systex | 42451700b7cac308d2ce1d866c29da09c3127d15dfbd8c5d70a69093c37fea2a

Analysis

max time kernel
149s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 03:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-21_d5c7f830848617b4733684a2823e8640_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Size 365KB
Sample260721-ec2vjad14r
SHA256 42451700b7cac308d2ce1d866c29da09c3127d15dfbd8c5d70a69093c37fea2a
MD5 d5c7f830848617b4733684a2823e8640
SHA1 9cf8f0eb4ec0e00edd577f6f9fc43049d65e879a
SHA512 723f84c4ce09148fa208811d47bc50f68b978b05abbd4a86b5b3323ce565242b6c3a5918bb7125386e0fc475ee936962f2c267620574e2303275c493f9b46db3
SSDEEP 3072:AuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:AuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1AB847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
4464	omgezwrpjhbzwrpj.exe
4472	omgezwrpjhbzwrpj.sys
2828	CreateProcess.exe
4204	wrojhbztrm.exe
1348	CreateProcess.exe
6060	CreateProcess.exe
3620	i_wrojhbztrm.exe
5920	eywrojhbzt.sys
5588	CreateProcess.exe
5900	mgeywqomge.exe
940	CreateProcess.exe
4632	CreateProcess.exe
2456	i_mgeywqomge.exe
1372	lgeywtoljd.sys
5180	CreateProcess.exe
1884	lgebwtrljd.exe
3700	CreateProcess.exe
4688	CreateProcess.exe
4408	i_lgebwtrljd.exe
4996	gdbvtqljdb.sys
4652	CreateProcess.exe
1776	ayvtnigdyw.exe
1732	CreateProcess.exe
2564	CreateProcess.exe
4352	i_ayvtnigdyw.exe
5844	ysqlidxvtn.sys
3800	CreateProcess.exe
4844	sqkicavsnl.exe
4916	CreateProcess.exe
4764	CreateProcess.exe
4324	i_sqkicavsnl.exe
4732	sqkifaxvqn.sys
3740	CreateProcess.exe
2768	icaxvpnhfa.exe
4720	CreateProcess.exe
5724	CreateProcess.exe
5528	i_icaxvpnhfa.exe
2804	spkicausmk.sys
2832	CreateProcess.exe
4804	snkicausnk.exe
3196	CreateProcess.exe
3624	CreateProcess.exe
4212	i_snkicausnk.exe
2320	uspkhcausm.sys
4472	CreateProcess.exe
3752	rpkhczxusm.exe
4624	CreateProcess.exe
6088	CreateProcess.exe
4176	i_rpkhczxusm.exe
3656	mheczurpmh.sys
5312	CreateProcess.exe
2516	eczurmjecw.exe
3604	CreateProcess.exe
5936	CreateProcess.exe
1608	i_eczurmjecw.exe
3724	gecwromhec.sys
5544	CreateProcess.exe
1356	tromjdbztr.exe
700	CreateProcess.exe
4272	CreateProcess.exe
2276	i_tromjdbztr.exe
4352	ywtrljgeyw.sys
5436	CreateProcess.exe
5628	ebztrljdbz.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4304_674299017\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4304_1940433106\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4304_1940433106\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4304_674299017\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4304_1940433106\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4304_1940433106\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4304_2093224520\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4304_1813952582\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4304_1813952582\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkicavsnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgezwrpjhbzwrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgeywqomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgeywqomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ayvtnigdyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpkhczxusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bywqoigayt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icaxvpnhfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icaxvpnhfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpmhezwup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnigaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgebwtrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eczurmjecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bywqoigayt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrojhbzwur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebztrojgbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-21_d5c7f830848617b4733684a2823e8640_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eczurmjecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hczxrpnhfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrojhbzwur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ayvtnigdyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrojhbztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snkicausnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebztrljdbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axvsnifdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdavpnhfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebztrojgbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tromjdbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hczxrpnhfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrojhbztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snkicausnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpkhczxusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tromjdbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdavpnhfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpmhezwup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rojgeytrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgebwtrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkicavsnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebztrljdbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnigaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axvsnifdxv.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5796	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4548	ipconfig.exe
5400	ipconfig.exe
4152	ipconfig.exe
2676	ipconfig.exe
5592	ipconfig.exe
5572	ipconfig.exe
1552	ipconfig.exe
2960	ipconfig.exe
4560	ipconfig.exe
5968	ipconfig.exe
3880	ipconfig.exe
4816	ipconfig.exe
5692	ipconfig.exe
4672	ipconfig.exe
5044	ipconfig.exe
2920	ipconfig.exe
3108	ipconfig.exe
1172	ipconfig.exe
5148	ipconfig.exe
2152	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134290793226728940"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{96323749-7D7C-4B3C-8D48-9394949B27CB}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4644	2026-07-21_d5c7f830848617b4733684a2823e8640_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4644	2026-07-21_d5c7f830848617b4733684a2823e8640_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4644	2026-07-21_d5c7f830848617b4733684a2823e8640_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4644	2026-07-21_d5c7f830848617b4733684a2823e8640_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4644	2026-07-21_d5c7f830848617b4733684a2823e8640_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4644	2026-07-21_d5c7f830848617b4733684a2823e8640_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4644	2026-07-21_d5c7f830848617b4733684a2823e8640_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4644	2026-07-21_d5c7f830848617b4733684a2823e8640_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4644	2026-07-21_d5c7f830848617b4733684a2823e8640_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4644	2026-07-21_d5c7f830848617b4733684a2823e8640_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4644	2026-07-21_d5c7f830848617b4733684a2823e8640_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4644	2026-07-21_d5c7f830848617b4733684a2823e8640_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4644	2026-07-21_d5c7f830848617b4733684a2823e8640_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4644	2026-07-21_d5c7f830848617b4733684a2823e8640_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4644	2026-07-21_d5c7f830848617b4733684a2823e8640_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4644	2026-07-21_d5c7f830848617b4733684a2823e8640_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4644	2026-07-21_d5c7f830848617b4733684a2823e8640_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4644	2026-07-21_d5c7f830848617b4733684a2823e8640_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4644	2026-07-21_d5c7f830848617b4733684a2823e8640_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4644	2026-07-21_d5c7f830848617b4733684a2823e8640_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4644	2026-07-21_d5c7f830848617b4733684a2823e8640_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4644	2026-07-21_d5c7f830848617b4733684a2823e8640_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4644	2026-07-21_d5c7f830848617b4733684a2823e8640_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4644	2026-07-21_d5c7f830848617b4733684a2823e8640_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4644	2026-07-21_d5c7f830848617b4733684a2823e8640_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4644	2026-07-21_d5c7f830848617b4733684a2823e8640_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4644	2026-07-21_d5c7f830848617b4733684a2823e8640_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4644	2026-07-21_d5c7f830848617b4733684a2823e8640_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4644	2026-07-21_d5c7f830848617b4733684a2823e8640_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4644	2026-07-21_d5c7f830848617b4733684a2823e8640_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4644	2026-07-21_d5c7f830848617b4733684a2823e8640_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4644	2026-07-21_d5c7f830848617b4733684a2823e8640_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4644	2026-07-21_d5c7f830848617b4733684a2823e8640_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4644	2026-07-21_d5c7f830848617b4733684a2823e8640_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4644	2026-07-21_d5c7f830848617b4733684a2823e8640_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4644	2026-07-21_d5c7f830848617b4733684a2823e8640_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4644	2026-07-21_d5c7f830848617b4733684a2823e8640_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4644	2026-07-21_d5c7f830848617b4733684a2823e8640_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4644	2026-07-21_d5c7f830848617b4733684a2823e8640_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4644	2026-07-21_d5c7f830848617b4733684a2823e8640_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4644	2026-07-21_d5c7f830848617b4733684a2823e8640_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4644	2026-07-21_d5c7f830848617b4733684a2823e8640_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4644	2026-07-21_d5c7f830848617b4733684a2823e8640_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4644	2026-07-21_d5c7f830848617b4733684a2823e8640_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4644	2026-07-21_d5c7f830848617b4733684a2823e8640_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4644	2026-07-21_d5c7f830848617b4733684a2823e8640_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4644	2026-07-21_d5c7f830848617b4733684a2823e8640_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4644	2026-07-21_d5c7f830848617b4733684a2823e8640_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4644	2026-07-21_d5c7f830848617b4733684a2823e8640_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4644	2026-07-21_d5c7f830848617b4733684a2823e8640_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4644	2026-07-21_d5c7f830848617b4733684a2823e8640_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4644	2026-07-21_d5c7f830848617b4733684a2823e8640_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4464	omgezwrpjhbzwrpj.exe
4464	omgezwrpjhbzwrpj.exe
4644	2026-07-21_d5c7f830848617b4733684a2823e8640_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4644	2026-07-21_d5c7f830848617b4733684a2823e8640_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4464	omgezwrpjhbzwrpj.exe
4464	omgezwrpjhbzwrpj.exe
4644	2026-07-21_d5c7f830848617b4733684a2823e8640_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4644	2026-07-21_d5c7f830848617b4733684a2823e8640_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4464	omgezwrpjhbzwrpj.exe
4464	omgezwrpjhbzwrpj.exe
4464	omgezwrpjhbzwrpj.exe
4464	omgezwrpjhbzwrpj.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	3620	i_wrojhbztrm.exe
Token: SeDebugPrivilege	2456	i_mgeywqomge.exe
Token: SeDebugPrivilege	4408	i_lgebwtrljd.exe
Token: SeDebugPrivilege	4352	i_ayvtnigdyw.exe
Token: SeDebugPrivilege	4324	i_sqkicavsnl.exe
Token: SeDebugPrivilege	5528	i_icaxvpnhfa.exe
Token: SeDebugPrivilege	4212	i_snkicausnk.exe
Token: SeDebugPrivilege	4176	i_rpkhczxusm.exe
Token: SeDebugPrivilege	1608	i_eczurmjecw.exe
Token: SeDebugPrivilege	2276	i_tromjdbztr.exe
Token: SeDebugPrivilege	4356	i_ebztrljdbz.exe
Token: SeDebugPrivilege	5728	i_bywqoigayt.exe
Token: SeDebugPrivilege	2544	i_qnigaysqki.exe
Token: SeDebugPrivilege	5576	i_axvsnifdxv.exe
Token: SeDebugPrivilege	1996	i_fdavpnhfdx.exe
Token: SeDebugPrivilege	5536	i_hczxrpnhfc.exe
Token: SeDebugPrivilege	4372	i_xrpmhezwup.exe
Token: SeDebugPrivilege	5152	i_wrojhbzwur.exe
Token: SeDebugPrivilege	3628	i_ebztrojgbz.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4304	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4644 wrote to memory of 4464	4644	2026-07-21_d5c7f830848617b4733684a2823e8640_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	89
PID 4644 wrote to memory of 4380	4644	2026-07-21_d5c7f830848617b4733684a2823e8640_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	90
PID 4380 wrote to memory of 4304	4380	iexplore.exe	91
PID 4304 wrote to memory of 4868	4304	msedge.exe	92
PID 4304 wrote to memory of 2952	4304	msedge.exe	94
PID 4304 wrote to memory of 5796	4304	msedge.exe	95
PID 4304 wrote to memory of 2952	4304	msedge.exe	94
PID 4304 wrote to memory of 2952	4304	msedge.exe	94
PID 4304 wrote to memory of 2916	4304	msedge.exe	96
PID 4304 wrote to memory of 4212	4304	msedge.exe	97
PID 4304 wrote to memory of 2916	4304	msedge.exe	96
PID 4304 wrote to memory of 4212	4304	msedge.exe	97
PID 4304 wrote to memory of 4212	4304	msedge.exe	97
PID 4304 wrote to memory of 2332	4304	msedge.exe	98
PID 4304 wrote to memory of 2332	4304	msedge.exe	98
PID 4304 wrote to memory of 2332	4304	msedge.exe	98
PID 4304 wrote to memory of 2404	4304	msedge.exe	99
PID 4304 wrote to memory of 1488	4304	msedge.exe	100
PID 4304 wrote to memory of 2404	4304	msedge.exe	99
PID 4304 wrote to memory of 2404	4304	msedge.exe	99
PID 4304 wrote to memory of 1488	4304	msedge.exe	100
PID 4304 wrote to memory of 1488	4304	msedge.exe	100
PID 4304 wrote to memory of 4328	4304	msedge.exe	102
PID 4304 wrote to memory of 4328	4304	msedge.exe	102
PID 4464 wrote to memory of 2828	4464	omgezwrpjhbzwrpj.exe	105
PID 4304 wrote to memory of 2232	4304	msedge.exe	107
PID 4304 wrote to memory of 5144	4304	msedge.exe	108
PID 4304 wrote to memory of 2232	4304	msedge.exe	107
PID 4304 wrote to memory of 5144	4304	msedge.exe	108
PID 4204 wrote to memory of 1348	4204	wrojhbztrm.exe	110
PID 4304 wrote to memory of 5848	4304	msedge.exe	114
PID 4304 wrote to memory of 3020	4304	msedge.exe	115
PID 4304 wrote to memory of 3020	4304	msedge.exe	115
PID 4304 wrote to memory of 3200	4304	msedge.exe	116
PID 4304 wrote to memory of 3200	4304	msedge.exe	116
PID 4464 wrote to memory of 6060	4464	omgezwrpjhbzwrpj.exe	119
PID 4464 wrote to memory of 5588	4464	omgezwrpjhbzwrpj.exe	123
PID 5900 wrote to memory of 940	5900	mgeywqomge.exe	125
PID 4464 wrote to memory of 4632	4464	omgezwrpjhbzwrpj.exe	128
PID 4464 wrote to memory of 5180	4464	omgezwrpjhbzwrpj.exe	132
PID 1884 wrote to memory of 3700	1884	lgebwtrljd.exe	134
PID 4464 wrote to memory of 4688	4464	omgezwrpjhbzwrpj.exe	137
PID 4464 wrote to memory of 4652	4464	omgezwrpjhbzwrpj.exe	141
PID 1776 wrote to memory of 1732	1776	ayvtnigdyw.exe	143
PID 4464 wrote to memory of 2564	4464	omgezwrpjhbzwrpj.exe	147
PID 4304 wrote to memory of 5624	4304	msedge.exe	149
PID 4304 wrote to memory of 3836	4304	msedge.exe	150
PID 4304 wrote to memory of 6088	4304	msedge.exe	151
PID 4464 wrote to memory of 3800	4464	omgezwrpjhbzwrpj.exe	154
PID 4844 wrote to memory of 4916	4844	sqkicavsnl.exe	156
PID 4464 wrote to memory of 4764	4464	omgezwrpjhbzwrpj.exe	159
PID 4464 wrote to memory of 3740	4464	omgezwrpjhbzwrpj.exe	163
PID 2768 wrote to memory of 4720	2768	icaxvpnhfa.exe	165
PID 4464 wrote to memory of 5724	4464	omgezwrpjhbzwrpj.exe	168
PID 4464 wrote to memory of 2832	4464	omgezwrpjhbzwrpj.exe	172
PID 4804 wrote to memory of 3196	4804	snkicausnk.exe	174
PID 4464 wrote to memory of 3624	4464	omgezwrpjhbzwrpj.exe	177
PID 4464 wrote to memory of 4472	4464	omgezwrpjhbzwrpj.exe	181
PID 3752 wrote to memory of 4624	3752	rpkhczxusm.exe	183
PID 4464 wrote to memory of 6088	4464	omgezwrpjhbzwrpj.exe	186
PID 4304 wrote to memory of 704	4304	msedge.exe	188
PID 4304 wrote to memory of 704	4304	msedge.exe	188
PID 4464 wrote to memory of 5312	4464	omgezwrpjhbzwrpj.exe	194
PID 2516 wrote to memory of 3604	2516	eczurmjecw.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-07-21_d5c7f830848617b4733684a2823e8640_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-21_d5c7f830848617b4733684a2823e8640_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4644
- C:\Temp\omgezwrpjhbzwrpj.exe
  C:\Temp\omgezwrpjhbzwrpj.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4464
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wrojhbztrm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2828
  - - C:\Temp\wrojhbztrm.exe
      C:\Temp\wrojhbztrm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4204
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1348
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4816
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wrojhbztrm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6060
  - - C:\Temp\i_wrojhbztrm.exe
      C:\Temp\i_wrojhbztrm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3620
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mgeywqomge.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5588
  - - C:\Temp\mgeywqomge.exe
      C:\Temp\mgeywqomge.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5900
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:940
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2676
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mgeywqomge.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4632
  - - C:\Temp\i_mgeywqomge.exe
      C:\Temp\i_mgeywqomge.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2456
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lgebwtrljd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5180
  - - C:\Temp\lgebwtrljd.exe
      C:\Temp\lgebwtrljd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1884
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3700
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5592
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lgebwtrljd.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4688
  - - C:\Temp\i_lgebwtrljd.exe
      C:\Temp\i_lgebwtrljd.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4408
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ayvtnigdyw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4652
  - - C:\Temp\ayvtnigdyw.exe
      C:\Temp\ayvtnigdyw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1776
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1732
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5692
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ayvtnigdyw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2564
  - - C:\Temp\i_ayvtnigdyw.exe
      C:\Temp\i_ayvtnigdyw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4352
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqkicavsnl.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3800
  - - C:\Temp\sqkicavsnl.exe
      C:\Temp\sqkicavsnl.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4844
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4916
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5572
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqkicavsnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4764
  - - C:\Temp\i_sqkicavsnl.exe
      C:\Temp\i_sqkicavsnl.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4324
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\icaxvpnhfa.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3740
  - - C:\Temp\icaxvpnhfa.exe
      C:\Temp\icaxvpnhfa.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2768
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4720
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1552
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_icaxvpnhfa.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5724
  - - C:\Temp\i_icaxvpnhfa.exe
      C:\Temp\i_icaxvpnhfa.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5528
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\snkicausnk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2832
  - - C:\Temp\snkicausnk.exe
      C:\Temp\snkicausnk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4804
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3196
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5400
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_snkicausnk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3624
  - - C:\Temp\i_snkicausnk.exe
      C:\Temp\i_snkicausnk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4212
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rpkhczxusm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4472
  - - C:\Temp\rpkhczxusm.exe
      C:\Temp\rpkhczxusm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3752
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4624
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4672
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rpkhczxusm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6088
  - - C:\Temp\i_rpkhczxusm.exe
      C:\Temp\i_rpkhczxusm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4176
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\eczurmjecw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5312
  - - C:\Temp\eczurmjecw.exe
      C:\Temp\eczurmjecw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2516
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3604
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5044
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_eczurmjecw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5936
  - - C:\Temp\i_eczurmjecw.exe
      C:\Temp\i_eczurmjecw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1608
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tromjdbztr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5544
  - - C:\Temp\tromjdbztr.exe
      C:\Temp\tromjdbztr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1356
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:700
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2920
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tromjdbztr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4272
  - - C:\Temp\i_tromjdbztr.exe
      C:\Temp\i_tromjdbztr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2276
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ebztrljdbz.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5436
  - - C:\Temp\ebztrljdbz.exe
      C:\Temp\ebztrljdbz.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5628
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3832
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2960
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ebztrljdbz.exe ups_ins
    3⤵
    PID:1220
  - - C:\Temp\i_ebztrljdbz.exe
      C:\Temp\i_ebztrljdbz.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4356
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bywqoigayt.exe ups_run
    3⤵
    PID:4168
  - - C:\Temp\bywqoigayt.exe
      C:\Temp\bywqoigayt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4412
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2024
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4560
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bywqoigayt.exe ups_ins
    3⤵
    PID:1932
  - - C:\Temp\i_bywqoigayt.exe
      C:\Temp\i_bywqoigayt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5728
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qnigaysqki.exe ups_run
    3⤵
    PID:2344
  - - C:\Temp\qnigaysqki.exe
      C:\Temp\qnigaysqki.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3836
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4940
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4152
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qnigaysqki.exe ups_ins
    3⤵
    PID:988
  - - C:\Temp\i_qnigaysqki.exe
      C:\Temp\i_qnigaysqki.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2544
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\axvsnifdxv.exe ups_run
    3⤵
    PID:5992
  - - C:\Temp\axvsnifdxv.exe
      C:\Temp\axvsnifdxv.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4776
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2552
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5968
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_axvsnifdxv.exe ups_ins
    3⤵
    PID:1936
  - - C:\Temp\i_axvsnifdxv.exe
      C:\Temp\i_axvsnifdxv.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5576
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fdavpnhfdx.exe ups_run
    3⤵
    PID:5748
  - - C:\Temp\fdavpnhfdx.exe
      C:\Temp\fdavpnhfdx.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5380
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4400
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3108
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fdavpnhfdx.exe ups_ins
    3⤵
    PID:2596
  - - C:\Temp\i_fdavpnhfdx.exe
      C:\Temp\i_fdavpnhfdx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1996
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hczxrpnhfc.exe ups_run
    3⤵
    PID:6036
  - - C:\Temp\hczxrpnhfc.exe
      C:\Temp\hczxrpnhfc.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2524
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1832
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5148
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hczxrpnhfc.exe ups_ins
    3⤵
    PID:800
  - - C:\Temp\i_hczxrpnhfc.exe
      C:\Temp\i_hczxrpnhfc.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5536
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xrpmhezwup.exe ups_run
    3⤵
    PID:5848
  - - C:\Temp\xrpmhezwup.exe
      C:\Temp\xrpmhezwup.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4564
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2200
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3880
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xrpmhezwup.exe ups_ins
    3⤵
    PID:2324
  - - C:\Temp\i_xrpmhezwup.exe
      C:\Temp\i_xrpmhezwup.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4372
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wrojhbzwur.exe ups_run
    3⤵
    PID:4164
  - - C:\Temp\wrojhbzwur.exe
      C:\Temp\wrojhbzwur.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6004
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5448
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2152
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wrojhbzwur.exe ups_ins
    3⤵
    PID:5948
  - - C:\Temp\i_wrojhbzwur.exe
      C:\Temp\i_wrojhbzwur.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5152
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ebztrojgbz.exe ups_run
    3⤵
    PID:2468
  - - C:\Temp\ebztrojgbz.exe
      C:\Temp\ebztrojgbz.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4120
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3732
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1172
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ebztrojgbz.exe ups_ins
    3⤵
    PID:468
  - - C:\Temp\i_ebztrojgbz.exe
      C:\Temp\i_ebztrojgbz.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3628
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rojgeytrlj.exe ups_run
    3⤵
    PID:1236
  - - C:\Temp\rojgeytrlj.exe
      C:\Temp\rojgeytrlj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5652
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2372
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4548
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x220,0x304,0x7ffec25dc188,0x7ffec25dc194,0x7ffec25dc1a0
      4⤵
      PID:4868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1880,i,5286394036682576817,9969216884809494654,262144 --field-trial-handle=2540,i,64971942848333224,26383811173537779,262144 --variations-seed-version --mojo-platform-channel-handle=3204 /prefetch:2
      4⤵
      PID:2952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2044,i,15108990126787172448,7610375242750401253,524288 --field-trial-handle=2540,i,64971942848333224,26383811173537779,262144 --variations-seed-version --mojo-platform-channel-handle=3304 /prefetch:11
      4⤵
      System Time Discovery
      PID:5796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2456,i,2339626061218649156,16763600252558128262,524288 --field-trial-handle=2540,i,64971942848333224,26383811173537779,262144 --variations-seed-version --mojo-platform-channel-handle=3400 /prefetch:13
      4⤵
      PID:2916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3404,i,1064206684601679030,14379213318823175819,2097152 --field-trial-handle=2540,i,64971942848333224,26383811173537779,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
      4⤵
      PID:4212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3412,i,2979760985423574358,12861309359593629369,2097152 --field-trial-handle=2540,i,64971942848333224,26383811173537779,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
      4⤵
      PID:2332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4256,i,7077874976424678495,4187049915484141785,2097152 --field-trial-handle=2540,i,64971942848333224,26383811173537779,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:1
      4⤵
      PID:2404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,2614157189424323411,3443982425983539173,2097152 --field-trial-handle=2540,i,64971942848333224,26383811173537779,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:9
      4⤵
      PID:1488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,10682890674194605493,2775702948767362600,524288 --field-trial-handle=2540,i,64971942848333224,26383811173537779,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:14
      4⤵
      PID:4328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,14462737979305680688,16884923858861121791,524288 --field-trial-handle=2540,i,64971942848333224,26383811173537779,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:14
      4⤵
      PID:2232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3780,i,936510188621309673,15278143424714547770,524288 --field-trial-handle=2540,i,64971942848333224,26383811173537779,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:14
      4⤵
      PID:5144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,5600494520148426755,9354661595092775926,524288 --field-trial-handle=2540,i,64971942848333224,26383811173537779,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
      4⤵
      PID:5560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,5600494520148426755,9354661595092775926,524288 --field-trial-handle=2540,i,64971942848333224,26383811173537779,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
      4⤵
      PID:5848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,8794476260039118050,10278721039277628796,524288 --field-trial-handle=2540,i,64971942848333224,26383811173537779,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:14
      4⤵
      PID:3020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6704,i,5580244881155252667,9655751514872660946,524288 --field-trial-handle=2540,i,64971942848333224,26383811173537779,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:14
      4⤵
      PID:3200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1404,i,17601642136804020681,5491018539217372858,524288 --field-trial-handle=2540,i,64971942848333224,26383811173537779,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:14
      4⤵
      PID:5624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1416,i,13283697053572798435,5246725614815330356,524288 --field-trial-handle=2540,i,64971942848333224,26383811173537779,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:14
      4⤵
      PID:3836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1424,i,9032324920724412361,10160478146764578988,524288 --field-trial-handle=2540,i,64971942848333224,26383811173537779,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:14
      4⤵
      PID:6088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6176,i,7606066889435120777,3249487211046140722,524288 --field-trial-handle=2540,i,64971942848333224,26383811173537779,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:14
      4⤵
      PID:704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,15385044649164819352,1896513097633951356,524288 --field-trial-handle=2540,i,64971942848333224,26383811173537779,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:14
      4⤵
      PID:4976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,5224709516994096796,14502929449124697605,524288 --field-trial-handle=2540,i,64971942848333224,26383811173537779,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:14
      4⤵
      PID:4152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,10643730963487116961,8835582753567073823,524288 --field-trial-handle=2540,i,64971942848333224,26383811173537779,262144 --variations-seed-version --mojo-platform-channel-handle=1424 /prefetch:14
      4⤵
      PID:5020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6664,i,14505066986543897325,12240900096357483147,524288 --field-trial-handle=2540,i,64971942848333224,26383811173537779,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:14
      4⤵
      PID:2468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5000,i,8181540178563305908,16111058033257607898,262144 --field-trial-handle=2540,i,64971942848333224,26383811173537779,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:10
      4⤵
      PID:4608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,2872872378555316803,17006257647358157540,524288 --field-trial-handle=2540,i,64971942848333224,26383811173537779,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:14
      4⤵
      PID:4284

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3624

C:\Temp\omgezwrpjhbzwrpj.sys
C:\Temp\omgezwrpjhbzwrpj.sys
1⤵
- Executes dropped EXE
PID:4472

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3624

C:\Temp\eywrojhbzt.sys
C:\Temp\eywrojhbzt.sys
1⤵
- Executes dropped EXE
PID:5920

C:\Temp\lgeywtoljd.sys
C:\Temp\lgeywtoljd.sys
1⤵
- Executes dropped EXE
PID:1372

C:\Temp\gdbvtqljdb.sys
C:\Temp\gdbvtqljdb.sys
1⤵
- Executes dropped EXE
PID:4996

C:\Temp\ysqlidxvtn.sys
C:\Temp\ysqlidxvtn.sys
1⤵
- Executes dropped EXE
PID:5844

C:\Temp\sqkifaxvqn.sys
C:\Temp\sqkifaxvqn.sys
1⤵
- Executes dropped EXE
PID:4732

C:\Temp\spkicausmk.sys
C:\Temp\spkicausmk.sys
1⤵
- Executes dropped EXE
PID:2804

C:\Temp\uspkhcausm.sys
C:\Temp\uspkhcausm.sys
1⤵
- Executes dropped EXE
PID:2320

C:\Temp\mheczurpmh.sys
C:\Temp\mheczurpmh.sys
1⤵
- Executes dropped EXE
PID:3656

C:\Temp\gecwromhec.sys
C:\Temp\gecwromhec.sys
1⤵
- Executes dropped EXE
PID:3724

C:\Temp\ywtrljgeyw.sys
C:\Temp\ywtrljgeyw.sys
1⤵
- Executes dropped EXE
PID:4352

C:\Temp\dbvtoljgay.sys
C:\Temp\dbvtoljgay.sys
1⤵
PID:5044

C:\Temp\yvqnigdyvq.sys
C:\Temp\yvqnigdyvq.sys
1⤵
PID:1148

C:\Temp\tnlfdxvqni.sys
C:\Temp\tnlfdxvqni.sys
1⤵
PID:3656

C:\Temp\fdxvsnkfdx.sys
C:\Temp\fdxvsnkfdx.sys
1⤵
PID:2060

C:\Temp\fzxrpnhfca.sys
C:\Temp\fzxrpnhfca.sys
1⤵
PID:4620

C:\Temp\czxrpmhecw.sys
C:\Temp\czxrpmhecw.sys
1⤵
PID:4540

C:\Temp\ezwrpjhbzw.sys
C:\Temp\ezwrpjhbzw.sys
1⤵
PID:5968

C:\Temp\eywuomjhbz.sys
C:\Temp\eywuomjhbz.sys
1⤵
PID:3108

C:\Temp\oljeyvtrlj.sys
C:\Temp\oljeyvtrlj.sys
1⤵
PID:2448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ayvtnigdyw.exe

Path C:\Temp\ayvtnigdyw.exe
Size 365KB
SHA256 375c70a0b05d7612ca01cdbb8e19c280f018c9ab8fe107bf0f8c3bc2517ad602
MD5 76c021fb971aa4ee152138ce5d219e5e
SHA1 174d2a4aae2fad8b40ff38ad5b3868169da7db8e
SHA512 e60f1eee69990f70ff1b55605df2bc734de3cb2920aab018940ee34c9ed31d7d2608365fb832653e71c7119397c48994bcc30b6848cd7682894e378115fd19e2
SSDEEP 3072:BuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:BuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T176847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eywrojhbzt.sys

Path C:\Temp\eywrojhbzt.sys
Size 293KB
SHA256 af1a94ffc18e5dfb10cbac33446070350cb386cc9447b91100ed0819d38cff61
MD5 37a45f0d213b110cf5d4077e22890c1a
SHA1 d1cc7e6f91c401bf1157ab23c8f7e00130e610bd
SHA512 1e283ca6ab6554c2cfc525d18253e50f88d8a2863ba302954f3b8a270a819013e7bc7ad91dd82c83514ac6923b327787f537c963801414e2247f59bfae5c4e32
SSDEEP 3072:6tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:6IJjiJcbI03GBc3ucY5DCSj
TLSH
T165545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gdbvtqljdb.sys

Path C:\Temp\gdbvtqljdb.sys
Size 293KB
SHA256 9b6f67b192e7f521214fb913542be984f0b580377bd446be8b0408d1efc99b3d
MD5 dc513252fe8d2ced43640f8fb495f6eb
SHA1 b68ac9fb2697bb9b79a36d4d73f99270f83853fa
SHA512 97c3160c5081875791c5f57932c28cd16a33ccb2393d088a561af720d35ccae00e65fa3227770075e05c1c33d64af6d38542be67593f9de96511c8d5fc7c084a
SSDEEP 3072:utKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:uIJjiJcbI03GBc3ucY5DCSj
TLSH
T1B9545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ayvtnigdyw.exe

Path C:\Temp\i_ayvtnigdyw.exe
Size 365KB
SHA256 e802b33f34bb1939dccb8b8174dc1cd4a8ff92e4d64d8b1d2200251aae2709f8
MD5 8b8554d57086a8875c6044ad048e633a
SHA1 7090c5ce88795efd23776af39062b00e01ae02b4
SHA512 0746929193cb5a4a5c4fedeabf6942dc7cecb195b6f8b8747d02f933538c64d4cc3d62b03c355aaa57c540f56bc18655dadbacdb118ac140af7f6b2cf4d8aeac
SSDEEP 3072:19uxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLB:3uxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T19A847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lgebwtrljd.exe

Path C:\Temp\i_lgebwtrljd.exe
Size 365KB
SHA256 aa54e197a0adec85cda7dc2eebe605cd0691c0f72fd1ff11b52e696f1fc99de2
MD5 56a4fc69572cb321a49db61ebd6d7b4a
SHA1 3d64bb2bfa325127383a11816d630a793df89a61
SHA512 cdb32400ddf3c6820b270c5b5717710fc7134f9d73e0391357e00cda282f954f0fcf40ffc5f493021e31c1545494c756e05c9d67912b5012e37489e873a93f61
SSDEEP 3072:TuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:TuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1AA847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mgeywqomge.exe

Path C:\Temp\i_mgeywqomge.exe
Size 365KB
SHA256 ebdd7fb37a32d68875c37481359cfbfb9cd7c0e8680ddba68991534ad08ff9d9
MD5 d11df244541a5874d7bcd8636b54ca8f
SHA1 53e4b3f423b6e3e03443c19f61f2219737db2743
SHA512 e8ad884d42e5b3db09b2c947d6ddc763c8c1269f410080a2dd54e91bfad0911a7d731da3a35d9cebce35ea89bb24afda680798e7bf5ad1d1f450ec6cd3a3cfed
SSDEEP 3072:fuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:fuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C4847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_sqkicavsnl.exe

Path C:\Temp\i_sqkicavsnl.exe
Size 365KB
SHA256 a540650fdb53b9517dc65ab6db64d34e357ce1eb9535f9bea2d2703031164a6b
MD5 a6da6198b12bf575410e6cd621c38b45
SHA1 057f00d25b15fe2ba7fbc19fb09996dc98b957e4
SHA512 d2f8a7777cfac0857d4608a3d31f42c32389afb2b6f0e0927b0bf069d1eb921f69d618df5c1917872f965dd9f914b9ced4446fd2bdba84cb40e692ca4813ded2
SSDEEP 3072:CuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:CuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D9847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wrojhbztrm.exe

Path C:\Temp\i_wrojhbztrm.exe
Size 365KB
SHA256 2251ce8b479b153aa1b54db43f6d521359738aa46f404a4a8f20a37832d03cd7
MD5 66f5e671796c3a1ffb91215ab69b8dbf
SHA1 8450aec7e18570bf62f4ec08c9820364686518c2
SHA512 91f65043d5b0dc4ebc9b1687f28e130c8e21678c6f1cae488b09ac66b79e60eb4c35da1b304b7c23a64154b12947e9459a3c4adbeb7a8238eb14a637bf8554a7
SSDEEP 3072:zuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:zuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T106847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icaxvpnhfa.exe

Path C:\Temp\icaxvpnhfa.exe
Size 365KB
SHA256 6ee189721eaf4455bcf891878a1220ceb0810c40b3002828c83c91d1d409865f
MD5 77c18010da3e05a412d8317ba9dbbae7
SHA1 8b33fb0d528351d3a6dc5b65a005da2b7a9a9f53
SHA512 9861a1e3aef89664506d2e76aff162b9c18faeb20270999c72f4625a7201c3724f57e3ae92b3dda8dfd4b7cd4ce8ef4f3ac7f83bb422c5d7911e7dec615f4517
SSDEEP 3072:UuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:UuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T100847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgebwtrljd.exe

Path C:\Temp\lgebwtrljd.exe
Size 365KB
SHA256 72c6d4c10008542515223bb6f6068f8beb38e27270f135c714a81532b426ce4e
MD5 d037de80aa1ece4191003808f13dd6ad
SHA1 4dc187490735e8fb10381f9eef54d45d0415199e
SHA512 c61440688bebc89c1f8536c2cd6b3b9670b16b426b66862653821f4d48a012e3ff85307e9729f29833e877854e4906c1c7831d3ba05ebe40bcf492fd9a05e0d7
SSDEEP 3072:HuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:HuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T129847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgeywtoljd.sys

Path C:\Temp\lgeywtoljd.sys
Size 293KB
SHA256 6b8e8445643a2fc55891a8974b82a28a599140b3d78da2de429fd272da3724f5
MD5 4787ef9dd5d7fb7a7906cac92151bba6
SHA1 79559066014d76756410ae3e63b74cee7ecde09d
SHA512 fa46e4defc2016517990e816463e7e285acb73d4a317fb01c68e64eb46ec9cc69ecdbac4321f09320defe0ae0ecdcfbd38f66ff8a63495dabfd27091fbd3b93f
SSDEEP 3072:ftKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:fIJjiJcbI03GBc3ucY5DCSj
TLSH
T150545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mgeywqomge.exe

Path C:\Temp\mgeywqomge.exe
Size 365KB
SHA256 acd4b4e2a68577cb90db8dd3ba04abe281de20c2182c3bf155ca1c44417950ac
MD5 4e4d327df6d4e2cf886bbf45b92f8839
SHA1 10715749b05f0bb442c1aec6affd66adebdc249c
SHA512 7de991fb0e3092b1ac59c7154a3b2f59a2bc09cddbce20d8922dc9ca6a5197683e26c7b3364acbc557567baed765ce4dfbe2fc2bf12204930e28bf61f082abd1
SSDEEP 3072:ouxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:ouxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1AC847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omgezwrpjhbzwrpj.exe

Path C:\Temp\omgezwrpjhbzwrpj.exe
Size 365KB
SHA256 279a55b162f1f09b3151906e94c5223cd1c9075150fa656bb5851f094f6a8dd4
MD5 3a4224cadf4ce57f604b8bdb071b9be5
SHA1 3de8f573a4a52ca39d530108a4589e7c14516996
SHA512 bda2e462ff82d497a413aa1e71923ca64c559c4bef1b487565c2cdfe26758cd339f2f5b70bf37e33b4e4ecbf1d212f5de73adafd1f71fade19bd46117a6c117c
SSDEEP 3072:yuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:yuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A3847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omgezwrpjhbzwrpj.sys

Path C:\Temp\omgezwrpjhbzwrpj.sys
Size 293KB
SHA256 21fa4ebfbc6030d11049a922abf89d5c1342d44d63545d367bdabe32528c2537
MD5 d3e5c86f9c391ff870eda54d4f782103
SHA1 4bc847964024c34227d574b4991073e601adafeb
SHA512 bdce6ca6f37daa8479687f0f0fee5434d88313fc4303a299ae40596fc8fbb0e7be0d684caeb923dce3fb3011dd901f10f1294c88742dd1518e9d108dbc37b955
SSDEEP 3072:NtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9Edt:NIJjiJcbI03GBc3ucY5DCSj
TLSH
T15D545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqkicavsnl.exe

Path C:\Temp\sqkicavsnl.exe
Size 365KB
SHA256 5ab5d5ac11a36f6a749928fed60d9a3f8f454f139e472b7047474235894e8d55
MD5 90fe35bdc9fd0910f1c5da19054d8e48
SHA1 ff28acd827bc7b90b8086e17759166731ad95e87
SHA512 760d4718505786281e71783329a3d609a504d5e2e7656d8b6ae4c3796b64e2a5083ac5bd33fd977fa2a043a8bfab5783261ceb42f9815b844f8c73a0267e41ef
SSDEEP 3072:/uxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:/uxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T19E847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqkifaxvqn.sys

Path C:\Temp\sqkifaxvqn.sys
Size 293KB
SHA256 6797df2ad99a766d2fdabc12d5faab079e40b073e77040f7797a48ba9c7c3f45
MD5 122e6092f906dc19e8984ee601f82aa2
SHA1 ed782bd098f85c314e3e2e604e27d1721bd4532e
SHA512 9e62d58705ed51f704709d3887f5d16f1c7ea369bf8e1887401587664f4855d43e688d9b7f15cca69a423f4b4ce8e4918b483d1db34d85a313201a9e5b34b59b
SSDEEP 3072:ktKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:kIJjiJcbI03GBc3ucY5DCSj
TLSH
T11D545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrojhbztrm.exe

Path C:\Temp\wrojhbztrm.exe
Size 365KB
SHA256 038b294b5c2971aa8c52bd00541b6c153a6e3af1561aabd41dbac44be7af56f5
MD5 5bbb322dd013e73c20543a50b89143f5
SHA1 de08cbcabd32f55ec69d4e24865cbacac5ef1b39
SHA512 2500c46f045d224631a0695bece8ba059689360403f8643104914831d6913439e142d5b98a2fd3118dd3c7cb74beac8c6f24d435bb5751fdb8cf6092ed2553c1
SSDEEP 3072:ruxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:ruxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T11E847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ysqlidxvtn.sys

Path C:\Temp\ysqlidxvtn.sys
Size 293KB
SHA256 e559614a04a01310a34b2b5548726cae16e0973eb807747ef2695b51ff42cacd
MD5 d6117ef9fae5475f0d445967ff008f03
SHA1 42dabe8fda8f1ada4da34ed68ae073ce61b7dbe8
SHA512 27a184c8bec0fd289e6052e4bcf1819be7236e0c0b27844222e0540f21073aa1092b05d4edfa066f8485498ad76df45d1017687021bbd470fb54e0e7ea878da5
SSDEEP 3072:JtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:JIJjiJcbI03GBc3ucY5DCSj
TLSH
T19D545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9df7d4673162784b06482b0ea0466fcd89698f28dbae9b6ff03b6f1de967d2ad
MD5 fca0c51972c2898605470c263ee6f406
SHA1 c8d35da8f0ac67353cdaa9a26cf070eaf4ed20e4
SHA512 ad00645b4329a6f1ef379c5d5d01f0d88620a673dd8a5fe412853687cab95bea661b5f501af152ed5c2dab3970dcfb8831b73c01815c8726541d30a502e83cb9
TLSH
T16661EC5493611EF2CBE94AB3F2F06C9833E88446668B2A0DC05EAFF51406F5D93E1633
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe598488.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe598488.TMP
Size 3KB
SHA256 8c877642c9e427670668becb176346bf7d99fc040a651b816c0a1eb372f89032
MD5 33a4e50915602e6d7f01d781420b0d70
SHA1 07af6b98ce09e5b61701335f22282fd04e6c140e
SHA512 79f25b47756423f28d798c0aab501750a0389fd50943281e7f8b5905297fbd9b9b2484658b72e87992124d27f13e9ffa611c26df3008bb79dc52586560865d2f
TLSH
T16E61FE5493611EF2CBE94AB3F2F06C5833E88446668B2A0DC05EAFF51406F5D93E1633
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 171b933b9dbfd0f0e9e6bed4acc04398f2920991b683fec6c508ac15fd74ce62
MD5 f45439abf5298eea23661c39e5fb5a56
SHA1 1c330f48675efc1f497ca7c11e896504fd59a89b
SHA512 f2b081f8d18fcb47eab93bcfe598c07b35a6b1396cb018753ceddfd4a547582cec27bb2d0e294e4f6cce520110878745d56e521f4fce9364e5bda09eaefa783f
TLSH
T10451ADF7C7E8862E890196F0AA187E1BCE1D0914832C7D5AC8E4EF1BA3E2471D14159F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 68721d57ed8b4d1e7d34aece3509942c0cda41f191216dad1c34f6721216612f
MD5 37e0af4b1a74743b70b01d5624e4e5ad
SHA1 1de9d0a938e784e9dca4ae034751828f7be430ea
SHA512 7185ed5d10b8af24765f2b66d43c457b2fc2488d38434f153c47a16221e30198c131c7961f38dfc061267a2a9bfd249b7bf894b6a8b655626b6540371855568e
SSDEEP 384:sxRGsk8i/foskvSX9gbFG/5w/Q/fYRDhTp:siyi/fwS1/5hgR7
TLSH
T14B62D915AA245D7B8CDBD209FA557F53D6F91563E2901E48AAFC8E0C00E6ADD2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 c12188722e3c7965a1bce44934a71aeb2c69c6cf8fa80daed4b6561bebabb0d2
MD5 50149ca3857f378952a026791df316f7
SHA1 ed20c672be0831255a263908d1e8ce16530aa542
SHA512 a9c5dc01ffb9fe4a44d8fb3b26673f8b22b688b392a15c71df837e36f2fd28205feab534f1443da4062f34de732d3d92907df99403e5adc0e6818546381bb8cf
SSDEEP 384:sxRtskqri/fosCYvHX9gbXG/5w/Q/fYKDhT08:sJsri/fvH7/5hgK9
TLSH
T17862D916AA245D778CDBD209FA517F53D6F95573E2901E48AAFCCE0C00E6ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 b8b2bf45cd61395cf1acd52337464425a4139af679e9aa6fdf804d8ce6f1fa6e
MD5 72cec12dfe2f8479f97c7813760ee702
SHA1 0aa7bd0c3d2c9055334d82079f88a0a126ed611d
SHA512 902fd2ffd23578cddad0087faa24ce143ba33697d61e3f41c476bc721048712e221fb2c4b8a2640f6ccfb8d5ef08bef91ebd7d2240402bf53bcf9b03b02ae8cb
SSDEEP 384:sxRtsk8i/fosCYvSX9gbFG/5w/Q/fYRDhT0+:sJyi/fvS1/5hgRT
TLSH
T1FE62D915AA245D7B8CDBD209FA557F53D6F91563E2901E48AAFC8E0C00E6ADD2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 b8901061d3dd7ae19d665c8d92fcfdec64b2850e49f681094cacc2362f951b67
MD5 4342c92466550905ae40e3f0c4775c4b
SHA1 07b221b8146beea83a8535406965824936404cc0
SHA512 9afe35cd93158524dbec6a3892729ebf88008911f5f7f71256697a499f50dedc3cafd82d3848f506ce22f9ad392d58ae5a100d2571e397a3c1201c9d64cc2847
SSDEEP 768:wGedCg7pLuL7X6WgoufDM8F1+UoAYDCx9Tuqh0VfUC9xbog/OVkAOu4YrroSW8lg:wGedCsE7X6WgoufDMu1jaDAOVYY8g
TLSH
T136E2DB7B680CCB7E4F804ADCEC29BE9F6DA801CB96D88D5447EA840C03C66EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 cf41181697ecf1ef2e9d0d0cb26e745ff05ae4a51d52678a4095fa5ad1b28656
MD5 4fa27c1883f288b25daf24f43425b5fe
SHA1 7bcb03622ce1cceb976ce73b37bdf0a4eb425e9b
SHA512 e5a7d2b52ea019144b4b7d999bba81446b60241bf3ba569a6d98937236435d1f82873a2e6e34c6b3825fbc7c3626ee94b925cd6bc28174810cf77ab3a75d32bf
SSDEEP 96:KReTieYgQGWAltgeGK4DgcGcW+9M+XHklQUuSW0Wyf/gc0K4xgW0cUUfOrJCKaI0:CeTieYgQxAl+eODgc1W+9M+XHklQUuSM
TLSH
T18691641535BA079438BFB94881669C6A92C574B63204F52B3BE901E60F27E53CDFF4C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a2348.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a2348.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 2fece8edd18c2fbfe77025e9517462bb7bd157242a2ecef6072f2c5f6624a527
MD5 bb8fe1724be2bcb2802b278d45c1742e
SHA1 c72761ae861a8267848d8c1b844a207256d3f537
SHA512 4944ae6162418969249d906cbfef332ecfde59a51393714dcf7108402a9468047096eedb458be0c04ca5a8fb905f4f28e9ac2db17a5dc1ab486802f11eab638f
SSDEEP 768:6rv+4UNbds31iDZIO0CEl8dNzc4ReyIsXTeVH1S5D:6bsbS3CDtc44bsjEH1Y
TLSH
T19003CF36E8689977ACF69685B44B76133EF8612B82C81ED4C5DE2F0C4A4B5DD130F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 82a9d56c05553495da2c244cacdf4dc44c8d42013897d7df409a8d9a358d0e36
MD5 8750572b8b4f6a68348adfa0741a70b7
SHA1 12e63ed31f849ccb40783b7ebed1a063087bd397
SHA512 d856cb890c0a3701e99dadbe3858d8aeeea0a7a25bba7eb4e2bc2a6dd250878c6588c540fa199dc2a95b0e93da61731946fa61557c1f99496c9fde4b5d813c9d
SSDEEP 768:Sj+9b3UXDZIO0CEl8siNzc4ReyIsPkMVcLCO7w/s:h9b38iitc44bscHCt/s
TLSH
T1CEF2CF35E8268C67ECEAA742F5033A837EF0516B85C82E99E5ED5F0C058B39C071B427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 bcba8dbd50505c6aec1dc44a17c07454fcc4a9e4226d9f5cb932a83ae7ea2a01
MD5 1011667752885fdac508b05f0fc17e61
SHA1 7a3f07208fae4d05d79218d3e46bb98f44c6b573
SHA512 00065258f4c0a1b8ba73ec28462b0b231d141c060cc4906e330b3648807fb86032813b8cf903f6f733869be4977ecdfec3bfc8f95b3a8e13fdeaab1cd75bc5b7
SSDEEP 768:1j+9b3DXDZIO0CEl8siNzc4ReyIsPkMVcLCO7w/s:A9b3hiitc44bscHCt/s
TLSH
T12FF2CF35E8669C67ACEAA742F5033A837EF0516B85C82E99E5ED5F0C058B39C071B426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 7efa7d7381c967f193e45883c1882059bf6a085c7ddc2607738f97498eb57553
MD5 e68b84e8029f1541fbbcc72bd640bd52
SHA1 ed213ecddd3f515c2375affd76a8c0eb73e4a138
SHA512 81494a60dc27bb8313c22f5c86bce597a8a715306b3e0f5a7e5e256e3a2a625f981705a8156be8669b2739f3cc7fd9da71de39c47ebda6b247116d758f795d8a
SSDEEP 768:0rv+4UNbdl3d+XDZIO0CEl8siNzc4ReyIsPkMVcLCO7w/8:0bsbn3d2iitc44bscHCt/8
TLSH
T15F13CF32E8698D73ACFAA642F44735837EF4216786C81E98D5EA1F0C064B6DD171F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 c397a6d9c0c039a136cfb42f914cad737346c962a733266e03bef6fa96c8595d
MD5 acb229b1d420e4aab1e15b3d22adfbfa
SHA1 fa3f5b8a76853ae5a5fbd24c7097c71d30eed71a
SHA512 352b9f6cc775c1652b5b03228aace4f764c3624bb0a22be38c0e186b8b851ac33e89de03b3ce1827f87ddcd38c1e343665517b761609dc0b5af7cd2bff33bd87
SSDEEP 768:JF1j+9n33wga2ZQ5O0CEl8sONzc4ReyIsPkMVcLCO7w/s:49n3HiOtc44bscHCt/s
TLSH
T1EF1318F598D38977ECAD5783A73E2D4669FCC167B5881894B7991E0CCC462BFC30A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

32089e41-4144-4e18-9466-c7918f754e87.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\32089e41-4144-4e18-9466-c7918f754e87.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4304_2084103862\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 0b19f43e520fa66421ad223d57633f83ed57afacc5ef113572adc1c21454b01f
MD5 96cfec9167f69164453551ea4e603977
SHA1 f5079ea82a763645fe3eb906583689bf77bc0c7e
SHA512 40e62dfa33a186869942ade11b0c2175c86bf4706e74026b40e1371f9fb83d6ee88a7248aea9f615b6749bd3f210bdf99d774400f6e54c4757c024e3691cc283
TLSH
T15D71239357B9CAF3C5DA5BF502835648F5FF22380B3330244B565586AB30A7A28B9F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1148-412-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1372-238-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2060-436-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2320-319-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2448-501-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2804-320-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3108-484-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3656-416-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3656-324-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3724-343-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4352-372-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4472-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4540-452-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4620-447-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4732-291-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4996-266-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5044-392-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5844-278-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5920-191-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5968-472-0x0000000000010000-0x00000000000AB000-memory.dmp

Download