systex | 43ae021860aaa4a2161281af5f6d6dc78227545b69e45073cfa580088d3a4c7d

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/08/2026, 16:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-07_023a1a1a7ba0808363db46e529842c7d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Size 365KB
Sample260807-t4nvbagh52
SHA256 43ae021860aaa4a2161281af5f6d6dc78227545b69e45073cfa580088d3a4c7d
MD5 023a1a1a7ba0808363db46e529842c7d
SHA1 9ac230c8a6ee832b3255a981d869b300204e2f8b
SHA512 c152c0f6fb6dbc6ea39cb55e3fdcaeb59af1bcd7084759d4d48c787fc7a4fc85f828af2762e2399f419cd3bbe7d9c5addbd677dda4233d07ae395e0074a8661e
SSDEEP 3072:EuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:EuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T18C847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
3304	ljdbwtoljdbwtolj.exe
2548	ljdbwtoljdbwtolj.sys
1436	CreateProcess.exe
5096	oigbywqomj.exe
2820	CreateProcess.exe
4648	CreateProcess.exe
5160	i_oigbywqomj.exe
5908	ysqlidbvtn.sys
4936	CreateProcess.exe
2548	qljdbytqoi.exe
544	CreateProcess.exe
2776	CreateProcess.exe
4252	i_qljdbytqoi.exe
1504	vtnlfdyvqn.sys
6132	CreateProcess.exe
3580	nkidayvpnk.exe
2632	CreateProcess.exe
2344	CreateProcess.exe
5332	i_nkidayvpnk.exe
5936	vsnkfdxvpn.sys
3692	CreateProcess.exe
5952	kicausqkic.exe
4388	CreateProcess.exe
3104	CreateProcess.exe
5824	i_kicausqkic.exe
2804	nhfdxvpnki.sys
476	CreateProcess.exe
4560	hfaxspkica.exe
4584	CreateProcess.exe
1960	CreateProcess.exe
2440	i_hfaxspkica.exe
2608	rpmkecxupm.sys
6120	CreateProcess.exe
4916	xupnhfzxrp.exe
5284	CreateProcess.exe
5088	CreateProcess.exe
6076	i_xupnhfzxrp.exe
4620	rpjhezxrpj.sys
4672	CreateProcess.exe
3496	uomgezwrpj.exe
4852	CreateProcess.exe
5900	CreateProcess.exe
4024	i_uomgezwrpj.exe
2516	wuomjhezxr.sys
3536	CreateProcess.exe
5156	romgeywqoj.exe
4020	CreateProcess.exe
4792	CreateProcess.exe
5220	i_romgeywqoj.exe
6088	wuomgeywro.sys
5064	CreateProcess.exe
3020	rljgbztrlj.exe
4308	CreateProcess.exe
5756	CreateProcess.exe
4072	i_rljgbztrlj.exe
2388	gbywqolgdy.sys
456	CreateProcess.exe
4556	eywtqljdbv.exe
608	CreateProcess.exe
5436	CreateProcess.exe
1100	i_eywtqljdbv.exe
4328	qoigaysqki.sys
4128	CreateProcess.exe
4164	oigaysqkid.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1272_1184826770\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1272_1624282868\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1272_41515375\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1272_1926891951\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1272_1926891951\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1272_1624282868\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1272_41515375\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1272_1926891951\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1272_1926891951\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkidayvpnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkidayvpnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xupnhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhezxrpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vqnlgdyvql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigaysqkid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigaysqkid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axspnlicav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztrojgbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xsqkicavsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfaxspkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigbywqomj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	romgeywqoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_romgeywqoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtrljdbvto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qljdbytqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomgezwrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnkfcaurpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztrojgbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfaxspkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kicausqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljgbztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywtqljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xsqkicavsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwromgezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtrljdbvto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vqnlgdyvql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicausqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axspnlicav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xupnhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbwtoljdbwtolj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomgezwrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljgbztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnkfcaurpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhezxrpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwromgezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywtqljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-07_023a1a1a7ba0808363db46e529842c7d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigbywqomj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qljdbytqoi.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5060	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5112	ipconfig.exe
5668	ipconfig.exe
2576	ipconfig.exe
3376	ipconfig.exe
2704	ipconfig.exe
5920	ipconfig.exe
4308	ipconfig.exe
6080	ipconfig.exe
5444	ipconfig.exe
5592	ipconfig.exe
696	ipconfig.exe
2908	ipconfig.exe
1624	ipconfig.exe
5428	ipconfig.exe
2564	ipconfig.exe
540	ipconfig.exe
3512	ipconfig.exe
3324	ipconfig.exe
980	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134305942219927041"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{6433FF8D-8099-471F-9E6F-2B4E013CD7A7}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1240	2026-08-07_023a1a1a7ba0808363db46e529842c7d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1240	2026-08-07_023a1a1a7ba0808363db46e529842c7d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1240	2026-08-07_023a1a1a7ba0808363db46e529842c7d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1240	2026-08-07_023a1a1a7ba0808363db46e529842c7d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1240	2026-08-07_023a1a1a7ba0808363db46e529842c7d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1240	2026-08-07_023a1a1a7ba0808363db46e529842c7d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1240	2026-08-07_023a1a1a7ba0808363db46e529842c7d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1240	2026-08-07_023a1a1a7ba0808363db46e529842c7d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1240	2026-08-07_023a1a1a7ba0808363db46e529842c7d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1240	2026-08-07_023a1a1a7ba0808363db46e529842c7d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1240	2026-08-07_023a1a1a7ba0808363db46e529842c7d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1240	2026-08-07_023a1a1a7ba0808363db46e529842c7d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1240	2026-08-07_023a1a1a7ba0808363db46e529842c7d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1240	2026-08-07_023a1a1a7ba0808363db46e529842c7d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1240	2026-08-07_023a1a1a7ba0808363db46e529842c7d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1240	2026-08-07_023a1a1a7ba0808363db46e529842c7d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1240	2026-08-07_023a1a1a7ba0808363db46e529842c7d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1240	2026-08-07_023a1a1a7ba0808363db46e529842c7d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1240	2026-08-07_023a1a1a7ba0808363db46e529842c7d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1240	2026-08-07_023a1a1a7ba0808363db46e529842c7d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1240	2026-08-07_023a1a1a7ba0808363db46e529842c7d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1240	2026-08-07_023a1a1a7ba0808363db46e529842c7d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1240	2026-08-07_023a1a1a7ba0808363db46e529842c7d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1240	2026-08-07_023a1a1a7ba0808363db46e529842c7d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1240	2026-08-07_023a1a1a7ba0808363db46e529842c7d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1240	2026-08-07_023a1a1a7ba0808363db46e529842c7d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1240	2026-08-07_023a1a1a7ba0808363db46e529842c7d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1240	2026-08-07_023a1a1a7ba0808363db46e529842c7d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1240	2026-08-07_023a1a1a7ba0808363db46e529842c7d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1240	2026-08-07_023a1a1a7ba0808363db46e529842c7d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1240	2026-08-07_023a1a1a7ba0808363db46e529842c7d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1240	2026-08-07_023a1a1a7ba0808363db46e529842c7d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1240	2026-08-07_023a1a1a7ba0808363db46e529842c7d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1240	2026-08-07_023a1a1a7ba0808363db46e529842c7d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1240	2026-08-07_023a1a1a7ba0808363db46e529842c7d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1240	2026-08-07_023a1a1a7ba0808363db46e529842c7d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1240	2026-08-07_023a1a1a7ba0808363db46e529842c7d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1240	2026-08-07_023a1a1a7ba0808363db46e529842c7d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1240	2026-08-07_023a1a1a7ba0808363db46e529842c7d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1240	2026-08-07_023a1a1a7ba0808363db46e529842c7d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1240	2026-08-07_023a1a1a7ba0808363db46e529842c7d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1240	2026-08-07_023a1a1a7ba0808363db46e529842c7d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1240	2026-08-07_023a1a1a7ba0808363db46e529842c7d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1240	2026-08-07_023a1a1a7ba0808363db46e529842c7d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1240	2026-08-07_023a1a1a7ba0808363db46e529842c7d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1240	2026-08-07_023a1a1a7ba0808363db46e529842c7d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1240	2026-08-07_023a1a1a7ba0808363db46e529842c7d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1240	2026-08-07_023a1a1a7ba0808363db46e529842c7d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1240	2026-08-07_023a1a1a7ba0808363db46e529842c7d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1240	2026-08-07_023a1a1a7ba0808363db46e529842c7d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1240	2026-08-07_023a1a1a7ba0808363db46e529842c7d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1240	2026-08-07_023a1a1a7ba0808363db46e529842c7d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1240	2026-08-07_023a1a1a7ba0808363db46e529842c7d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1240	2026-08-07_023a1a1a7ba0808363db46e529842c7d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1240	2026-08-07_023a1a1a7ba0808363db46e529842c7d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1240	2026-08-07_023a1a1a7ba0808363db46e529842c7d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3304	ljdbwtoljdbwtolj.exe
3304	ljdbwtoljdbwtolj.exe
3304	ljdbwtoljdbwtolj.exe
3304	ljdbwtoljdbwtolj.exe
3304	ljdbwtoljdbwtolj.exe
3304	ljdbwtoljdbwtolj.exe
3304	ljdbwtoljdbwtolj.exe
3304	ljdbwtoljdbwtolj.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	5160	i_oigbywqomj.exe
Token: SeDebugPrivilege	4252	i_qljdbytqoi.exe
Token: SeDebugPrivilege	5332	i_nkidayvpnk.exe
Token: SeDebugPrivilege	5824	i_kicausqkic.exe
Token: SeDebugPrivilege	2440	i_hfaxspkica.exe
Token: SeDebugPrivilege	6076	i_xupnhfzxrp.exe
Token: SeDebugPrivilege	4024	i_uomgezwrpj.exe
Token: SeDebugPrivilege	5220	i_romgeywqoj.exe
Token: SeDebugPrivilege	4072	i_rljgbztrlj.exe
Token: SeDebugPrivilege	1100	i_eywtqljdbv.exe
Token: SeDebugPrivilege	1504	i_oigaysqkid.exe
Token: SeDebugPrivilege	6044	i_axspnlicav.exe
Token: SeDebugPrivilege	5220	i_xsqkicavsn.exe
Token: SeDebugPrivilege	3848	i_pnkfcaurpn.exe
Token: SeDebugPrivilege	3568	i_mhezxrpjhb.exe
Token: SeDebugPrivilege	924	i_ecwromgezw.exe
Token: SeDebugPrivilege	616	i_ztrojgbztr.exe
Token: SeDebugPrivilege	5428	i_vtrljdbvto.exe
Token: SeDebugPrivilege	4636	i_vqnlgdyvql.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1272	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1240 wrote to memory of 3304	1240	2026-08-07_023a1a1a7ba0808363db46e529842c7d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	89
PID 1240 wrote to memory of 4124	1240	2026-08-07_023a1a1a7ba0808363db46e529842c7d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	90
PID 4124 wrote to memory of 1272	4124	iexplore.exe	91
PID 1272 wrote to memory of 4276	1272	msedge.exe	92
PID 1272 wrote to memory of 3120	1272	msedge.exe	93
PID 1272 wrote to memory of 5060	1272	msedge.exe	94
PID 1272 wrote to memory of 3120	1272	msedge.exe	93
PID 1272 wrote to memory of 3120	1272	msedge.exe	93
PID 1272 wrote to memory of 3148	1272	msedge.exe	95
PID 1272 wrote to memory of 3148	1272	msedge.exe	95
PID 1272 wrote to memory of 6124	1272	msedge.exe	98
PID 1272 wrote to memory of 5560	1272	msedge.exe	97
PID 1272 wrote to memory of 6124	1272	msedge.exe	98
PID 1272 wrote to memory of 6124	1272	msedge.exe	98
PID 1272 wrote to memory of 5560	1272	msedge.exe	97
PID 1272 wrote to memory of 5560	1272	msedge.exe	97
PID 1272 wrote to memory of 472	1272	msedge.exe	99
PID 1272 wrote to memory of 472	1272	msedge.exe	99
PID 1272 wrote to memory of 472	1272	msedge.exe	99
PID 1272 wrote to memory of 1132	1272	msedge.exe	100
PID 1272 wrote to memory of 1132	1272	msedge.exe	100
PID 1272 wrote to memory of 1132	1272	msedge.exe	100
PID 1272 wrote to memory of 4936	1272	msedge.exe	101
PID 1272 wrote to memory of 4936	1272	msedge.exe	101
PID 1272 wrote to memory of 5236	1272	msedge.exe	105
PID 1272 wrote to memory of 3168	1272	msedge.exe	106
PID 1272 wrote to memory of 5236	1272	msedge.exe	105
PID 1272 wrote to memory of 3168	1272	msedge.exe	106
PID 3304 wrote to memory of 1436	3304	ljdbwtoljdbwtolj.exe	107
PID 1272 wrote to memory of 4584	1272	msedge.exe	110
PID 5096 wrote to memory of 2820	5096	oigbywqomj.exe	112
PID 1272 wrote to memory of 3724	1272	msedge.exe	115
PID 1272 wrote to memory of 3724	1272	msedge.exe	115
PID 1272 wrote to memory of 5432	1272	msedge.exe	116
PID 1272 wrote to memory of 5432	1272	msedge.exe	116
PID 3304 wrote to memory of 4648	3304	ljdbwtoljdbwtolj.exe	119
PID 3304 wrote to memory of 4936	3304	ljdbwtoljdbwtolj.exe	123
PID 2548 wrote to memory of 544	2548	qljdbytqoi.exe	125
PID 3304 wrote to memory of 2776	3304	ljdbwtoljdbwtolj.exe	128
PID 3304 wrote to memory of 6132	3304	ljdbwtoljdbwtolj.exe	132
PID 3580 wrote to memory of 2632	3580	nkidayvpnk.exe	134
PID 3304 wrote to memory of 2344	3304	ljdbwtoljdbwtolj.exe	137
PID 3304 wrote to memory of 3692	3304	ljdbwtoljdbwtolj.exe	142
PID 5952 wrote to memory of 4388	5952	kicausqkic.exe	144
PID 3304 wrote to memory of 3104	3304	ljdbwtoljdbwtolj.exe	147
PID 1272 wrote to memory of 3028	1272	msedge.exe	149
PID 1272 wrote to memory of 1360	1272	msedge.exe	150
PID 1272 wrote to memory of 5444	1272	msedge.exe	151
PID 3304 wrote to memory of 476	3304	ljdbwtoljdbwtolj.exe	154
PID 4560 wrote to memory of 4584	4560	hfaxspkica.exe	156
PID 3304 wrote to memory of 1960	3304	ljdbwtoljdbwtolj.exe	159
PID 3304 wrote to memory of 6120	3304	ljdbwtoljdbwtolj.exe	163
PID 4916 wrote to memory of 5284	4916	xupnhfzxrp.exe	165
PID 3304 wrote to memory of 5088	3304	ljdbwtoljdbwtolj.exe	168
PID 3304 wrote to memory of 4672	3304	ljdbwtoljdbwtolj.exe	172
PID 3496 wrote to memory of 4852	3496	uomgezwrpj.exe	174
PID 3304 wrote to memory of 5900	3304	ljdbwtoljdbwtolj.exe	177
PID 3304 wrote to memory of 3536	3304	ljdbwtoljdbwtolj.exe	181
PID 5156 wrote to memory of 4020	5156	romgeywqoj.exe	183
PID 3304 wrote to memory of 4792	3304	ljdbwtoljdbwtolj.exe	186
PID 1272 wrote to memory of 5832	1272	msedge.exe	188
PID 1272 wrote to memory of 5832	1272	msedge.exe	188
PID 3304 wrote to memory of 5064	3304	ljdbwtoljdbwtolj.exe	194
PID 3020 wrote to memory of 4308	3020	rljgbztrlj.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-08-07_023a1a1a7ba0808363db46e529842c7d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_023a1a1a7ba0808363db46e529842c7d_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1240
- C:\Temp\ljdbwtoljdbwtolj.exe
  C:\Temp\ljdbwtoljdbwtolj.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3304
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\oigbywqomj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1436
  - - C:\Temp\oigbywqomj.exe
      C:\Temp\oigbywqomj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5096
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2820
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:696
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_oigbywqomj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4648
  - - C:\Temp\i_oigbywqomj.exe
      C:\Temp\i_oigbywqomj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5160
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qljdbytqoi.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4936
  - - C:\Temp\qljdbytqoi.exe
      C:\Temp\qljdbytqoi.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2548
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:544
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5112
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qljdbytqoi.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2776
  - - C:\Temp\i_qljdbytqoi.exe
      C:\Temp\i_qljdbytqoi.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4252
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nkidayvpnk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6132
  - - C:\Temp\nkidayvpnk.exe
      C:\Temp\nkidayvpnk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3580
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2632
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4308
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nkidayvpnk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2344
  - - C:\Temp\i_nkidayvpnk.exe
      C:\Temp\i_nkidayvpnk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5332
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kicausqkic.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3692
  - - C:\Temp\kicausqkic.exe
      C:\Temp\kicausqkic.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5952
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4388
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5668
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kicausqkic.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3104
  - - C:\Temp\i_kicausqkic.exe
      C:\Temp\i_kicausqkic.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5824
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hfaxspkica.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:476
  - - C:\Temp\hfaxspkica.exe
      C:\Temp\hfaxspkica.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4560
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4584
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6080
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hfaxspkica.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1960
  - - C:\Temp\i_hfaxspkica.exe
      C:\Temp\i_hfaxspkica.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2440
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xupnhfzxrp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6120
  - - C:\Temp\xupnhfzxrp.exe
      C:\Temp\xupnhfzxrp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4916
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5284
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2908
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xupnhfzxrp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5088
  - - C:\Temp\i_xupnhfzxrp.exe
      C:\Temp\i_xupnhfzxrp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6076
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\uomgezwrpj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4672
  - - C:\Temp\uomgezwrpj.exe
      C:\Temp\uomgezwrpj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3496
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4852
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1624
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_uomgezwrpj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5900
  - - C:\Temp\i_uomgezwrpj.exe
      C:\Temp\i_uomgezwrpj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4024
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\romgeywqoj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3536
  - - C:\Temp\romgeywqoj.exe
      C:\Temp\romgeywqoj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5156
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4020
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5444
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_romgeywqoj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4792
  - - C:\Temp\i_romgeywqoj.exe
      C:\Temp\i_romgeywqoj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5220
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rljgbztrlj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5064
  - - C:\Temp\rljgbztrlj.exe
      C:\Temp\rljgbztrlj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3020
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4308
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5428
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rljgbztrlj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5756
  - - C:\Temp\i_rljgbztrlj.exe
      C:\Temp\i_rljgbztrlj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4072
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\eywtqljdbv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:456
  - - C:\Temp\eywtqljdbv.exe
      C:\Temp\eywtqljdbv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4556
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:608
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2564
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_eywtqljdbv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5436
  - - C:\Temp\i_eywtqljdbv.exe
      C:\Temp\i_eywtqljdbv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1100
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\oigaysqkid.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4128
  - - C:\Temp\oigaysqkid.exe
      C:\Temp\oigaysqkid.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4164
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5172
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2576
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_oigaysqkid.exe ups_ins
    3⤵
    PID:1584
  - - C:\Temp\i_oigaysqkid.exe
      C:\Temp\i_oigaysqkid.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1504
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\axspnlicav.exe ups_run
    3⤵
    PID:4072
  - - C:\Temp\axspnlicav.exe
      C:\Temp\axspnlicav.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6076
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:252
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3512
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_axspnlicav.exe ups_ins
    3⤵
    PID:1624
  - - C:\Temp\i_axspnlicav.exe
      C:\Temp\i_axspnlicav.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6044
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xsqkicavsn.exe ups_run
    3⤵
    PID:2932
  - - C:\Temp\xsqkicavsn.exe
      C:\Temp\xsqkicavsn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2180
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1312
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3324
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xsqkicavsn.exe ups_ins
    3⤵
    PID:2404
  - - C:\Temp\i_xsqkicavsn.exe
      C:\Temp\i_xsqkicavsn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5220
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pnkfcaurpn.exe ups_run
    3⤵
    PID:4248
  - - C:\Temp\pnkfcaurpn.exe
      C:\Temp\pnkfcaurpn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2908
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1504
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:980
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pnkfcaurpn.exe ups_ins
    3⤵
    PID:2688
  - - C:\Temp\i_pnkfcaurpn.exe
      C:\Temp\i_pnkfcaurpn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3848
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mhezxrpjhb.exe ups_run
    3⤵
    PID:1396
  - - C:\Temp\mhezxrpjhb.exe
      C:\Temp\mhezxrpjhb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2320
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4616
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3376
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mhezxrpjhb.exe ups_ins
    3⤵
    PID:4360
  - - C:\Temp\i_mhezxrpjhb.exe
      C:\Temp\i_mhezxrpjhb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3568
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ecwromgezw.exe ups_run
    3⤵
    PID:6044
  - - C:\Temp\ecwromgezw.exe
      C:\Temp\ecwromgezw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4988
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2496
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2704
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ecwromgezw.exe ups_ins
    3⤵
    PID:1420
  - - C:\Temp\i_ecwromgezw.exe
      C:\Temp\i_ecwromgezw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:924
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ztrojgbztr.exe ups_run
    3⤵
    PID:4512
  - - C:\Temp\ztrojgbztr.exe
      C:\Temp\ztrojgbztr.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3080
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5220
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:540
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ztrojgbztr.exe ups_ins
    3⤵
    PID:1700
  - - C:\Temp\i_ztrojgbztr.exe
      C:\Temp\i_ztrojgbztr.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:616
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtrljdbvto.exe ups_run
    3⤵
    PID:3004
  - - C:\Temp\vtrljdbvto.exe
      C:\Temp\vtrljdbvto.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1748
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2448
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5920
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtrljdbvto.exe ups_ins
    3⤵
    PID:5336
  - - C:\Temp\i_vtrljdbvto.exe
      C:\Temp\i_vtrljdbvto.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5428
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vqnlgdyvql.exe ups_run
    3⤵
    PID:3664
  - - C:\Temp\vqnlgdyvql.exe
      C:\Temp\vqnlgdyvql.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5928
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2780
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5592
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vqnlgdyvql.exe ups_ins
    3⤵
    PID:5048
  - - C:\Temp\i_vqnlgdyvql.exe
      C:\Temp\i_vqnlgdyvql.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4636
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x2c8,0x7ffcef4ec188,0x7ffcef4ec194,0x7ffcef4ec1a0
      4⤵
      PID:4276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,16573956463607497696,15692901461053019950,262144 --field-trial-handle=2356,i,4014301198593191314,12397223392020907235,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:2
      4⤵
      PID:3120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,7442606753005678680,16735317064433808477,524288 --field-trial-handle=2356,i,4014301198593191314,12397223392020907235,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:11
      4⤵
      System Time Discovery
      PID:5060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2496,i,17557390428073988277,9261853498108422974,524288 --field-trial-handle=2356,i,4014301198593191314,12397223392020907235,262144 --variations-seed-version --mojo-platform-channel-handle=3032 /prefetch:13
      4⤵
      PID:3148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3576,i,377205410301131917,13016875476742271343,2097152 --field-trial-handle=2356,i,4014301198593191314,12397223392020907235,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
      4⤵
      PID:5560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3652,i,14611402100399012859,16885968119048028944,2097152 --field-trial-handle=2356,i,4014301198593191314,12397223392020907235,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
      4⤵
      PID:6124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4248,i,12471874559745156776,7062937353984193186,2097152 --field-trial-handle=2356,i,4014301198593191314,12397223392020907235,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:1
      4⤵
      PID:472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,3690448534234289759,15015168278273291345,2097152 --field-trial-handle=2356,i,4014301198593191314,12397223392020907235,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:9
      4⤵
      PID:1132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,11582049288678337250,18073625307744450253,524288 --field-trial-handle=2356,i,4014301198593191314,12397223392020907235,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:14
      4⤵
      PID:4936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,512618049498156651,1249473486543052900,524288 --field-trial-handle=2356,i,4014301198593191314,12397223392020907235,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:14
      4⤵
      PID:5236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,9841138468022245915,7105155049949946386,524288 --field-trial-handle=2356,i,4014301198593191314,12397223392020907235,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
      4⤵
      PID:3168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,12047960961891457723,12283631002279872236,524288 --field-trial-handle=2356,i,4014301198593191314,12397223392020907235,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:14
      4⤵
      PID:4252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,12047960961891457723,12283631002279872236,524288 --field-trial-handle=2356,i,4014301198593191314,12397223392020907235,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:14
      4⤵
      PID:4584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,18151359746120236409,5256831136340304983,524288 --field-trial-handle=2356,i,4014301198593191314,12397223392020907235,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:14
      4⤵
      PID:3724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6656,i,8131791038718381437,10362369068176792992,524288 --field-trial-handle=2356,i,4014301198593191314,12397223392020907235,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:14
      4⤵
      PID:5432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=748,i,372685994951758027,9566711780857792405,524288 --field-trial-handle=2356,i,4014301198593191314,12397223392020907235,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:14
      4⤵
      PID:3028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,6950760353607045682,2760199487860697880,524288 --field-trial-handle=2356,i,4014301198593191314,12397223392020907235,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:14
      4⤵
      PID:1360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,5970372585060434059,10236177645105386964,524288 --field-trial-handle=2356,i,4014301198593191314,12397223392020907235,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:14
      4⤵
      PID:5444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2096,i,6859914815919915739,15578844846189593166,524288 --field-trial-handle=2356,i,4014301198593191314,12397223392020907235,262144 --variations-seed-version --mojo-platform-channel-handle=2100 /prefetch:14
      4⤵
      PID:5832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,8893049399459050505,16389445955468786037,524288 --field-trial-handle=2356,i,4014301198593191314,12397223392020907235,262144 --variations-seed-version --mojo-platform-channel-handle=3308 /prefetch:14
      4⤵
      PID:1744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,7358240441831662962,16584494397379934151,524288 --field-trial-handle=2356,i,4014301198593191314,12397223392020907235,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:14
      4⤵
      PID:5104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6604,i,13589998621516503489,250559200815896012,524288 --field-trial-handle=2356,i,4014301198593191314,12397223392020907235,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:14
      4⤵
      PID:1248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6612,i,11336244702114724640,13029407442932999631,262144 --field-trial-handle=2356,i,4014301198593191314,12397223392020907235,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:10
      4⤵
      PID:5140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,9264798767494680743,17955090489715297307,524288 --field-trial-handle=2356,i,4014301198593191314,12397223392020907235,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:14
      4⤵
      PID:916

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2536

C:\Temp\ljdbwtoljdbwtolj.sys
C:\Temp\ljdbwtoljdbwtolj.sys
1⤵
- Executes dropped EXE
PID:2548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1624

C:\Temp\ysqlidbvtn.sys
C:\Temp\ysqlidbvtn.sys
1⤵
- Executes dropped EXE
PID:5908

C:\Temp\vtnlfdyvqn.sys
C:\Temp\vtnlfdyvqn.sys
1⤵
- Executes dropped EXE
PID:1504

C:\Temp\vsnkfdxvpn.sys
C:\Temp\vsnkfdxvpn.sys
1⤵
- Executes dropped EXE
PID:5936

C:\Temp\nhfdxvpnki.sys
C:\Temp\nhfdxvpnki.sys
1⤵
- Executes dropped EXE
PID:2804

C:\Temp\rpmkecxupm.sys
C:\Temp\rpmkecxupm.sys
1⤵
- Executes dropped EXE
PID:2608

C:\Temp\rpjhezxrpj.sys
C:\Temp\rpjhezxrpj.sys
1⤵
- Executes dropped EXE
PID:4620

C:\Temp\wuomjhezxr.sys
C:\Temp\wuomjhezxr.sys
1⤵
- Executes dropped EXE
PID:2516

C:\Temp\wuomgeywro.sys
C:\Temp\wuomgeywro.sys
1⤵
- Executes dropped EXE
PID:6088

C:\Temp\gbywqolgdy.sys
C:\Temp\gbywqolgdy.sys
1⤵
- Executes dropped EXE
PID:2388

C:\Temp\qoigaysqki.sys
C:\Temp\qoigaysqki.sys
1⤵
- Executes dropped EXE
PID:4328

C:\Temp\lidavtnlic.sys
C:\Temp\lidavtnlic.sys
1⤵
PID:4620

C:\Temp\faxspkicau.sys
C:\Temp\faxspkicau.sys
1⤵
PID:3280

C:\Temp\pkicaxrpnk.sys
C:\Temp\pkicaxrpnk.sys
1⤵
PID:6088

C:\Temp\pmkecwupmh.sys
C:\Temp\pmkecwupmh.sys
1⤵
PID:1936

C:\Temp\omhezwurmj.sys
C:\Temp\omhezwurmj.sys
1⤵
PID:5048

C:\Temp\hbztrljebz.sys
C:\Temp\hbztrljebz.sys
1⤵
PID:3348

C:\Temp\tqoigbywto.sys
C:\Temp\tqoigbywto.sys
1⤵
PID:792

C:\Temp\yvtnlgdbvt.sys
C:\Temp\yvtnlgdbvt.sys
1⤵
PID:2292

C:\Temp\yvqnigayvq.sys
C:\Temp\yvqnigayvq.sys
1⤵
PID:5460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hfaxspkica.exe

Path C:\Temp\hfaxspkica.exe
Size 365KB
SHA256 4af236ed4fc6ed68d321edbf73c0b07aeea83819d47175191040634e883a9645
MD5 8bba770ff162b4c4e9d115e1edc0ebb1
SHA1 574296270d1465446fec4f39bc6a2e6498003954
SHA512 776286a1886ac67f206395740a3d661aab34c0ba713a2f3ad489f9d99b7563d6ad796bed0e6db0f0128d92ffa2bfc4816f24eb121e6c4fa9a5b3c74b18edb5db
SSDEEP 3072:cuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:cuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T109847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hfaxspkica.exe

Path C:\Temp\i_hfaxspkica.exe
Size 365KB
SHA256 e806802e229fb4bb9c26a2742e8b7d4cc5ff3a42106401778ebb7aa213d53f25
MD5 b0326aee36435ab86b4a5246fba2569c
SHA1 0ae2ff4e1d6261d7d6d3ad5bee6b07fa6384654e
SHA512 7849ee4a4b20b33186125b4af06637fac7740f4d346a864c5c6d1f7205e8c7fe7976d55577b050470a70dc1209bf3ff2af8600ae95556a6752a2a9499424960d
SSDEEP 3072:ZuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:ZuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T126847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_kicausqkic.exe

Path C:\Temp\i_kicausqkic.exe
Size 365KB
SHA256 fc173c1e0893b6153ea2d888a956c1ac02042e951f11c2318f62fa0b96842a14
MD5 8194c3729928ab29b3416ead1d45fee1
SHA1 9dd6a198b6e2272b18f49fd3215fd600d1bf02cf
SHA512 fad87a65ed37d82051aefaab8d758c48dc61d043611700327af40d105265617f2ecef97c70d282aed09f9d29c80c1fde457bc8b787960cdd388548a9232b18cf
SSDEEP 3072:AuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:AuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T155847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nkidayvpnk.exe

Path C:\Temp\i_nkidayvpnk.exe
Size 365KB
SHA256 dc990458715be9f25579d935c683070441d59ab63acb7599d6526809855c5303
MD5 a6ac59793163c53993ccb97a6c358fdf
SHA1 d4035f428400228095353f9230393b7f922cbb68
SHA512 7cb90ed22089927a2d1c2bca5ecc1791e177a7ab0f1d665d0dfaab1c1c11ba36fa4168f55242da9bdfdcddc84d7f5a596dae62b362274ea232c8743c700024fe
SSDEEP 3072:juxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:juxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T164847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_oigbywqomj.exe

Path C:\Temp\i_oigbywqomj.exe
Size 365KB
SHA256 1f5bf32d7b4c7408b6c7ac87f7b1085734c5b26c32aa87f48eca0e956a60c996
MD5 de4b89cfb7c11724cd0f45b9f95d9efc
SHA1 4c2c6db51377db7018af5da238cb12defc3966e8
SHA512 4def86c9818191268255bff2aca7311cbcf1bd66db69b395cf70487a1bbd532de6350e569879e33640bb946582d950501312212c84bffe917a2694790da1f4eb
SSDEEP 3072:9uxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:9uxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T114847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qljdbytqoi.exe

Path C:\Temp\i_qljdbytqoi.exe
Size 365KB
SHA256 7cf533a1b25d7db7a7ebe5fdff9d3a9fa1a7ef74eb6cebaee7e237eb55d1ede0
MD5 f450e24088fc98b60b5053259e314270
SHA1 33c7819ae6e5f69f53e36f644d68aed1820fe7bf
SHA512 79e50940b50fb5e68ddadec9f6eced5b17ff578f83f58051ac342c61b8886bcec63619fb3c1c1f2824f920a66256be85630ed09113e725e47a403a96516f84e3
SSDEEP 3072:+uxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:+uxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T15D847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kicausqkic.exe

Path C:\Temp\kicausqkic.exe
Size 365KB
SHA256 24d0579977bf45031f56574cfbc2de5b6bb16564b55ecce5de2843aaad88c767
MD5 7591b39944769fdf2a023ee4a9be8b81
SHA1 b4aec55fe88772ab35fc78083ff1124dfd253389
SHA512 bc80a13552fa0aa59280699c224de8dee85431cd666e187fd29987af2377d56cc84c4237461216d43be8563fa2802980966b382a182f5ef1b1ad3bec686d25c1
SSDEEP 3072:uuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:uuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T13D847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljdbwtoljdbwtolj.exe

Path C:\Temp\ljdbwtoljdbwtolj.exe
Size 365KB
SHA256 ffbf755e2bc95b02852b06765ff8793d68539a0cf08e361b96ff77ab7ae1e2b7
MD5 b4f99b851bafa108972c31e087535f32
SHA1 67094f56425d30fd533738b869a4b77cae2f5b3c
SHA512 f3b6c59edd7537a7c67d23f99aef9c4d8b06784c9b8991b04f3e41121946564794e8e5d0f43f0ad7c3fa518c885677f11237c6ab06c9a674dcbcacde9477afa8
SSDEEP 3072:4uxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:4uxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T16D847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljdbwtoljdbwtolj.sys

Path C:\Temp\ljdbwtoljdbwtolj.sys
Size 293KB
SHA256 9931b6fef09f257e355d2c190b133cb5b681f4d5ef953982eb2364a5d428ef88
MD5 7e581d0b77a46d0baeaba5c680d1a0fa
SHA1 0f51411e620ba1514c6dbdeac1f7dc9625830927
SHA512 ca1b48afc44ef899f9d921c0f8568e2ae93eb7fd6bacb759fa3c738703f13c77ac9445495e1e8ddfec2a49f8516ab4994e2e2dbdcd99a6f180d4f1eed6b3e584
SSDEEP 3072:MtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:MIJjiJcbI03GBc3ucY5DCSj
TLSH
T145545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nhfdxvpnki.sys

Path C:\Temp\nhfdxvpnki.sys
Size 293KB
SHA256 75f34a5f60d9801e4b84e798c0869c5e0722ac09c690c724209de9154b6b9fe6
MD5 ab5c834800e9c268f0f7d3b925f13792
SHA1 de261f5cf8aba9bf1cd94e85d74801e282194a56
SHA512 edd6e8d096d139f534ae67097243764d74e63b9a6252af459c585b1e7c80b225b705a03722163da64688fa32b1db9f523297bc6b20f17a0bab479600a33c2266
SSDEEP 3072:dtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:dIJjiJcbI03GBc3ucY5DCSj
TLSH
T145545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nkidayvpnk.exe

Path C:\Temp\nkidayvpnk.exe
Size 365KB
SHA256 164a340936d4d21b9f001c8d921603a19175703658b13c5525d30bb45992ada7
MD5 bb7966f374f8ce7b6f9f3469f6a969ff
SHA1 6542f1bd0b0315bd2690b28a1ed79c25c0a017ec
SHA512 819f12a87d50008e09d3da895745c0b326ba0268a41ba996ef65c69ecfa24d1fe2e498e61fef466a696a61dae7e9de4ac834d17fbfef799da77eeb5cd0bd58cd
SSDEEP 3072:uuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:uuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1AF847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oigbywqomj.exe

Path C:\Temp\oigbywqomj.exe
Size 365KB
SHA256 30cb9b8389f58003cc249a23d416322937209e3217d604baedf07d80a9712439
MD5 728e5e55b18116fd11e7af958340bb17
SHA1 b81de9d6a3bad72503cbf24c732453182fb911ad
SHA512 a9e5ac2d81d6bb0bc9d3de0c182db861e98f41bcf99a39577b44473c1eb34e69b2808bbc79c6dc4d09f659aa084c27f72a11f1bc4470978f101e739f2f6d1d72
SSDEEP 3072:auxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:auxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E4847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qljdbytqoi.exe

Path C:\Temp\qljdbytqoi.exe
Size 365KB
SHA256 832f2f6b44cf3c88e6831fccfb02042073b50c8e9ec76634446c81b861d00333
MD5 13a964879121e2c80952e1ea2af329c3
SHA1 39fc2d0affb7153387ef1c8a1ca89717f7268ecc
SHA512 4d5e2be153a717064188716de1ac14bd129487632f3bc16b3e5e73591a4a2729dfebf8638d7773b6a931ffca911d909a9fff876abf3f4908f74af78a035ce804
SSDEEP 3072:KuxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:KuxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T153847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpmkecxupm.sys

Path C:\Temp\rpmkecxupm.sys
Size 293KB
SHA256 e8d75e65e4f7f9f8cf90b545522fdf0fa08bfc3df937268a79a0c8f42564e158
MD5 3dc27f3a616199d9f921175006b048f4
SHA1 1e48ec32c8804d2e0d73e7d66791deeeab6ebc1c
SHA512 24a7035315f1a498bf260f238fa89cf8503686acc6e82ef74ae4c513a586b607d87eeadddee189c8ef9b61a743c98c00e61958a8396db3c601b85771c22d6da6
SSDEEP 3072:MtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:MIJjiJcbI03GBc3ucY5DCSj
TLSH
T1A9545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vsnkfdxvpn.sys

Path C:\Temp\vsnkfdxvpn.sys
Size 293KB
SHA256 93f891ea16c5c7af0afad7bda7806a2a9a00447dd1172f910bd63cc20f78595d
MD5 cb9498cf01c7f73bc9f189ebddd2f248
SHA1 cf8075e405f59b825b1440a0d5f208292977363d
SHA512 dc4d79715d305310b93f75f076656f47dc33f349a92aa35dbad582d2ef96c50fa3ed113b52f672839bc0880e4bc7bb0ae773bbd24a238e28243b0166db499eb8
SSDEEP 3072:VtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:VIJjiJcbI03GBc3ucY5DCSj
TLSH
T109545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtnlfdyvqn.sys

Path C:\Temp\vtnlfdyvqn.sys
Size 293KB
SHA256 a55a26dd97e93c5bf345e3fd7790d7c7aebdcda6186e9b159bc370afc2acc48b
MD5 d65f5bc9c022914699a2c860e4174ddb
SHA1 49b0a53f62aced4b3f56a771353614a90f3f0e86
SHA512 4775312038ab44c4ac8f826acd88bafe0053011ab73e3648751ec3cd67940d028dbd16d11a3c1381b76a0ddae43e0ab7c831723e9774dd9e3b7f443ec49db545
SSDEEP 3072:QtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:QIJjiJcbI03GBc3ucY5DCSj
TLSH
T1C4545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xupnhfzxrp.exe

Path C:\Temp\xupnhfzxrp.exe
Size 365KB
SHA256 2a37eb905e77bd442dd685884fe99635845ddf7b3bb20e8b4bee3028e41c642a
MD5 2e98143bc9c23e413f78c4b34ec76fd2
SHA1 111d0c15e132d25ff39309626663623f22d71b9e
SHA512 988a59fc432cdd8b029735b30dfc4b2172f900765445735d5449c2bf0960e848141ab421565643f28ae8cf597bcd7e7f743043d73fef499115f58181a7f0134f
SSDEEP 3072:4uxUxtc/GaML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:4uxUxtXlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1DD847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ysqlidbvtn.sys

Path C:\Temp\ysqlidbvtn.sys
Size 293KB
SHA256 003f55b9fc2c557fd861c5e081d52a910c3898bc64eca5fba89b5bebc037f7e0
MD5 02f6036f38b90aa4bff772e93c78849a
SHA1 3d8f6c5cdb81ee14c4bc32c1e170d52123cccd31
SHA512 6d99f95bf6af5481d6b1c79e9c2c7f2b1374c35f71c5aef0231e9a90ae9119ba4bc8958710edf8d3a51dd69ac246887f69ff0f7e9b577f03c1f4ca1885f1391a
SSDEEP 3072:3tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:3IJjiJcbI03GBc3ucY5DCSj
TLSH
T14B545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 09ab0cd9f320b2029efded4ada832c132aa39835cdbd37ce716ce0e3d6118bcb
MD5 8fcbb80c68afd4a151be9403662306a7
SHA1 28533e7f42757c2d392e2ab7287f69ca710bdea1
SHA512 af59a25631a09d8f355ad815188211f3a1a75d0501468638344ba3cb03b5b2dce42a1c3c2cafece585afb7c77413df9b1674ff98b331ac667b47784fcfbd428c
TLSH
T1A95118B023B2D9D3D765877357E26A8E36F0946B260B2E5980643D758906F2CECF102F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 21e56da37f4be8c2c43cceb079377a06872113b9f449314eef3175b9f9627543
MD5 a7b03a479b18f2d580adaee2bd3b1825
SHA1 095b0c4ae499c90cf3ab03a424efcdcdab8fedfa
SHA512 9abab603ff71fc8c4bda4728cb474ffced7775195b97e7c08571b99f0d0e39f3bac336a1eac9575539737aa283e1ce9fb73c0ca2be8624eca5ad9c99e60f5630
TLSH
T10441C0F3C7F8967D890191F0AB183E1BCE2D0954832C3E5AC5E4AE1B93E2471D14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 f35bcc79409b54cd6c20a5ff8d147e06d06f2a4a53821b3c7baa6177b5c3f2d9
MD5 6be94fdad8afa17fd01e0eb24788de6c
SHA1 add430ed9e732eccdfb516fc0dddb7c9854e3351
SHA512 a85df20bd59b495351d2f8d3b610af4694d50891fdb994c7c6e38678e8227ad626305fdf59914668155c5c3c92b21365e7eef549f9a31d9d235778be3948c236
SSDEEP 192:sxRCrC0/fYsbYwGJzoA8p90/g6+WNCgP/YoRFYhGTIgDOIJ:sxRCe0/fYsbYpU2/5h/Lvb
TLSH
T19D42D9596D28AD3B4CC7D319BB65BF93D2F95032A1D11E58ABFC960C00EB6DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 50f7ab315cd4460056b6ab2ed35e2e7f4fc0b8dbf1e22491079f399b215c9a6c
MD5 b0ce79ec149873b9c814187dc951bee5
SHA1 e4c3f7ab1bf0f835ede1be0d1ae79fe4d5e2e3ab
SHA512 810743135c67bf6f4975f8c0e32027c48eb0dfe68a182f22c26812189f67225fa4b4e8e2a27c334f8e977cbffb110c76a9c0c6e3848c50c341b132c4290e839f
SSDEEP 192:sxRBrC0/fYsCYwGJzoA8p90/g6+WNCgP/YoRFYhGTIgVIJ:sxRBe0/fYsCYpU2/5h/Lvu
TLSH
T16342C9596D28AD3B4CC7D319BB65BF53D2F95032A1D01E48ABFC960C00EB6DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 7fda0f6bec6a667df4afadbb6799e13cea9283f5f6887a6c8cc059cfcaec9abb
MD5 8287e4756fc13f9d4c9f400fa7d68795
SHA1 95b10f491720e4325feb80348d19f1137424d9c1
SHA512 c8401eef428fb67b217ce98bcdcb92ee19c9c6d4b5263c66084db68cb161ae30fa1a23d4eae0b219d009d162487d2892ff8a75b80ca20fc42cd3972d547ee38b
SSDEEP 192:sxRCrC0/fYsbpoZq3zoA8p90/g6+WNCgP/Yo7FYhGTIgD0IJ:sxRCe0/fYsbpWl2/5h/pv9
TLSH
T1D142E9596E28A93B4CC7D319BB55BF53E2F95032A1D11E08ABFC960C00EB6CD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 fcae7333fe755c9d109709eb35add6f5380ab9a54c7d45e7ba7470bb40e24095
MD5 91bdd6df34571bc5771d630a9421a29f
SHA1 207ec8e0706613c9fa8be2664c9ed90cd61e6da6
SHA512 61c64c60b05f76216dcb80b8f0a3785a8d61e528647e6ca594b5308689fe817705bf4c45755cc34f041c8b7f7f1c9f34ecc9061b8dcead94c90b88cb5edc54b6
SSDEEP 192:sxRCrC0/fYsbpwGJzoA8p90/g6+WNCgP/Yo7FYhGTIgD0IJ:sxRCe0/fYsbppU2/5h/pv9
TLSH
T1E142DA596D28AD3B5CC7D319BB55BF93E2F95032A1D11E48ABFC960C00EB6DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 2a9de934fc6f15af58d06819736dac993cfa9b58fe159aada0ce0fcf66e15c98
MD5 e29cd197ae87903418cc342b2bfb712e
SHA1 3af395733e11bb9a6b545b8f3f83e94383cfb175
SHA512 d061a9b861a8b3c5ea0c4d74f7e4c2b730258df60a832ea0406899fd192b1a059bb1ed53febfe22bf0a2e35e43fe53a40690640cd52d8e481ae42fee40cf06be
SSDEEP 768:j26HWo7pLuL7MRWgs2f028F1+UoAYDCx9Tuqh0VfUC9xbog/OVAYBVuwrro9fe0H:j26HWUE7MRWgs2f02u1jaDYB4wYSY
TLSH
T121D2EB7B640DCABF4F804ADDEC197E9F6D6802CB9698CD8047FE941C02C6BEA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 6f5ba8ab307b30396e5f4c968195e37bf40e42d76d46f187a832e0c92741ae48
MD5 e2a516aad6ea160957143227f9626b03
SHA1 4c8014c99e2fa6060678f0397dce39b5d77fb35b
SHA512 8ffc4cfc1d028d7eb6c2bf2e021877eecebfe164144fecf8986df52967763c40db6274a98930ea6922522e7f8eb59a929f78f622f2ec951fae6c7bd4dbe1ebb1
SSDEEP 96:KR3gFB31lpWRekgJpK4ggHpcvHG5FaHoZs4q26gWeDzgggK41gCgcwgziOZGrP6Y:C3gFB31lERe1JDggH2vHG5FaHoZs4q2L
TLSH
T1E3916240717A56883C3E7A5D80A58C5AD6C174737205A42F7BA901B64FABE134DFDCCE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

76a748d2-aa33-402b-bba2-89752162a38d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\76a748d2-aa33-402b-bba2-89752162a38d.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 32e1e341c9cb3655d9e218835b62b0aa1878d4297c1fc7e4285b283ae5444ff0
MD5 5196790423c931e128e30d27b7b7179f
SHA1 089eda7c3ccb491f888d367f50e8483fada11ade
SHA512 fc089007e77dd706f433f942cf1d6cac5a635a195403b35922f0fff65ea1a8ce9058801ba88675973b4e145bb4de828d68cb6c472229933e7c95a442c24ca975
SSDEEP 768:uf35ds/TBOW8FsmCONXyer1IRCzni9jtcWC:uf35uadCSIqngaj
TLSH
T12EF2BE74A464EE234CD5E386B24A3383AFF82067C6C01BA4EEDE6B1E055755E170B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 be16fdb67ceceae042fc0249b8e03f17f7a187e104495727c6500d8534f987b1
MD5 80801cefa1a48643c99151f37630df67
SHA1 83186ac89db674f51291d849cf2352ed15df5c71
SHA512 14844a75a91e450846119957ffe2fe630d0a54758a2e12e4cd09edd91c615931e38ccd3a9f8992e1ee3ae1c4cc33a5442f2e4f69d5d7c3f13aa5747593656ca0
SSDEEP 768:wf3+rs/TBOW8FsmCONXyer1IRCzni9jtcWC:wf3+oadCSIqngaj
TLSH
T1C1F2BE74A464EE274CD5E386B24A7383AFF82067C6C01BA4EEDE6F1E054715E170B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 7516952eb2bf365c487f01a178a2b29a5575f1d49bec81fe182266f5dc364cfd
MD5 978ea9ab59559a59d059b39d42b879b1
SHA1 083e02a66ec8a2032bf781674e55f1a1e39530a9
SHA512 ced96d61f552463c82f4b5f924b74e4252b23e6a2d4dae42436fec8d5f2f398ed64a8c4cf188834eb74948c32a48f97db24799a0ea0b422b605cde90c899c36f
SSDEEP 768:cFQc3uwgisfxsOW8FsmFONXyer1IRCzni9jtcWC:Pc33ADdFSIqngaj
TLSH
T1081337F594D7DA37D89E9783A33D6E429ABCD063B5845994BBC91E0DCC8217FC30A806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 4ea3ffde4120f83a4b4195b75baa875357c414bb2bfd09ce72734d4f20fd4cb8
MD5 130ba45874bf5dc79d2ede3aa10d2bb4
SHA1 94be7f0cf7f5c8b52a59ebb2ddf381e25683e307
SHA512 d4b6da957b39a5b3b7e4ef8f275b2eb4559b762c67f192ef4d1e28adede44e6527a483492870827f78a404b4189cc03084d92eacc63e8f91fa9be93e32861fb6
SSDEEP 768:hrv+4UNbdz3q9/TBOW8FxONXyer1IRCzniBjeVH1SK7:hbsbV34axSIqnQEH1l
TLSH
T1FA03BE36E4A8DE338CE2A3C5B14B72437FB86057D6840B90E9DE2F4E069B59D130B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c3c94671-3622-4733-8310-e6364478fa53.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\c3c94671-3622-4733-8310-e6364478fa53.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

87dbfc13-ee47-432b-8644-f19992e96fc0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\87dbfc13-ee47-432b-8644-f19992e96fc0.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1272_2058543420\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 3027620b994faf44c8c9270ddbd890fe6607ccf0871b5a9ce03190c176414942
MD5 1f90442eb786caa86059b27f7af29d2d
SHA1 3c1b0c78f6fc033aa1a0d19c8a13e8ab84502fd2
SHA512 0fdded75ec14eec967531ee26208f12a3860b2f21103e2124d79acc79c5ee2a4a84a3bd80846d0ff74a833c1db23828c2332f23609ce894fd268796aa29cd739
TLSH
T1DB71008356A9D6B3C1DA9BF002835604F6FB2278472360240BA19946AA30A7A24B8F08
MD5 SHA1 SHA512 TLSH

Submit Download

memory/792-471-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1504-236-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1936-435-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2292-475-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2388-342-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2516-315-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2548-64-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2608-286-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2804-273-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3280-411-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3348-451-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4328-371-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4620-391-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4620-311-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5048-446-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5460-492-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5908-189-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5936-261-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6088-415-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6088-338-0x0000000000010000-0x00000000000AB000-memory.dmp

Download