.exe
1548	fdavsmkfcx.sys
4076	CreateProcess.exe
1016	ausmkicxvn.exe
2064	CreateProcess.exe
4808	CreateProcess.exe
4244	i_ausmkicxvn.exe
256	xsmcxupnhf.sys
5904	CreateProcess.exe
2956	cxupjczusm.exe
3748	CreateProcess.exe
2392	CreateProcess.exe
5016	i_cxupjczusm.exe
3676	mhfzxupnhf.sys
5880	CreateProcess.exe
6052	upmhezwrpj.exe
2904	CreateProcess.exe
3460	CreateProcess.exe
3876	i_upmhezwrpj.exe
2036	wrpjhbztrm.sys
4856	CreateProcess.exe
1268	mjcwurmjeb.exe
1316	CreateProcess.exe
2964	CreateProcess.exe
5912	i_mjcwurmjeb.exe
5856	jebwuomgey.sys
5940	CreateProcess.exe
2872	ywrojgbztr.exe
2596	CreateProcess.exe
5056	CreateProcess.exe
692	i_ywrojgbztr.exe
1896	ywqoigaywq.sys
5808	CreateProcess.exe
5804	qoigaytrlj.exe
1964	CreateProcess.exe
3336	CreateProcess.exe
912	i_qoigaytrlj.exe
2912	dyoigaysql.sys
2636	CreateProcess.exe
4264	lfdbvtnlfd.exe
5428	CreateProcess.exe
3592	CreateProcess.exe
2040	i_lfdbvtnlfd.exe
1776	xvqnigaysq.sys
4736	CreateProcess.exe
6044	faysqkicav.exe
2344	CreateProcess.exe
1896	CreateProcess.exe
3580	i_faysqkicav.exe
784	vpnifayspk.sys
1260	CreateProcess.exe
1136	nifaxvpnhf.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 39 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_upmhezwrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ausmkicxvn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigaytrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lfdbvtnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faysqkicav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jebwuomjeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqkidxsqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lidbytqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-14_d4e5694813bdb761b24d089a8b57e69b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dyvtqlgdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ausmkicxvn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigaytrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lfdbvtnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrpkhcaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpjhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gezwrpjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdyvqoigaytqlidb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqkidxsqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywrojgbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxrpkhcaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpjhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gezwrpjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jebwuomjeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywqoigbytr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cxupjczusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjcwurmjeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nifaxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nifaysnkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upmhezwrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywrojgbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nifaxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqoigbytr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lidbytqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dyvtqlgdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxupjczusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjcwurmjeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faysqkicav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nifaysnkic.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5756	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 18 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3676	ipconfig.exe
364	ipconfig.exe
2364	ipconfig.exe
5996	ipconfig.exe
5924	ipconfig.exe
3864	ipconfig.exe
4172	ipconfig.exe
4616	ipconfig.exe
6028	ipconfig.exe
4616	ipconfig.exe
4336	ipconfig.exe
4672	ipconfig.exe
4156	ipconfig.exe
1196	ipconfig.exe
1280	ipconfig.exe
1280	ipconfig.exe
1908	ipconfig.exe
4164	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134285058951326564"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{C90124A2-600C-4F0C-A8BE-1096D91BB1C4}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2108	2026-07-14_d4e5694813bdb761b24d089a8b57e69b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2108	2026-07-14_d4e5694813bdb761b24d089a8b57e69b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2108	2026-07-14_d4e5694813bdb761b24d089a8b57e69b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2108	2026-07-14_d4e5694813bdb761b24d089a8b57e69b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2108	2026-07-14_d4e5694813bdb761b24d089a8b57e69b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2108	2026-07-14_d4e5694813bdb761b24d089a8b57e69b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2108	2026-07-14_d4e5694813bdb761b24d089a8b57e69b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2108	2026-07-14_d4e5694813bdb761b24d089a8b57e69b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2108	2026-07-14_d4e5694813bdb761b24d089a8b57e69b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2108	2026-07-14_d4e5694813bdb761b24d089a8b57e69b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2108	2026-07-14_d4e5694813bdb761b24d089a8b57e69b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2108	2026-07-14_d4e5694813bdb761b24d089a8b57e69b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2108	2026-07-14_d4e5694813bdb761b24d089a8b57e69b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2108	2026-07-14_d4e5694813bdb761b24d089a8b57e69b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2108	2026-07-14_d4e5694813bdb761b24d089a8b57e69b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2108	2026-07-14_d4e5694813bdb761b24d089a8b57e69b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2108	2026-07-14_d4e5694813bdb761b24d089a8b57e69b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2108	2026-07-14_d4e5694813bdb761b24d089a8b57e69b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2108	2026-07-14_d4e5694813bdb761b24d089a8b57e69b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2108	2026-07-14_d4e5694813bdb761b24d089a8b57e69b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2108	2026-07-14_d4e5694813bdb761b24d089a8b57e69b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2108	2026-07-14_d4e5694813bdb761b24d089a8b57e69b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2108	2026-07-14_d4e5694813bdb761b24d089a8b57e69b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2108	2026-07-14_d4e5694813bdb761b24d089a8b57e69b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2108	2026-07-14_d4e5694813bdb761b24d089a8b57e69b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2108	2026-07-14_d4e5694813bdb761b24d089a8b57e69b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2108	2026-07-14_d4e5694813bdb761b24d089a8b57e69b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2108	2026-07-14_d4e5694813bdb761b24d089a8b57e69b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2108	2026-07-14_d4e5694813bdb761b24d089a8b57e69b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2108	2026-07-14_d4e5694813bdb761b24d089a8b57e69b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2108	2026-07-14_d4e5694813bdb761b24d089a8b57e69b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2108	2026-07-14_d4e5694813bdb761b24d089a8b57e69b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2108	2026-07-14_d4e5694813bdb761b24d089a8b57e69b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2108	2026-07-14_d4e5694813bdb761b24d089a8b57e69b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2108	2026-07-14_d4e5694813bdb761b24d089a8b57e69b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2108	2026-07-14_d4e5694813bdb761b24d089a8b57e69b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2108	2026-07-14_d4e5694813bdb761b24d089a8b57e69b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2108	2026-07-14_d4e5694813bdb761b24d089a8b57e69b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2108	2026-07-14_d4e5694813bdb761b24d089a8b57e69b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2108	2026-07-14_d4e5694813bdb761b24d089a8b57e69b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2108	2026-07-14_d4e5694813bdb761b24d089a8b57e69b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2108	2026-07-14_d4e5694813bdb761b24d089a8b57e69b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2108	2026-07-14_d4e5694813bdb761b24d089a8b57e69b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2108	2026-07-14_d4e5694813bdb761b24d089a8b57e69b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2108	2026-07-14_d4e5694813bdb761b24d089a8b57e69b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2108	2026-07-14_d4e5694813bdb761b24d089a8b57e69b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2108	2026-07-14_d4e5694813bdb761b24d089a8b57e69b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2108	2026-07-14_d4e5694813bdb761b24d089a8b57e69b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2108	2026-07-14_d4e5694813bdb761b24d089a8b57e69b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2108	2026-07-14_d4e5694813bdb761b24d089a8b57e69b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2108	2026-07-14_d4e5694813bdb761b24d089a8b57e69b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2108	2026-07-14_d4e5694813bdb761b24d089a8b57e69b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2108	2026-07-14_d4e5694813bdb761b24d089a8b57e69b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2108	2026-07-14_d4e5694813bdb761b24d089a8b57e69b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2108	2026-07-14_d4e5694813bdb761b24d089a8b57e69b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
2108	2026-07-14_d4e5694813bdb761b24d089a8b57e69b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1468	gdyvqoigaytqlidb.exe
1468	gdyvqoigaytqlidb.exe
1468	gdyvqoigaytqlidb.exe
1468	gdyvqoigaytqlidb.exe
1468	gdyvqoigaytqlidb.exe
1468	gdyvqoigaytqlidb.exe
1468	gdyvqoigaytqlidb.exe
1468	gdyvqoigaytqlidb.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	2272	i_dyvtqlgdbv.exe
Token: SeDebugPrivilege	4336	i_ysqkidxsqk.exe
Token: SeDebugPrivilege	4244	i_ausmkicxvn.exe
Token: SeDebugPrivilege	5016	i_cxupjczusm.exe
Token: SeDebugPrivilege	3876	i_upmhezwrpj.exe
Token: SeDebugPrivilege	5912	i_mjcwurmjeb.exe
Token: SeDebugPrivilege	692	i_ywrojgbztr.exe
Token: SeDebugPrivilege	912	i_qoigaytrlj.exe
Token: SeDebugPrivilege	2040	i_lfdbvtnlfd.exe
Token: SeDebugPrivilege	3580	i_faysqkicav.exe
Token: SeDebugPrivilege	1796	i_nifaxvpnhf.exe
Token: SeDebugPrivilege	4092	i_zxrpkhcaus.exe
Token: SeDebugPrivilege	5984	i_xrpjhfzxrp.exe
Token: SeDebugPrivilege	1780	i_gezwrpjhbz.exe
Token: SeDebugPrivilege	2480	i_jebwuomjeb.exe
Token: SeDebugPrivilege	4816	i_ywqoigbytr.exe
Token: SeDebugPrivilege	4592	i_lidbytqlid.exe
Token: SeDebugPrivilege	4108	i_nifaysnkic.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5460	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 1468	2108	2026-07-14_d4e5694813bdb761b24d089a8b57e69b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 2108 wrote to memory of 3096	2108	2026-07-14_d4e5694813bdb761b24d089a8b57e69b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 3096 wrote to memory of 5460	3096	iexplore.exe	90
PID 5460 wrote to memory of 868	5460	msedge.exe	91
PID 5460 wrote to memory of 5756	5460	msedge.exe	93
PID 5460 wrote to memory of 2128	5460	msedge.exe	95
PID 5460 wrote to memory of 4516	5460	msedge.exe	94
PID 5460 wrote to memory of 2128	5460	msedge.exe	95
PID 5460 wrote to memory of 4516	5460	msedge.exe	94
PID 5460 wrote to memory of 4516	5460	msedge.exe	94
PID 5460 wrote to memory of 5564	5460	msedge.exe	96
PID 5460 wrote to memory of 5564	5460	msedge.exe	96
PID 5460 wrote to memory of 5564	5460	msedge.exe	96
PID 5460 wrote to memory of 2840	5460	msedge.exe	97
PID 5460 wrote to memory of 2840	5460	msedge.exe	97
PID 5460 wrote to memory of 2840	5460	msedge.exe	97
PID 5460 wrote to memory of 840	5460	msedge.exe	98
PID 5460 wrote to memory of 840	5460	msedge.exe	98
PID 5460 wrote to memory of 840	5460	msedge.exe	98
PID 5460 wrote to memory of 2904	5460	msedge.exe	99
PID 5460 wrote to memory of 2904	5460	msedge.exe	99
PID 5460 wrote to memory of 2904	5460	msedge.exe	99
PID 5460 wrote to memory of 4124	5460	msedge.exe	101
PID 5460 wrote to memory of 4124	5460	msedge.exe	101
PID 1468 wrote to memory of 1488	1468	gdyvqoigaytqlidb.exe	104
PID 2548 wrote to memory of 4800	2548	dyvtqlgdbv.exe	107
PID 5460 wrote to memory of 5216	5460	msedge.exe	111
PID 5460 wrote to memory of 5844	5460	msedge.exe	110
PID 5460 wrote to memory of 5216	5460	msedge.exe	111
PID 5460 wrote to memory of 5844	5460	msedge.exe	110
PID 5460 wrote to memory of 5292	5460	msedge.exe	113
PID 5460 wrote to memory of 5956	5460	msedge.exe	114
PID 5460 wrote to memory of 5956	5460	msedge.exe	114
PID 5460 wrote to memory of 3032	5460	msedge.exe	115
PID 5460 wrote to memory of 3032	5460	msedge.exe	115
PID 1468 wrote to memory of 836	1468	gdyvqoigaytqlidb.exe	118
PID 1468 wrote to memory of 3956	1468	gdyvqoigaytqlidb.exe	122
PID 3936 wrote to memory of 5660	3936	ysqkidxsqk.exe	124
PID 1468 wrote to memory of 3144	1468	gdyvqoigaytqlidb.exe	127
PID 1468 wrote to memory of 4076	1468	gdyvqoigaytqlidb.exe	131
PID 1016 wrote to memory of 2064	1016	ausmkicxvn.exe	133
PID 1468 wrote to memory of 4808	1468	gdyvqoigaytqlidb.exe	136
PID 5460 wrote to memory of 4308	5460	msedge.exe	138
PID 5460 wrote to memory of 4308	5460	msedge.exe	138
PID 5460 wrote to memory of 4308	5460	msedge.exe	138
PID 1468 wrote to memory of 5904	1468	gdyvqoigaytqlidb.exe	142
PID 2956 wrote to memory of 3748	2956	cxupjczusm.exe	144
PID 5460 wrote to memory of 200	5460	msedge.exe	147
PID 5460 wrote to memory of 200	5460	msedge.exe	147
PID 5460 wrote to memory of 200	5460	msedge.exe	147
PID 5460 wrote to memory of 3568	5460	msedge.exe	148
PID 5460 wrote to memory of 1484	5460	msedge.exe	149
PID 5460 wrote to memory of 2892	5460	msedge.exe	150
PID 1468 wrote to memory of 2392	1468	gdyvqoigaytqlidb.exe	151
PID 1468 wrote to memory of 5880	1468	gdyvqoigaytqlidb.exe	155
PID 6052 wrote to memory of 2904	6052	upmhezwrpj.exe	157
PID 1468 wrote to memory of 3460	1468	gdyvqoigaytqlidb.exe	160
PID 1468 wrote to memory of 4856	1468	gdyvqoigaytqlidb.exe	164
PID 1268 wrote to memory of 1316	1268	mjcwurmjeb.exe	166
PID 1468 wrote to memory of 2964	1468	gdyvqoigaytqlidb.exe	169
PID 1468 wrote to memory of 5940	1468	gdyvqoigaytqlidb.exe	173
PID 2872 wrote to memory of 2596	2872	ywrojgbztr.exe	175
PID 1468 wrote to memory of 5056	1468	gdyvqoigaytqlidb.exe	178
PID 5460 wrote to memory of 6012	5460	msedge.exe	182

C:\Users\Admin\AppData\Local\Temp\2026-07-14_d4e5694813bdb761b24d089a8b57e69b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_d4e5694813bdb761b24d089a8b57e69b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Temp\gdyvqoigaytqlidb.exe
  C:\Temp\gdyvqoigaytqlidb.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1468
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dyvtqlgdbv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1488
  - - C:\Temp\dyvtqlgdbv.exe
      C:\Temp\dyvtqlgdbv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2548
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4800
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1280
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dyvtqlgdbv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:836
  - - C:\Temp\i_dyvtqlgdbv.exe
      C:\Temp\i_dyvtqlgdbv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2272
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ysqkidxsqk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3956
  - - C:\Temp\ysqkidxsqk.exe
      C:\Temp\ysqkidxsqk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3936
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5660
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1280
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ysqkidxsqk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3144
  - - C:\Temp\i_ysqkidxsqk.exe
      C:\Temp\i_ysqkidxsqk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4336
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ausmkicxvn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4076
  - - C:\Temp\ausmkicxvn.exe
      C:\Temp\ausmkicxvn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1016
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2064
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1908
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ausmkicxvn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4808
  - - C:\Temp\i_ausmkicxvn.exe
      C:\Temp\i_ausmkicxvn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4244
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cxupjczusm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5904
  - - C:\Temp\cxupjczusm.exe
      C:\Temp\cxupjczusm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2956
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3748
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5996
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cxupjczusm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2392
  - - C:\Temp\i_cxupjczusm.exe
      C:\Temp\i_cxupjczusm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5016
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\upmhezwrpj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5880
  - - C:\Temp\upmhezwrpj.exe
      C:\Temp\upmhezwrpj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6052
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2904
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4336
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_upmhezwrpj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3460
  - - C:\Temp\i_upmhezwrpj.exe
      C:\Temp\i_upmhezwrpj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3876
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mjcwurmjeb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4856
  - - C:\Temp\mjcwurmjeb.exe
      C:\Temp\mjcwurmjeb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1268
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1316
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4172
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mjcwurmjeb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2964
  - - C:\Temp\i_mjcwurmjeb.exe
      C:\Temp\i_mjcwurmjeb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5912
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ywrojgbztr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5940
  - - C:\Temp\ywrojgbztr.exe
      C:\Temp\ywrojgbztr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2872
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2596
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4164
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ywrojgbztr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5056
  - - C:\Temp\i_ywrojgbztr.exe
      C:\Temp\i_ywrojgbztr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:692
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qoigaytrlj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5808
  - - C:\Temp\qoigaytrlj.exe
      C:\Temp\qoigaytrlj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5804
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1964
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3676
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qoigaytrlj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3336
  - - C:\Temp\i_qoigaytrlj.exe
      C:\Temp\i_qoigaytrlj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:912
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lfdbvtnlfd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2636
  - - C:\Temp\lfdbvtnlfd.exe
      C:\Temp\lfdbvtnlfd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4264
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5428
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4672
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lfdbvtnlfd.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3592
  - - C:\Temp\i_lfdbvtnlfd.exe
      C:\Temp\i_lfdbvtnlfd.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2040
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\faysqkicav.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4736
  - - C:\Temp\faysqkicav.exe
      C:\Temp\faysqkicav.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:6044
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2344
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5924
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_faysqkicav.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1896
  - - C:\Temp\i_faysqkicav.exe
      C:\Temp\i_faysqkicav.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3580
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nifaxvpnhf.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1260
  - - C:\Temp\nifaxvpnhf.exe
      C:\Temp\nifaxvpnhf.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1136
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2520
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4156
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nifaxvpnhf.exe ups_ins
    3⤵
    PID:4440
  - - C:\Temp\i_nifaxvpnhf.exe
      C:\Temp\i_nifaxvpnhf.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1796
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zxrpkhcaus.exe ups_run
    3⤵
    PID:1384
  - - C:\Temp\zxrpkhcaus.exe
      C:\Temp\zxrpkhcaus.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4672
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2888
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1196
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zxrpkhcaus.exe ups_ins
    3⤵
    PID:1204
  - - C:\Temp\i_zxrpkhcaus.exe
      C:\Temp\i_zxrpkhcaus.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4092
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xrpjhfzxrp.exe ups_run
    3⤵
    PID:5888
  - - C:\Temp\xrpjhfzxrp.exe
      C:\Temp\xrpjhfzxrp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4656
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1652
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:364
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xrpjhfzxrp.exe ups_ins
    3⤵
    PID:2564
  - - C:\Temp\i_xrpjhfzxrp.exe
      C:\Temp\i_xrpjhfzxrp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5984
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gezwrpjhbz.exe ups_run
    3⤵
    PID:892
  - - C:\Temp\gezwrpjhbz.exe
      C:\Temp\gezwrpjhbz.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5736
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1584
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4616
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gezwrpjhbz.exe ups_ins
    3⤵
    PID:1160
  - - C:\Temp\i_gezwrpjhbz.exe
      C:\Temp\i_gezwrpjhbz.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1780
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jebwuomjeb.exe ups_run
    3⤵
    PID:3580
  - - C:\Temp\jebwuomjeb.exe
      C:\Temp\jebwuomjeb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3396
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3384
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2364
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jebwuomjeb.exe ups_ins
    3⤵
    PID:2808
  - - C:\Temp\i_jebwuomjeb.exe
      C:\Temp\i_jebwuomjeb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2480
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ywqoigbytr.exe ups_run
    3⤵
    PID:4944
  - - C:\Temp\ywqoigbytr.exe
      C:\Temp\ywqoigbytr.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3712
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1764
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6028
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ywqoigbytr.exe ups_ins
    3⤵
    PID:4664
  - - C:\Temp\i_ywqoigbytr.exe
      C:\Temp\i_ywqoigbytr.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4816
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lidbytqlid.exe ups_run
    3⤵
    PID:476
  - - C:\Temp\lidbytqlid.exe
      C:\Temp\lidbytqlid.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2192
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1408
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3864
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lidbytqlid.exe ups_ins
    3⤵
    PID:4208
  - - C:\Temp\i_lidbytqlid.exe
      C:\Temp\i_lidbytqlid.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4592
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nifaysnkic.exe ups_run
    3⤵
    PID:4164
  - - C:\Temp\nifaysnkic.exe
      C:\Temp\nifaysnkic.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3184
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:636
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4616
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nifaysnkic.exe ups_ins
    3⤵
    PID:2900
  - - C:\Temp\i_nifaysnkic.exe
      C:\Temp\i_nifaysnkic.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4108
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x35c,0x7ffe4c0fc188,0x7ffe4c0fc194,0x7ffe4c0fc1a0
      4⤵
      PID:868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,4366734924652792173,6087839619966268434,524288 --field-trial-handle=2920,i,4549042305845105206,16217862528129861610,262144 --variations-seed-version --mojo-platform-channel-handle=2960 /prefetch:11
      4⤵
      System Time Discovery
      PID:5756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,10564086183052792746,16440232138056167890,262144 --field-trial-handle=2920,i,4549042305845105206,16217862528129861610,262144 --variations-seed-version --mojo-platform-channel-handle=2916 /prefetch:2
      4⤵
      PID:4516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2340,i,16935519781156110387,4701997943257011140,524288 --field-trial-handle=2920,i,4549042305845105206,16217862528129861610,262144 --variations-seed-version --mojo-platform-channel-handle=2968 /prefetch:13
      4⤵
      PID:2128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3536,i,18152138863112565649,9629054457570799496,2097152 --field-trial-handle=2920,i,4549042305845105206,16217862528129861610,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
      4⤵
      PID:5564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3540,i,10485717380525108841,12890286449111590245,2097152 --field-trial-handle=2920,i,4549042305845105206,16217862528129861610,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
      4⤵
      PID:2840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4168,i,11420665490693475627,10007101894637225389,2097152 --field-trial-handle=2920,i,4549042305845105206,16217862528129861610,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:1
      4⤵
      PID:840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4180,i,15022043479914352594,18338509425064759536,2097152 --field-trial-handle=2920,i,4549042305845105206,16217862528129861610,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:9
      4⤵
      PID:2904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4172,i,1072259394889363565,1934720582383905432,524288 --field-trial-handle=2920,i,4549042305845105206,16217862528129861610,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:14
      4⤵
      PID:4124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,5127518470434933447,1956732044526000168,524288 --field-trial-handle=2920,i,4549042305845105206,16217862528129861610,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:14
      4⤵
      PID:5844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,5604957978067698460,15702072041285254719,524288 --field-trial-handle=2920,i,4549042305845105206,16217862528129861610,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:14
      4⤵
      PID:5216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,11431348494843977033,3536493855409106482,524288 --field-trial-handle=2920,i,4549042305845105206,16217862528129861610,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:14
      4⤵
      PID:1364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,11431348494843977033,3536493855409106482,524288 --field-trial-handle=2920,i,4549042305845105206,16217862528129861610,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:14
      4⤵
      PID:5292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,14469262299863905738,7243430275276081638,524288 --field-trial-handle=2920,i,4549042305845105206,16217862528129861610,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
      4⤵
      PID:5956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,15962012402476035944,2950327319342688288,524288 --field-trial-handle=2920,i,4549042305845105206,16217862528129861610,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:14
      4⤵
      PID:3032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5084,i,15734325123397649023,18058575581525788675,2097152 --field-trial-handle=2920,i,4549042305845105206,16217862528129861610,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:1
      4⤵
      PID:4308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3564,i,741852862117705199,17759882713851988022,2097152 --field-trial-handle=2920,i,4549042305845105206,16217862528129861610,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:1
      4⤵
      PID:200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3556,i,15068923697403875663,4734302254673620223,524288 --field-trial-handle=2920,i,4549042305845105206,16217862528129861610,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:14
      4⤵
      PID:3568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,5008352488688763253,16494761406190519324,524288 --field-trial-handle=2920,i,4549042305845105206,16217862528129861610,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:14
      4⤵
      PID:1484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,17488338240466039049,5343891545324061944,524288 --field-trial-handle=2920,i,4549042305845105206,16217862528129861610,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:14
      4⤵
      PID:2892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5176,i,14846044151091166131,14443795514328663962,2097152 --field-trial-handle=2920,i,4549042305845105206,16217862528129861610,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:1
      4⤵
      PID:6012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5620,i,10760646586739219113,12417673220513537294,524288 --field-trial-handle=2920,i,4549042305845105206,16217862528129861610,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:14
      4⤵
      PID:2892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=3748,i,8693970205746585933,11883213813173640460,2097152 --field-trial-handle=2920,i,4549042305845105206,16217862528129861610,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
      4⤵
      PID:260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5360,i,8952851421428352206,4684914647564821011,2097152 --field-trial-handle=2920,i,4549042305845105206,16217862528129861610,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:1
      4⤵
      PID:1192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6884,i,2858260378534470094,9733846433476222293,262144 --field-trial-handle=2920,i,4549042305845105206,16217862528129861610,262144 --variations-seed-version --mojo-platform-channel-handle=6892 /prefetch:10
      4⤵
      PID:2600

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1936

C:\Temp\gdyvqoigaytqlidb.sys
C:\Temp\gdyvqoigaytqlidb.sys
1⤵
- Executes dropped EXE
PID:4564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:256

C:\Temp\fdxvpnifay.sys
C:\Temp\fdxvpnifay.sys
1⤵
- Executes dropped EXE
PID:5752

C:\Temp\fdavsmkfcx.sys
C:\Temp\fdavsmkfcx.sys
1⤵
- Executes dropped EXE
PID:1548

C:\Temp\xsmcxupnhf.sys
C:\Temp\xsmcxupnhf.sys
1⤵
- Executes dropped EXE
PID:256

C:\Temp\mhfzxupnhf.sys
C:\Temp\mhfzxupnhf.sys
1⤵
- Executes dropped EXE
PID:3676

C:\Temp\wrpjhbztrm.sys
C:\Temp\wrpjhbztrm.sys
1⤵
- Executes dropped EXE
PID:2036

C:\Temp\jebwuomgey.sys
C:\Temp\jebwuomgey.sys
1⤵
- Executes dropped EXE
PID:5856

C:\Temp\ywqoigaywq.sys
C:\Temp\ywqoigaywq.sys
1⤵
- Executes dropped EXE
PID:1896

C:\Temp\dyoigaysql.sys
C:\Temp\dyoigaysql.sys
1⤵
- Executes dropped EXE
PID:2912

C:\Temp\xvqnigaysq.sys
C:\Temp\xvqnigaysq.sys
1⤵
- Executes dropped EXE
PID:1776

C:\Temp\vpnifayspk.sys
C:\Temp\vpnifayspk.sys
1⤵
- Executes dropped EXE
PID:784

C:\Temp\nhfzxrpkhc.sys
C:\Temp\nhfzxrpkhc.sys
1⤵
PID:5900

C:\Temp\hczurmkecw.sys
C:\Temp\hczurmkecw.sys
1⤵
PID:3220

C:\Temp\rpjhbzurmk.sys
C:\Temp\rpjhbzurmk.sys
1⤵
PID:3968

C:\Temp\wrojhbztrm.sys
C:\Temp\wrojhbztrm.sys
1⤵
PID:4564

C:\Temp\lgdbwtoljd.sys
C:\Temp\lgdbwtoljd.sys
1⤵
PID:3176

C:\Temp\tqlidaytql.sys
C:\Temp\tqlidaytql.sys
1⤵
PID:3220

C:\Temp\qkidavsnlf.sys
C:\Temp\qkidavsnlf.sys
1⤵
PID:5924

C:\Temp\pnifdxvpnl.sys
C:\Temp\pnifdxvpnl.sys
1⤵
PID:3408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ausmkicxvn.exe

Path C:\Temp\ausmkicxvn.exe
Size 376KB
SHA256 c3134f250c6b0dfcce277513b54a928c027e726e48cc42134085c026d12505e4
MD5 4e4b864e4a690dfe910f6275fd078251
SHA1 3bc7aa73498e2b1cda5b2ced2f7e5456b087c229
SHA512 5a0fb5fa6933e1ffddc10dda76d00bc6f9bff7758f04308021e25106c53d7427cd7874bb5384e41c7fc0bb5110a062cd433cfda1b9ef540ed102a305cc5a325d
SSDEEP 3072:SViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:SViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T104847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cxupjczusm.exe

Path C:\Temp\cxupjczusm.exe
Size 376KB
SHA256 33ad12b0cce860f3bced5449de917b7fbe7a93c0be66405c8ff0895cc4252914
MD5 672715f4675ea14efc05a1c5e8651f1d
SHA1 2ab69aa84cb332fdc95d22969a4338b124fd9aa9
SHA512 0c11c74069ea005af14f0c40dc724ae049c89171c0f3a25858c02f601bc32017f186b0c5c47d61e8e08e91b8a40633d5a8907a785b1503b0e972e3b866c01706
SSDEEP 6144:Q6ViLcYcVIJjiJcbI03GBc3ucY5DCSjXV:LViAY1GjSGecvX
TLSH
T1DC847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dyvtqlgdbv.exe

Path C:\Temp\dyvtqlgdbv.exe
Size 376KB
SHA256 6edabc8a538d2f36b2fc3c4f9824e21ca33f56d05700fa19fb682db9979b2951
MD5 ef285c4892c741bf1d4c8dd630c1481b
SHA1 dbedf926b5c68feb37e008d7546e4fa75462a2da
SHA512 0f5f4dd0cb3ddafedbcfa54e537218ffdbfc4ec24e0e3bdda46e54e31840abb7441610287dad1b72333d60f0bbcc578d24740ec717ff5dcbbceb46d0e41c6aba
SSDEEP 3072:IViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:IViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T192847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdavsmkfcx.sys

Path C:\Temp\fdavsmkfcx.sys
Size 293KB
SHA256 9f766a81f749425ce90cabf459b790a03501d4f51c1c9ce2712ff456668f598b
MD5 ae84b51f56e8821f6ca82da51a0f30f7
SHA1 a62a3d1ad1645b46dfb2a1f4586d2be54e22c58c
SHA512 5703a7594f6a47d96d7888cad91b4528f619d6c2e8ff5d1d37fd9bf088b3a5cf841e6a2d0065d9551f36a6d8b8a6d10157cf5f04da6f9bd8a5f1be1b319fcfbd
SSDEEP 3072:ttKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:tIJjiJcbI03GBc3ucY5DCSj
TLSH
T121545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdxvpnifay.sys

Path C:\Temp\fdxvpnifay.sys
Size 293KB
SHA256 de6bc201aab7e1c08f514e8c1bf97ee19ff0fb2773fab1b635d46ab3ec978ad3
MD5 46fdfe1689fe4c78c18b002d4d76edcb
SHA1 4ba86655f1b566065226af05a4f71bea22079098
SHA512 baf96bc51de7f2e2b0913ff2d0f06800eea1d59e6fe1fa4a6125cac897e5860304c438198b83d109caf76344205015b8e5799700f2c79ef062adf8f73f0cfa25
SSDEEP 3072:2tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:2IJjiJcbI03GBc3ucY5DCSj
TLSH
T16D545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gdyvqoigaytqlidb.exe

Path C:\Temp\gdyvqoigaytqlidb.exe
Size 376KB
SHA256 03fca50a8a3d7e1ab9d04e4bc3e19a47ed406e55a260604f9111440f78f4838b
MD5 fe388c3fbedec4fc7005aacdca19d0c7
SHA1 b0a40b2417db83a2bf53c59f18fed0a98dda05ca
SHA512 5bcf0b7f678d37271c1300e67bb5ee4f8ef5718d6a61ef649c1f06e1a680ecf6d8975238611227bfd45e57f16a36454231f332d9c2ec61d44e15f4b23ad14c89
SSDEEP 3072:fViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:fViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T199847C04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gdyvqoigaytqlidb.sys

Path C:\Temp\gdyvqoigaytqlidb.sys
Size 293KB
SHA256 984f33216b956f3737ed1cd33bd34cf687db6c59071a21b954ed32aab4a09bca
MD5 3c25a31fb21d4a53ed4fc1ac3c60fc72
SHA1 1844c464e51975821c1937fcf8a36464063ea979
SHA512 cc6e85b66798bd9028e80757d46c3b961e543c749f8c6e28d1e3e435dae5571b44f65a79ffb3f280c87aefaf44428ebe3afdc00a519c1912bbfcf1fbefe896d9
SSDEEP 3072:ytKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:yIJjiJcbI03GBc3ucY5DCSj
TLSH
T14E545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ausmkicxvn.exe

Path C:\Temp\i_ausmkicxvn.exe
Size 376KB
SHA256 7ded809f64895dd2c8b4412d9cb7e311a90587e152fa451a25cd13b04c47244a
MD5 db6c15e35bff531d2dfa25a6859da5d5
SHA1 4e65a2387c70fe58ed783c41ab9ea6ec02fb9bce
SHA512 f110c6c09a26ffd6723b41b7fd69c40f723984138b4ece5a5b1ccd56d35d4fd1ef166c716f504ba5d47e3e202a9d0fa38d70a136d5ade3aae99da88799f5930d
SSDEEP 3072:BViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:BViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B9847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_cxupjczusm.exe

Path C:\Temp\i_cxupjczusm.exe
Size 376KB
SHA256 beaa9b2229c125b833a1088d19854721047a95f8db6d9086a8bb9f7d96427c54
MD5 217dc16e4c9ca72cf5d9d65372e7d38a
SHA1 9c36e642121ca672c755effc171a90aa9452f885
SHA512 dfa4a340d801be3c7e98632a7b11cabf1ed6f8c3f46968398dfa7f339b0b577cff6b1f7daa3da42631e2494d79041a8328d75f08c4ca6495ad68a1ca87590230
SSDEEP 3072:1ViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:1ViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T148847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dyvtqlgdbv.exe

Path C:\Temp\i_dyvtqlgdbv.exe
Size 376KB
SHA256 6fa9a9af73464d57080ed03fe37a01a751d284a93f537ce056a794acf5b97d51
MD5 28e240ddbd504fc468078f1b98913f83
SHA1 1de5f1fd836962230f8dc6c15fedad7c7a4eb68b
SHA512 98cc638be96d54bb477f55d09d13f21b62c4a6f836289cbe608d8139f50eb138fd30fad4c38193683c740a365c1b134797edcc320959f1dc02c0f5b46cf5b8d6
SSDEEP 3072:DViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:DViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T112847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_upmhezwrpj.exe

Path C:\Temp\i_upmhezwrpj.exe
Size 376KB
SHA256 a6bba3a6a4d4a9d3a36925ba97004bdcd744b1d39fc34a28c79eeee739341415
MD5 e56b4f44ea896fd31f03195f1b247799
SHA1 83f7cc5d631538d98d5e2a4d15b519b9d517594f
SHA512 20d8170f07485b69bc996fbe1924313201b8870bc872d004e2ef84b587c54e88874fe0da7d9543ab4e050b99ddba1da637b4a20335d5d15f0e1242342163886b
SSDEEP 3072:4ViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:4ViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A6847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ysqkidxsqk.exe

Path C:\Temp\i_ysqkidxsqk.exe
Size 376KB
SHA256 580debbb3b6a22315b05e095a03dda652806db794bd15c9649d9dce1d7482c4b
MD5 55d8da70dc035324314df9fc8551b19d
SHA1 8f6b356dc1569323b0d21afededeabd9bfe8d937
SHA512 61ff86318fb47cecddff04b0744c37ea9cacc3f2fe7c628bfdb455c810081c0c7563bc285d363c8feaa28ff2c79645f10863439b7022f8b675ef621dc1f0e65b
SSDEEP 3072:2ViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:2ViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T16D847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mhfzxupnhf.sys

Path C:\Temp\mhfzxupnhf.sys
Size 293KB
SHA256 77a21fbccb861752a910add77b1acf5c6f2be9a6446645a8ca4fc676f80904e9
MD5 30bea4ea04a3acc0d7fea240730772a0
SHA1 3539a48851d38351e43eb76091fb97a0cd1e6e7f
SHA512 429cea80de8c2bbd69e8076e301d5e46055d3f86c03e3cd6b1f562fb08af01eb7a3e0d293881fa463f73f4c1395485cab13b44908a7eea31d72a75184aa9b6d8
SSDEEP 3072:mtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:mIJjiJcbI03GBc3ucY5DCSj
TLSH
T114545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mjcwurmjeb.exe

Path C:\Temp\mjcwurmjeb.exe
Size 376KB
SHA256 3f4b499ad24f848ff7698a509dc9ef674a68134795b2485609df80df097d6951
MD5 ae48ca95e25abced23240562a7d43926
SHA1 547e57d4cb7f978568e12f1c38ccc47fc68044c7
SHA512 b5b33334f5bf57ddbbc8d79e1709d9c4619e3b593e0dfabd76f0c55bc94d58c7d66ec0ae65375dfe165628a9b6dd391ce86509ce3a0d9631c508eff9da8a4195
SSDEEP 3072:RViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:RViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1DF847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

upmhezwrpj.exe

Path C:\Temp\upmhezwrpj.exe
Size 376KB
SHA256 c10ba50f0ed510f76872e4ee6b36a42657887ad595b13091bfc1661a6830f9f3
MD5 a4f47863fe77cdd235dfcc2ad8ba646e
SHA1 1690b03393c158e81e8775d1ebf4f550f71071f9
SHA512 28f001119ed6a3175b077ac837152f728492db621dff6b00364c0e1c957b38aaa1a18533373b317aa5a1b4be7bb0c322ae2674c63534ba86701a970627935fa3
SSDEEP 3072:ZViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:ZViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A9847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrpjhbztrm.sys

Path C:\Temp\wrpjhbztrm.sys
Size 293KB
SHA256 6321d1db1f2b0ea25ea66044454f34ccf233e193f5cf0162fff092f1c5aecdc8
MD5 c7950a55ec0e174b5ee66b0655b4796a
SHA1 8316b5a8b085b7db6155d96c0497bae00009b0ca
SHA512 0c82dd56c3d45804ff3abaa53efcd65d8d60681778f9b7b5ff8432bc54278ecd72534a0b5cb6162a641d63034e58451281a16d4cad7761668fcd68a1961f13b0
SSDEEP 3072:qtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:qIJjiJcbI03GBc3ucY5DCSj
TLSH
T1C6545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xsmcxupnhf.sys

Path C:\Temp\xsmcxupnhf.sys
Size 293KB
SHA256 c40487705a866e4c22fb0e704c33c692a26d84284d503a8fd094b8906b8e3dc6
MD5 5a2a4ae878c23d6b75236b183762c397
SHA1 bf414f24e8c0b743facc2c8e03fb31ac1205286f
SHA512 baeeb8f4cc57cf3c9c9b1dd092cbeac1253e6cd058778aea14a06e45b843d80a563d788e4771c900d868dabbe6602f2dd935f98f45f21ded8af9400e51331c72
SSDEEP 3072:9tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:9IJjiJcbI03GBc3ucY5DCSj
TLSH
T1EB545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ysqkidxsqk.exe

Path C:\Temp\ysqkidxsqk.exe
Size 376KB
SHA256 0c473173646e73b8fd1fa913e6a6519b616d492b290dfd9c9a033d009b56ec13
MD5 45d42c7551afbc13d919f9e303767435
SHA1 fd36a8ea1d70f36a35d463d4c1e5964b74acb416
SHA512 13db5f2c1446fc7c379357b8107bc6da2c656643f90c4fed7c16e37cbe2890fae0a56c21009baf65e738f2fb43dc9bff7b7dab9f15d62b607f12c022c19f04c9
SSDEEP 3072:yViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:yViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C1847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 97f448a9741e4b733bb8cc6de101ce372bd3fcdd8e474470b0a33b4b2f3c8d6a
MD5 34fef36892088331196501846d69edb7
SHA1 d552ad2aef356fe8b1f804b99e2b144c496ee219
SHA512 60a3920a0484705ef93c1c0f72e7e85539c13102716882c960e651c089ee1567fbebce1757dee8ce4a702ed58b1b622fb8909237ab38a9a82a8bd8b96915c6bb
TLSH
T172512C1DA33614D2E3244772BCD394883FF5CC9A08075E1BA0409EB868C2F17AED2AD3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59e6dc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59e6dc.TMP
Size 2KB
SHA256 75300b1b667fd45409ae6ebc3fd4d78143bed801bccc92d8b0ea001ade2b60e1
MD5 2a0be326d9f23642c7ca76192a56578c
SHA1 56071a279f2673107ba9703328b4df87dd63d5da
SHA512 ed41aee4be35b4c33c0ccbb0b26f99ef19f6f4e9937cb55890f3012b81b2d9f24102cd942341f1cbed1b6d43afac3631fec80358c1b16c1cd67439b266b995bd
TLSH
T1DE513D1DA37615D2E3240772BCD394883FF5CC9A08075E1BA0409EB868C2F17AED2AD3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a30ea83fa605a948a26ef2ce26dcecf0fa7db1fbf5ed8c12f3369486c8c5a53d
MD5 9a06e52b0cf5d18aead0fda2065117cf
SHA1 b55f45282e4fd10c9fd4d7b8a8e8afbef828eb1c
SHA512 5b2afc0d296ff82fa841edd53f06ad25a8e3264cb4d9b5754bc1da0010f126ccf7451bce8983fe174bd81415a632fbe05ba7cef70c65927a3e60d67b709e8ac9
TLSH
T17C41B0F7C3E4856E890156F0AB147E2BCE1D0915432C3D6AC9E4AF5B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 efd7f9768bd460c5885be0acd028a2452cce2193f071a6b4128a48f8f1503f3d
MD5 d0cbfb7a08fffb8fa05856a3427e8593
SHA1 1193bc5ae8f8f21b0f35e8f66fa7568dec7f663a
SHA512 c9605aab29bd9a844060e6efa063b81730623b49e9abd505b4ff279e43a8a084a39860f5278eab3a5589c71307dc6ceaa0393efc901314c008f883f5e3fb3307
SSDEEP 192:sxRIRIyM/jK1Ml8wCN/fxs/uoUZuPcGzoA8pi/g6+WNIYnYph9GpIgtJ:sxRI+8N/fxsGoqpi/5I5jK3
TLSH
T13752FA166A345D7B8CDBD20DFA557F93D6F81563A2901E44AAFCCB0C04E6AED121381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 b4fc18e49719225b509a35f57476c7dc7077b294f8e1e446501e7b409c17dbb5
MD5 87782f0ee55e607ec8998fbf172afa06
SHA1 67b7a70114a29a04a69a1fe07c8c8e0da763e27d
SHA512 78293e8fb5520feec87da5ea9be1dd40439256b1b4861694ef71bea042e583b1cd0af5a321137b18373ac970e5bcc7a04095096d9f08815067a3ec3cde1f2d52
SSDEEP 192:sxR/RIyM/jK1Ml8UQqCN/fxs8udnUZuPcqzoA8prZ4/g6+WNIYn8ch9GpIgDeJ:sxR/+qNN/fxsPVqxV4/5IT6K+
TLSH
T19262EA16AA345E7B8CDBD209FA557F93D6F81463A2901E44ABFCCB0C00E6ADD121381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 3abc60180bd5ebc1f264c4834df15d5f74a255483ce90b4a83d96d5b7cf67b57
MD5 7ede1092f8dd0b70f8cb513dbb02f007
SHA1 435170b8a742e5509ad053aa39dcd34f3356fd9d
SHA512 ab53f698684791806c1da4ad7e66608ef8b1abe78041f6626819656da6478a0fcd09c75f0df2217e63422e953cd2c5c7e95b5c59e7d69834ebbd7e905e3a4ad4
SSDEEP 192:sxR/RIyM/jK1Ml8wCN/fxs8uoUZuPcGzoA8pi/g6+WNIYnYph9GpIgDYJ:sxR/+8N/fxsPoqpi/5I5jKQ
TLSH
T10452EA16AA345A7B8CDBD20DFA557F93D6F81563A2901E44ABFCCB0C04E6ADD121381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 9d567eb90e992343420944bf31dfe79eee2293f68c0207d73e08d63f441d9785
MD5 0ea6392bad63ea4e51dee219fce6ff7e
SHA1 a27b6922117ce25924047741505026d997d29511
SHA512 ad11d792885b0ae3b215c900e924e7adf96a6c5985b7d4ca1c5f2a216e32a41d35de9d57b47c4637726660d2f4e41a482f6c466e1648b8b114c9035a97043eab
SSDEEP 768:wGedPg7pLuL7X6WgoufDM8F1+UoAYDCx9Tuqh0VfUC9xbog/OV4Jhu4Y4roSE86m:wGedPsE7X6WgoufDMu1janJhVYDjKd
TLSH
T151E2EB3B680CCB7E4F804EDCEC29BE9FADA801CB56D8895447EA850C03C67EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 dde828747b3e91a9c3f9ec6ab574e73776f3a50435d30c088117d57ec947d012
MD5 93232cd16759403c2ab43d191caf6b57
SHA1 30f1aaa2334ac3f7282a0a86f5751f42bf84a084
SHA512 e286cef7eca242408e588af50a264364c87094a4464e1cfa44c900c81152c2e534ae274bf36cce7cb56ac057e760c7459f2c81873d28aca1afb7de1b3127305f
SSDEEP 96:KRoZs4q26gWeDzgggK41gCgcwgziItHU1gkeCGEWCPvgsEK4hgmEcEkvevggKd+r:CoZs4q26neDsgU1gC/wgziItHU1gkeC7
TLSH
T12C914141707B02D4397E761C81A8895AD6C1B877716CF8EB7BE881614F27E025EFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a833b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a833b.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 56e69c70e9a317d5769764e27cef2946e526880cc554dc1e94602ba0949e589f
MD5 7be5ac63d3ab48662e3d6086c8fc1d32
SHA1 99da027546eb4a28f448f3fb3e4445096f467627
SHA512 d070c24db814134b84f3ea22423532082f78ad747a050cf76badf8b6ae6c07e1efddd177e5631514b97524beac502e84d80631cfa290cd8d4347f07cc49a43ba
SSDEEP 384:n6tNn/s3n9Sc38N/3JUH92hJDZNfNoXOVSUURXvFAiXSFyETRzcoXfK86sfxEZxn:6j+9L3TqDZIO0Z/0Nzc4ReyIsP4b9MAf
TLSH
T1D4F2BF31EC25CD639CEA6755B21B36A3BEF0517B81C51E88DADD5F0C09432AD0B6B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 4acc17e212200b473f64d96c4c977d05a5d2d60dc34423059b749f94f56cc04c
MD5 fa74243c9e90cf0cb2d77d2c42a498e0
SHA1 47f5aae541d54bddb196f6a844d11288fd2be7f1
SHA512 505b328ae5e9a91e5273f7c36cc4638cda44db775bf01d323c60e45e4449990e130f8efc316217a0b5394f1bc40d196783ae55b1e9b2238bf956855e18aefbbd
SSDEEP 384:nPtNn/s3n9Sc38N/mJUB92hJDZNfNoXOVSUURXvFAiXSFJETRzcoXfK86sfxEZxn:Pj+9L3iqDZIO0Z/fNzc4ReyIsP4b9MAf
TLSH
T154F2B032EC25CD639CEA5755B21B36A3BEF0517781C51E88DADD5F0C09832AD0B6B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 290bca20187bdedb89a10ba1fae9b9a8c563c427ae9774035182348019586417
MD5 2aeb5d666ee64022193ae3a47e7e1ff0
SHA1 00901c42422085527aa7a82284aeb143a0a4fbc8
SHA512 171dabe523ecd2d206e2d867efdab43e6413bdf11556ac14a36d75b19fb3794ced469651ce8a3cfc046ca03f0c6939657f3d38d212a57a662b855b9dfcf60d89
SSDEEP 768:6rv+4UNbds3VkDZIO0ZaNzc4ReyIsXNeVH1S5D:6bsbS3itc44bsdEH1Y
TLSH
T10E03CF32E8788977ACF66785B14B76533EF8912782C81B90C9DE2F0C4A4B1DD131B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 934da45d8379d7030e7b75b994a20b608422eb47539668d6affe9e4f983998cf
MD5 04d9c8b20b003589a1b89127523f8005
SHA1 2f8695c1fd1c19078aa882974316915faa609947
SHA512 a3fec8f26e7265fd9e6408474d93d7307b4310902ed1e6132c257fc1f3d17f8a36ddcaceb65d9edde42e49d204d70529412b5f3d41676122030af370b34cab13
SSDEEP 384:nMtNn/s3n9Sc38N/aJUB92hJDZNfNoXOVSUURXvFAiXSFJETRzcoXfK86sfxEZxn:Mj+9L3yqDZIO0Z/fNzc4ReyIsP4b9MAf
TLSH
T1FCF2B031E825CD639CEA6755B31B36A3BEF0517B81C51E88DADD5F0C09832AD0B6B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 e92b702c5498890c3115e7f60a4733109180819c2bf481185beef105a65697fe
MD5 e9f56493ec4f473103a000f5ec76404c
SHA1 edbae07de3719071ecc4d2710986464171746b9b
SHA512 2629bc61fab7d28c8077dd03325d911bd07c48f5cefed1d09dd786ae5d134eb7a521fc9952469ac21549b41fc40cb70c0ea36a9d0a20c777f5689f903dd61519
SSDEEP 768:8FKj+9M3WwgsTZU5O0Z/TNzc4ReyIsP4b9MAf:M9M3mtc44bsAb+i
TLSH
T106039D36EC65CE6BACE65B86B70A3697AEF041A781C99DC4DAC95F4C04831DD070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5ed2ca5c-bba1-465e-b720-45946d3401fc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5ed2ca5c-bba1-465e-b720-45946d3401fc.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5460_132131965\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 ad3b4767f32c09d4b2c52f29180c54536c316c25769d0a2f95b5c7fa34c7e656
MD5 868783efd0ba89215bab299db849a285
SHA1 ed024d13ec06ad2200efcd35d1c287f1a315916c
SHA512 f4c220658e7b752aacf9685c74db6e07d4fc147e9754f525f34f21af7234ab253a8876b896e703c442b6f614bd4b8354d69496ed087ba47a0fcd6984c536bdf6
TLSH
T14D71009356A9C5B2C1DE5BF112839244F2FB22384B6330240B91558AEB70A7A64B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/256-274-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/784-380-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1548-238-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1776-368-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1896-328-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2036-317-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2912-343-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3176-410-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3220-414-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3220-397-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3408-430-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3676-288-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3968-401-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4564-405-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4564-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5752-199-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5856-324-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5900-393-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5924-426-0x0000000000010000-0x00000000000AB000-memory.dmp

Download