systex | 3901b8cd6ac6bee591b29ba25400236d86df1bd3b6bea77328ce3e6652fc1f80

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 16:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_e88f0e4c07a2ee894763eb1ed9610912_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Size 389KB
Sample260813-twcr3scl3x
SHA256 3901b8cd6ac6bee591b29ba25400236d86df1bd3b6bea77328ce3e6652fc1f80
MD5 e88f0e4c07a2ee894763eb1ed9610912
SHA1 baa49066f905015dfe963a72974b1b6477014c28
SHA512 5aa215486675dcb22759b85f3291f614fdc94dc32a1da7f00a19c401b1f6019c94f3fb57413f631afe9cfe4018e6955e6ee134a8119a2f2665104cbf61003339
SSDEEP 3072:Puxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:PuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T11E847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
4904	hczusmkecxupmhfz.exe
4380	hczusmkecxupmhfz.sys
2344	CreateProcess.exe
4184	heczurmjhf.exe
3256	CreateProcess.exe
5084	CreateProcess.exe
1200	i_heczurmjhf.exe
5828	ecwurmjezw.sys
4048	CreateProcess.exe
2508	ctrljebwuo.exe
3108	CreateProcess.exe
1440	CreateProcess.exe
1264	i_ctrljebwuo.exe
1796	jdbwtrljdb.sys
3156	CreateProcess.exe
2852	gbytrojdbw.exe
2864	CreateProcess.exe
4792	CreateProcess.exe
1268	i_gbytrojdbw.exe
4572	vtrljdbytr.sys
5676	CreateProcess.exe
1468	nljgaywqnl.exe
3408	CreateProcess.exe
3056	CreateProcess.exe
1200	i_nljgaywqnl.exe
2804	wtnlfdyvtn.sys
3044	CreateProcess.exe
5324	olgdytqlig.exe
52	CreateProcess.exe
1264	CreateProcess.exe
4148	i_olgdytqlig.exe
5796	davsnlfdxv.sys
4700	CreateProcess.exe
5276	ayvqnifdxv.exe
1296	CreateProcess.exe
1356	CreateProcess.exe
4480	i_ayvqnifdxv.exe
5552	usqkicaxvp.sys
1320	CreateProcess.exe
4080	vsqkicaupn.exe
1588	CreateProcess.exe
4132	CreateProcess.exe
2860	i_vsqkicaupn.exe
3592	causmkfcxv.sys
5744	CreateProcess.exe
4732	upmhfzxrpj.exe
4108	CreateProcess.exe
2984	CreateProcess.exe
2436	i_upmhfzxrpj.exe
3196	upmkhczxrp.sys
3396	CreateProcess.exe
2836	pmhecwusmk.exe
3556	CreateProcess.exe
1840	CreateProcess.exe
3296	i_pmhecwusmk.exe
3784	pjhbzurmke.sys
5520	CreateProcess.exe
4308	hezurpjhbz.exe
2276	CreateProcess.exe
5192	CreateProcess.exe
4808	i_hezurpjhbz.exe
976	eywtrljebz.sys
6008	CreateProcess.exe
940	ebztrojgby.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_547267198\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_547267198\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_350557219\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_350557219\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_350557219\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_350557219\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_641853755\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1785662467\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4244_1785662467\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_e88f0e4c07a2ee894763eb1ed9610912_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsqkicaupn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hczusmkecxupmhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_heczurmjhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbytrojdbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsqkicaupn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upmhfzxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmhecwusmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxusmhecxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ctrljebwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nljgaywqnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	olgdytqlig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebztrojgby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebztrojgby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjheczusmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmjebwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nljgaywqnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhfzxrpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctrljebwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_olgdytqlig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_upmhfzxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hezurpjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqoigayvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsqlidavtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsqlidavtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpnhfaxsqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpnhfaxsqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhfzxrpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cxusmhecxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	heczurmjhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmhecwusmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hezurpjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjheczusmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmjebwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbytrojdbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ayvqnifdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ayvqnifdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywqoigayvt.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5824	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4900	ipconfig.exe
5884	ipconfig.exe
1524	ipconfig.exe
1288	ipconfig.exe
3856	ipconfig.exe
3820	ipconfig.exe
5416	ipconfig.exe
2512	ipconfig.exe
3360	ipconfig.exe
4264	ipconfig.exe
4748	ipconfig.exe
2512	ipconfig.exe
3464	ipconfig.exe
3464	ipconfig.exe
2696	ipconfig.exe
5040	ipconfig.exe
4236	ipconfig.exe
3364	ipconfig.exe
6136	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134311118576757539"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3986082593-3624157295-3514260330-1000\{2CAE9555-EA35-425E-961C-20E6CA3BD99F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4288	2026-08-13_e88f0e4c07a2ee894763eb1ed9610912_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4288	2026-08-13_e88f0e4c07a2ee894763eb1ed9610912_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4288	2026-08-13_e88f0e4c07a2ee894763eb1ed9610912_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4288	2026-08-13_e88f0e4c07a2ee894763eb1ed9610912_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4288	2026-08-13_e88f0e4c07a2ee894763eb1ed9610912_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4288	2026-08-13_e88f0e4c07a2ee894763eb1ed9610912_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4288	2026-08-13_e88f0e4c07a2ee894763eb1ed9610912_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4288	2026-08-13_e88f0e4c07a2ee894763eb1ed9610912_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4288	2026-08-13_e88f0e4c07a2ee894763eb1ed9610912_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4288	2026-08-13_e88f0e4c07a2ee894763eb1ed9610912_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4288	2026-08-13_e88f0e4c07a2ee894763eb1ed9610912_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4288	2026-08-13_e88f0e4c07a2ee894763eb1ed9610912_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4288	2026-08-13_e88f0e4c07a2ee894763eb1ed9610912_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4288	2026-08-13_e88f0e4c07a2ee894763eb1ed9610912_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4288	2026-08-13_e88f0e4c07a2ee894763eb1ed9610912_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4288	2026-08-13_e88f0e4c07a2ee894763eb1ed9610912_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4288	2026-08-13_e88f0e4c07a2ee894763eb1ed9610912_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4288	2026-08-13_e88f0e4c07a2ee894763eb1ed9610912_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4288	2026-08-13_e88f0e4c07a2ee894763eb1ed9610912_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4288	2026-08-13_e88f0e4c07a2ee894763eb1ed9610912_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4288	2026-08-13_e88f0e4c07a2ee894763eb1ed9610912_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4288	2026-08-13_e88f0e4c07a2ee894763eb1ed9610912_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4288	2026-08-13_e88f0e4c07a2ee894763eb1ed9610912_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4288	2026-08-13_e88f0e4c07a2ee894763eb1ed9610912_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4288	2026-08-13_e88f0e4c07a2ee894763eb1ed9610912_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4288	2026-08-13_e88f0e4c07a2ee894763eb1ed9610912_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4288	2026-08-13_e88f0e4c07a2ee894763eb1ed9610912_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4288	2026-08-13_e88f0e4c07a2ee894763eb1ed9610912_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4288	2026-08-13_e88f0e4c07a2ee894763eb1ed9610912_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4288	2026-08-13_e88f0e4c07a2ee894763eb1ed9610912_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4288	2026-08-13_e88f0e4c07a2ee894763eb1ed9610912_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4288	2026-08-13_e88f0e4c07a2ee894763eb1ed9610912_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4288	2026-08-13_e88f0e4c07a2ee894763eb1ed9610912_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4288	2026-08-13_e88f0e4c07a2ee894763eb1ed9610912_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4288	2026-08-13_e88f0e4c07a2ee894763eb1ed9610912_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4288	2026-08-13_e88f0e4c07a2ee894763eb1ed9610912_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4288	2026-08-13_e88f0e4c07a2ee894763eb1ed9610912_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4288	2026-08-13_e88f0e4c07a2ee894763eb1ed9610912_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4904	hczusmkecxupmhfz.exe
4904	hczusmkecxupmhfz.exe
4288	2026-08-13_e88f0e4c07a2ee894763eb1ed9610912_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4904	hczusmkecxupmhfz.exe
4288	2026-08-13_e88f0e4c07a2ee894763eb1ed9610912_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4904	hczusmkecxupmhfz.exe
4904	hczusmkecxupmhfz.exe
4904	hczusmkecxupmhfz.exe
4288	2026-08-13_e88f0e4c07a2ee894763eb1ed9610912_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4288	2026-08-13_e88f0e4c07a2ee894763eb1ed9610912_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4288	2026-08-13_e88f0e4c07a2ee894763eb1ed9610912_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4904	hczusmkecxupmhfz.exe
4904	hczusmkecxupmhfz.exe
4288	2026-08-13_e88f0e4c07a2ee894763eb1ed9610912_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4904	hczusmkecxupmhfz.exe
4288	2026-08-13_e88f0e4c07a2ee894763eb1ed9610912_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4904	hczusmkecxupmhfz.exe
4288	2026-08-13_e88f0e4c07a2ee894763eb1ed9610912_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4904	hczusmkecxupmhfz.exe
4904	hczusmkecxupmhfz.exe
4288	2026-08-13_e88f0e4c07a2ee894763eb1ed9610912_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4288	2026-08-13_e88f0e4c07a2ee894763eb1ed9610912_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4904	hczusmkecxupmhfz.exe
4904	hczusmkecxupmhfz.exe
4288	2026-08-13_e88f0e4c07a2ee894763eb1ed9610912_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4288	2026-08-13_e88f0e4c07a2ee894763eb1ed9610912_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	1200	i_heczurmjhf.exe
Token: SeDebugPrivilege	1264	i_ctrljebwuo.exe
Token: SeDebugPrivilege	1268	i_gbytrojdbw.exe
Token: SeDebugPrivilege	1200	i_nljgaywqnl.exe
Token: SeDebugPrivilege	4148	i_olgdytqlig.exe
Token: SeDebugPrivilege	4480	i_ayvqnifdxv.exe
Token: SeDebugPrivilege	2860	i_vsqkicaupn.exe
Token: SeDebugPrivilege	2436	i_upmhfzxrpj.exe
Token: SeDebugPrivilege	3296	i_pmhecwusmk.exe
Token: SeDebugPrivilege	4808	i_hezurpjhbz.exe
Token: SeDebugPrivilege	4252	i_ebztrojgby.exe
Token: SeDebugPrivilege	3872	i_geywqoigay.exe
Token: SeDebugPrivilege	604	i_ywqoigayvt.exe
Token: SeDebugPrivilege	4900	i_vsqlidavtn.exe
Token: SeDebugPrivilege	5724	i_vpnhfaxsqk.exe
Token: SeDebugPrivilege	4820	i_pnhfzxrpnh.exe
Token: SeDebugPrivilege	4116	i_cxusmhecxu.exe
Token: SeDebugPrivilege	2112	i_pjheczusmj.exe
Token: SeDebugPrivilege	4312	i_rmjebwuomg.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4244	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4288 wrote to memory of 4904	4288	2026-08-13_e88f0e4c07a2ee894763eb1ed9610912_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	89
PID 4288 wrote to memory of 4136	4288	2026-08-13_e88f0e4c07a2ee894763eb1ed9610912_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	90
PID 4136 wrote to memory of 4244	4136	iexplore.exe	91
PID 4244 wrote to memory of 5568	4244	msedge.exe	92
PID 4244 wrote to memory of 124	4244	msedge.exe	93
PID 4244 wrote to memory of 5824	4244	msedge.exe	95
PID 4244 wrote to memory of 124	4244	msedge.exe	93
PID 4244 wrote to memory of 124	4244	msedge.exe	93
PID 4244 wrote to memory of 6132	4244	msedge.exe	96
PID 4244 wrote to memory of 6132	4244	msedge.exe	96
PID 4244 wrote to memory of 2568	4244	msedge.exe	97
PID 4244 wrote to memory of 2224	4244	msedge.exe	98
PID 4244 wrote to memory of 2568	4244	msedge.exe	97
PID 4244 wrote to memory of 2568	4244	msedge.exe	97
PID 4244 wrote to memory of 2224	4244	msedge.exe	98
PID 4244 wrote to memory of 2224	4244	msedge.exe	98
PID 4244 wrote to memory of 2932	4244	msedge.exe	99
PID 4244 wrote to memory of 2932	4244	msedge.exe	99
PID 4244 wrote to memory of 2932	4244	msedge.exe	99
PID 4244 wrote to memory of 4204	4244	msedge.exe	100
PID 4244 wrote to memory of 4204	4244	msedge.exe	100
PID 4244 wrote to memory of 4204	4244	msedge.exe	100
PID 4244 wrote to memory of 4516	4244	msedge.exe	103
PID 4244 wrote to memory of 4516	4244	msedge.exe	103
PID 4244 wrote to memory of 4540	4244	msedge.exe	105
PID 4244 wrote to memory of 3080	4244	msedge.exe	106
PID 4244 wrote to memory of 4540	4244	msedge.exe	105
PID 4244 wrote to memory of 3080	4244	msedge.exe	106
PID 4904 wrote to memory of 2344	4904	hczusmkecxupmhfz.exe	107
PID 4184 wrote to memory of 3256	4184	heczurmjhf.exe	110
PID 4244 wrote to memory of 1860	4244	msedge.exe	114
PID 4244 wrote to memory of 1468	4244	msedge.exe	117
PID 4244 wrote to memory of 1468	4244	msedge.exe	117
PID 4244 wrote to memory of 1684	4244	msedge.exe	118
PID 4244 wrote to memory of 1684	4244	msedge.exe	118
PID 4904 wrote to memory of 5084	4904	hczusmkecxupmhfz.exe	119
PID 4904 wrote to memory of 4048	4904	hczusmkecxupmhfz.exe	123
PID 2508 wrote to memory of 3108	2508	ctrljebwuo.exe	125
PID 4904 wrote to memory of 1440	4904	hczusmkecxupmhfz.exe	128
PID 4904 wrote to memory of 3156	4904	hczusmkecxupmhfz.exe	132
PID 2852 wrote to memory of 2864	2852	gbytrojdbw.exe	134
PID 4904 wrote to memory of 4792	4904	hczusmkecxupmhfz.exe	137
PID 4904 wrote to memory of 5676	4904	hczusmkecxupmhfz.exe	142
PID 1468 wrote to memory of 3408	1468	nljgaywqnl.exe	144
PID 4904 wrote to memory of 3056	4904	hczusmkecxupmhfz.exe	147
PID 4244 wrote to memory of 3160	4244	msedge.exe	149
PID 4244 wrote to memory of 4380	4244	msedge.exe	150
PID 4244 wrote to memory of 1804	4244	msedge.exe	151
PID 4904 wrote to memory of 3044	4904	hczusmkecxupmhfz.exe	154
PID 5324 wrote to memory of 52	5324	olgdytqlig.exe	156
PID 4904 wrote to memory of 1264	4904	hczusmkecxupmhfz.exe	159
PID 4904 wrote to memory of 4700	4904	hczusmkecxupmhfz.exe	163
PID 5276 wrote to memory of 1296	5276	ayvqnifdxv.exe	165
PID 4904 wrote to memory of 1356	4904	hczusmkecxupmhfz.exe	168
PID 4904 wrote to memory of 1320	4904	hczusmkecxupmhfz.exe	172
PID 4080 wrote to memory of 1588	4080	vsqkicaupn.exe	174
PID 4904 wrote to memory of 4132	4904	hczusmkecxupmhfz.exe	177
PID 4904 wrote to memory of 5744	4904	hczusmkecxupmhfz.exe	181
PID 4732 wrote to memory of 4108	4732	upmhfzxrpj.exe	183
PID 4904 wrote to memory of 2984	4904	hczusmkecxupmhfz.exe	186
PID 4244 wrote to memory of 2720	4244	msedge.exe	188
PID 4244 wrote to memory of 2720	4244	msedge.exe	188
PID 4904 wrote to memory of 3396	4904	hczusmkecxupmhfz.exe	194
PID 2836 wrote to memory of 3556	2836	pmhecwusmk.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-08-13_e88f0e4c07a2ee894763eb1ed9610912_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_e88f0e4c07a2ee894763eb1ed9610912_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4288
- C:\Temp\hczusmkecxupmhfz.exe
  C:\Temp\hczusmkecxupmhfz.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4904
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\heczurmjhf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2344
  - - C:\Temp\heczurmjhf.exe
      C:\Temp\heczurmjhf.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4184
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3256
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6136
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_heczurmjhf.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5084
  - - C:\Temp\i_heczurmjhf.exe
      C:\Temp\i_heczurmjhf.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1200
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ctrljebwuo.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4048
  - - C:\Temp\ctrljebwuo.exe
      C:\Temp\ctrljebwuo.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2508
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3108
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4748
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ctrljebwuo.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1440
  - - C:\Temp\i_ctrljebwuo.exe
      C:\Temp\i_ctrljebwuo.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1264
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gbytrojdbw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3156
  - - C:\Temp\gbytrojdbw.exe
      C:\Temp\gbytrojdbw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2852
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2864
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4900
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gbytrojdbw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4792
  - - C:\Temp\i_gbytrojdbw.exe
      C:\Temp\i_gbytrojdbw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1268
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nljgaywqnl.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5676
  - - C:\Temp\nljgaywqnl.exe
      C:\Temp\nljgaywqnl.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1468
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3408
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1288
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nljgaywqnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3056
  - - C:\Temp\i_nljgaywqnl.exe
      C:\Temp\i_nljgaywqnl.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1200
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\olgdytqlig.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3044
  - - C:\Temp\olgdytqlig.exe
      C:\Temp\olgdytqlig.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5324
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:52
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2512
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_olgdytqlig.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1264
  - - C:\Temp\i_olgdytqlig.exe
      C:\Temp\i_olgdytqlig.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4148
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ayvqnifdxv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4700
  - - C:\Temp\ayvqnifdxv.exe
      C:\Temp\ayvqnifdxv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5276
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1296
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3464
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ayvqnifdxv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1356
  - - C:\Temp\i_ayvqnifdxv.exe
      C:\Temp\i_ayvqnifdxv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4480
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vsqkicaupn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1320
  - - C:\Temp\vsqkicaupn.exe
      C:\Temp\vsqkicaupn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4080
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1588
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5884
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vsqkicaupn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4132
  - - C:\Temp\i_vsqkicaupn.exe
      C:\Temp\i_vsqkicaupn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2860
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\upmhfzxrpj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5744
  - - C:\Temp\upmhfzxrpj.exe
      C:\Temp\upmhfzxrpj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4732
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4108
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3856
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_upmhfzxrpj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2984
  - - C:\Temp\i_upmhfzxrpj.exe
      C:\Temp\i_upmhfzxrpj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2436
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pmhecwusmk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3396
  - - C:\Temp\pmhecwusmk.exe
      C:\Temp\pmhecwusmk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2836
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3556
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1524
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pmhecwusmk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1840
  - - C:\Temp\i_pmhecwusmk.exe
      C:\Temp\i_pmhecwusmk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3296
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hezurpjhbz.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5520
  - - C:\Temp\hezurpjhbz.exe
      C:\Temp\hezurpjhbz.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4308
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2276
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3820
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hezurpjhbz.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5192
  - - C:\Temp\i_hezurpjhbz.exe
      C:\Temp\i_hezurpjhbz.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4808
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ebztrojgby.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6008
  - - C:\Temp\ebztrojgby.exe
      C:\Temp\ebztrojgby.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:940
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1144
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5416
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ebztrojgby.exe ups_ins
    3⤵
    PID:5088
  - - C:\Temp\i_ebztrojgby.exe
      C:\Temp\i_ebztrojgby.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4252
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\geywqoigay.exe ups_run
    3⤵
    PID:5796
  - - C:\Temp\geywqoigay.exe
      C:\Temp\geywqoigay.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4832
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2976
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3464
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_geywqoigay.exe ups_ins
    3⤵
    PID:2616
  - - C:\Temp\i_geywqoigay.exe
      C:\Temp\i_geywqoigay.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3872
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ywqoigayvt.exe ups_run
    3⤵
    PID:2860
  - - C:\Temp\ywqoigayvt.exe
      C:\Temp\ywqoigayvt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4980
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4808
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2696
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ywqoigayvt.exe ups_ins
    3⤵
    PID:3160
  - - C:\Temp\i_ywqoigayvt.exe
      C:\Temp\i_ywqoigayvt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:604
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vsqlidavtn.exe ups_run
    3⤵
    PID:1868
  - - C:\Temp\vsqlidavtn.exe
      C:\Temp\vsqlidavtn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:904
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3064
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2512
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vsqlidavtn.exe ups_ins
    3⤵
    PID:4100
  - - C:\Temp\i_vsqlidavtn.exe
      C:\Temp\i_vsqlidavtn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4900
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vpnhfaxsqk.exe ups_run
    3⤵
    PID:3400
  - - C:\Temp\vpnhfaxsqk.exe
      C:\Temp\vpnhfaxsqk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2688
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2964
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5040
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vpnhfaxsqk.exe ups_ins
    3⤵
    PID:2004
  - - C:\Temp\i_vpnhfaxsqk.exe
      C:\Temp\i_vpnhfaxsqk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5724
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pnhfzxrpnh.exe ups_run
    3⤵
    PID:5816
  - - C:\Temp\pnhfzxrpnh.exe
      C:\Temp\pnhfzxrpnh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1248
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3512
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4236
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pnhfzxrpnh.exe ups_ins
    3⤵
    PID:2728
  - - C:\Temp\i_pnhfzxrpnh.exe
      C:\Temp\i_pnhfzxrpnh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4820
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cxusmhecxu.exe ups_run
    3⤵
    PID:3344
  - - C:\Temp\cxusmhecxu.exe
      C:\Temp\cxusmhecxu.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2756
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5512
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3360
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cxusmhecxu.exe ups_ins
    3⤵
    PID:1844
  - - C:\Temp\i_cxusmhecxu.exe
      C:\Temp\i_cxusmhecxu.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4116
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pjheczusmj.exe ups_run
    3⤵
    PID:3076
  - - C:\Temp\pjheczusmj.exe
      C:\Temp\pjheczusmj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1132
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4684
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3364
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pjheczusmj.exe ups_ins
    3⤵
    PID:4304
  - - C:\Temp\i_pjheczusmj.exe
      C:\Temp\i_pjheczusmj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2112
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rmjebwuomg.exe ups_run
    3⤵
    PID:2164
  - - C:\Temp\rmjebwuomg.exe
      C:\Temp\rmjebwuomg.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6048
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4944
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4264
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rmjebwuomg.exe ups_ins
    3⤵
    PID:2232
  - - C:\Temp\i_rmjebwuomg.exe
      C:\Temp\i_rmjebwuomg.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4312
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2cc,0x2f4,0x2f8,0x2c8,0x304,0x7ffc7c23c188,0x7ffc7c23c194,0x7ffc7c23c1a0
      4⤵
      PID:5568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,5082146817916634307,17591454593797489425,262144 --field-trial-handle=2292,i,10406084216327494599,8847618492576452664,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
      4⤵
      PID:124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,9570308872272047803,1298414969295500815,524288 --field-trial-handle=2292,i,10406084216327494599,8847618492576452664,262144 --variations-seed-version --mojo-platform-channel-handle=3076 /prefetch:11
      4⤵
      System Time Discovery
      PID:5824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2400,i,8366332637035351807,11076378438144309561,524288 --field-trial-handle=2292,i,10406084216327494599,8847618492576452664,262144 --variations-seed-version --mojo-platform-channel-handle=3180 /prefetch:13
      4⤵
      PID:6132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3580,i,12839505088300584047,15745186779309353609,2097152 --field-trial-handle=2292,i,10406084216327494599,8847618492576452664,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
      4⤵
      PID:2568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3584,i,4772312517719378135,313791885073628715,2097152 --field-trial-handle=2292,i,10406084216327494599,8847618492576452664,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
      4⤵
      PID:2224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,15799294632374145743,7719944360922476817,2097152 --field-trial-handle=2292,i,10406084216327494599,8847618492576452664,262144 --variations-seed-version --mojo-platform-channel-handle=4572 /prefetch:1
      4⤵
      PID:2932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,17008928003772226536,11545029302476951150,2097152 --field-trial-handle=2292,i,10406084216327494599,8847618492576452664,262144 --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:9
      4⤵
      PID:4204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,5125404322095872744,4820150635076182559,524288 --field-trial-handle=2292,i,10406084216327494599,8847618492576452664,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:14
      4⤵
      PID:4516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,12217284544127088830,17941020702147238272,524288 --field-trial-handle=2292,i,10406084216327494599,8847618492576452664,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:14
      4⤵
      PID:4540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3768,i,13332631605805170281,8716187266212489820,524288 --field-trial-handle=2292,i,10406084216327494599,8847618492576452664,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:14
      4⤵
      PID:3080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,2834404838741426806,9096914117799574720,524288 --field-trial-handle=2292,i,10406084216327494599,8847618492576452664,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
      4⤵
      PID:4376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,2834404838741426806,9096914117799574720,524288 --field-trial-handle=2292,i,10406084216327494599,8847618492576452664,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
      4⤵
      PID:1860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,12916487101030757975,14989191661778185101,524288 --field-trial-handle=2292,i,10406084216327494599,8847618492576452664,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
      4⤵
      PID:1468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6680,i,5403571428914324891,16931186744803313186,524288 --field-trial-handle=2292,i,10406084216327494599,8847618492576452664,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:14
      4⤵
      PID:1684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4960,i,11369294378426025350,678323194513138620,524288 --field-trial-handle=2292,i,10406084216327494599,8847618492576452664,262144 --variations-seed-version --mojo-platform-channel-handle=4636 /prefetch:14
      4⤵
      PID:3160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4964,i,15437963861695585522,7753078044943577118,524288 --field-trial-handle=2292,i,10406084216327494599,8847618492576452664,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
      4⤵
      PID:4380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4948,i,6757556279724361952,9832753649584094230,524288 --field-trial-handle=2292,i,10406084216327494599,8847618492576452664,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:14
      4⤵
      PID:1804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,11573379355016065296,6830921716116428072,524288 --field-trial-handle=2292,i,10406084216327494599,8847618492576452664,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:14
      4⤵
      PID:2720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6176,i,10225388312225620280,11717774973732407141,524288 --field-trial-handle=2292,i,10406084216327494599,8847618492576452664,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:14
      4⤵
      PID:2860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6816,i,13636028116662752324,15911638493935842686,524288 --field-trial-handle=2292,i,10406084216327494599,8847618492576452664,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:14
      4⤵
      PID:340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6604,i,17778187793943152836,174741575591318298,524288 --field-trial-handle=2292,i,10406084216327494599,8847618492576452664,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:14
      4⤵
      PID:5488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6732,i,189471379792727559,9205146484886316784,262144 --field-trial-handle=2292,i,10406084216327494599,8847618492576452664,262144 --variations-seed-version --mojo-platform-channel-handle=924 /prefetch:10
      4⤵
      PID:2064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2760,i,3995175188970595398,9767437198738750648,524288 --field-trial-handle=2292,i,10406084216327494599,8847618492576452664,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:14
      4⤵
      PID:584

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5676

C:\Temp\hczusmkecxupmhfz.sys
C:\Temp\hczusmkecxupmhfz.sys
1⤵
- Executes dropped EXE
PID:4380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5516

C:\Temp\ecwurmjezw.sys
C:\Temp\ecwurmjezw.sys
1⤵
- Executes dropped EXE
PID:5828

C:\Temp\jdbwtrljdb.sys
C:\Temp\jdbwtrljdb.sys
1⤵
- Executes dropped EXE
PID:1796

C:\Temp\vtrljdbytr.sys
C:\Temp\vtrljdbytr.sys
1⤵
- Executes dropped EXE
PID:4572

C:\Temp\wtnlfdyvtn.sys
C:\Temp\wtnlfdyvtn.sys
1⤵
- Executes dropped EXE
PID:2804

C:\Temp\davsnlfdxv.sys
C:\Temp\davsnlfdxv.sys
1⤵
- Executes dropped EXE
PID:5796

C:\Temp\usqkicaxvp.sys
C:\Temp\usqkicaxvp.sys
1⤵
- Executes dropped EXE
PID:5552

C:\Temp\causmkfcxv.sys
C:\Temp\causmkfcxv.sys
1⤵
- Executes dropped EXE
PID:3592

C:\Temp\upmkhczxrp.sys
C:\Temp\upmkhczxrp.sys
1⤵
- Executes dropped EXE
PID:3196

C:\Temp\pjhbzurmke.sys
C:\Temp\pjhbzurmke.sys
1⤵
- Executes dropped EXE
PID:3784

C:\Temp\eywtrljebz.sys
C:\Temp\eywtrljebz.sys
1⤵
- Executes dropped EXE
PID:976

C:\Temp\oljgeztroj.sys
C:\Temp\oljgeztroj.sys
1⤵
PID:720

C:\Temp\gdbvtnlgdy.sys
C:\Temp\gdbvtnlgdy.sys
1⤵
PID:428

C:\Temp\yvqnifdays.sys
C:\Temp\yvqnifdays.sys
1⤵
PID:5528

C:\Temp\vpnhfaxsqk.sys
C:\Temp\vpnhfaxsqk.sys
1⤵
PID:3720

C:\Temp\ausqkifaxv.sys
C:\Temp\ausqkifaxv.sys
1⤵
PID:5956

C:\Temp\hecausmkfc.sys
C:\Temp\hecausmkfc.sys
1⤵
PID:3036

C:\Temp\mkhczurpmh.sys
C:\Temp\mkhczurpmh.sys
1⤵
PID:704

C:\Temp\trmjecwuom.sys
C:\Temp\trmjecwuom.sys
1⤵
PID:5284

C:\Temp\wqomjebwur.sys
C:\Temp\wqomjebwur.sys
1⤵
PID:5968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ayvqnifdxv.exe

Path C:\Temp\ayvqnifdxv.exe
Size 389KB
SHA256 656befed62d2c94003ae6ffff34d671f34496d3da4d94f51e07378ecde167f21
MD5 0f56a7b5ce0114d019f3ed86992e2dd9
SHA1 98f57959a0735d0e5f91bd4166b34d378ce75f4e
SHA512 3f4e7115e7151d26a42b2c5a4efb0318b9deabe9e32fcb68b564af046c61a9255ce345a05aca0fa22416661126b23dabb43a28ed09b4d861f78b5846c5e99b31
SSDEEP 3072:puxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:puxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T10D847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ctrljebwuo.exe

Path C:\Temp\ctrljebwuo.exe
Size 389KB
SHA256 6f0a23d3093bd26ec620ba5caf28a377a434b7c157deef822dd420eb72aba0da
MD5 53375a6b565e43408b8202e45c67177c
SHA1 806ee7a78e8f00814c5632069c62208d7ad466eb
SHA512 ad18d24836f778c7a97f226a9d7eb57d757036fca68862f7c15f65e128fe2ceb68b1c36de1f6d7cf3a40b71699dabdeeb3b906734beafa56fa19de4dc90e35c1
SSDEEP 3072:Fuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:FuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C0847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

davsnlfdxv.sys

Path C:\Temp\davsnlfdxv.sys
Size 293KB
SHA256 547e290d4ce3e639e5c04bc1a33f521fa075d8098a6efdbbda648d1c3df3992a
MD5 fe836d199b89e2ce049ebe70d512cba4
SHA1 45eb61e7aca34149b8b7e327cba4aa7d79947ae1
SHA512 f992c2c9ea60089cacdd2f10b49300e57cfffc7baf4de977f09c014e16fbdb629d74282661ae4c99011ddad4300cefaefddef196c1efddbfe26f894fbe625872
SSDEEP 3072:JtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:JIJjiJcbI03GBc3ucY5DCSj
TLSH
T10D545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecwurmjezw.sys

Path C:\Temp\ecwurmjezw.sys
Size 293KB
SHA256 940e6b9d86f25e71a852d80fed510ec3dcf07716621d567b891107878d3756c6
MD5 bb1e0867785a5ab09f4c1bbba2e547b0
SHA1 e4763bbb5e24f0a54ca45358810cb29b227dd8e0
SHA512 275d84de7d5ae89d3ac9e354a4b476ab187ed3b179b5446c173ac538cd241a2134b7342f70f396d1b65a7a9fc2513729254d1fc1eac16079ff7dc07520ca60c7
SSDEEP 3072:7tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:7IJjiJcbI03GBc3ucY5DCSj
TLSH
T14D545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbytrojdbw.exe

Path C:\Temp\gbytrojdbw.exe
Size 389KB
SHA256 256ca356fe456652987f068bd935821958ab535d5937ee5228e6facd2d082782
MD5 039d36a72456d685b93645c5ed29c640
SHA1 1906cdde4861f93f240475b9538624978f88e49d
SHA512 bf57f7b04510eb45c400a539c5d4724976cb47dde2134f0ec02609ea85903eec36914a70f5e90ab1154137b9881543941cd16a7e454909650c611e5d90dea503
SSDEEP 3072:Huxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:HuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F1847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hczusmkecxupmhfz.exe

Path C:\Temp\hczusmkecxupmhfz.exe
Size 389KB
SHA256 46382ca196501a52d2b9199cc2a9f394e1eb613be9c7d45f5fe36db7b8b24446
MD5 efdb41abfe1956e6754d0a889b6dd05e
SHA1 f407a343fc05c828e42ac5bc1b20a0ef2b36fa36
SHA512 9b4ab758b1da1e89ed2399dd6dec2b006ce50f07d48c578655e0a3ed891d28e9da842c3e4a4a643229367a580748eb0b07a73da3cb8c7fa45cd2f96d0bc6b266
SSDEEP 3072:Nuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:NuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T18D847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hczusmkecxupmhfz.sys

Path C:\Temp\hczusmkecxupmhfz.sys
Size 293KB
SHA256 79a3cd39621d1cf649db6e7ab8f7d62ae9346360e971397bf68c819056445354
MD5 05f1622ecb99023857652a23dcb2eeda
SHA1 63574fc78b3a0ea5025b75e4331ba2a7ecddadff
SHA512 0d008e96c3cfceca20621f01bea17d081f13727663f5e1aebcdd17264103b9f73db4872f39eb28c86737a05f3ea1cf90652c442e382379c84d992ff3a2fa0350
SSDEEP 3072:UtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:UIJjiJcbI03GBc3ucY5DCSj
TLSH
T15D545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

heczurmjhf.exe

Path C:\Temp\heczurmjhf.exe
Size 389KB
SHA256 553f119b54f736d0cb52d8b40d9275033c9d3b3e8d0b2f7a854aeb4536081bb4
MD5 3985c6b7825959ab73923e57109567e3
SHA1 437f9c5035cbf1554240c326be254db56f1401ad
SHA512 462ebc02d5c96c5f539a922a4691f5443462d9e71746c7319f9c59089c6645fa26db6fae272fd6a33520381b795cee4884aa66d787bd9ffee2ef8a4d85a051df
SSDEEP 3072:Tuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:TuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T128847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ayvqnifdxv.exe

Path C:\Temp\i_ayvqnifdxv.exe
Size 389KB
SHA256 25440ff0846973bcf325dfcb821d73b63729417713f59831287d69fed798edad
MD5 2659509885bdbd876b9329a228b9514d
SHA1 0242230daa3f61d7418990b494fba9b3a1ff7bf8
SHA512 0b4f38f4a163381b3298b1e33968ab62b6706cc1d4acb06e6924a6a22ba04754197ed48dd478625dfa57e8911c4e5ed63ff21d4277d2346a83f74df11b1adea2
SSDEEP 3072:nuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:nuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C7847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ctrljebwuo.exe

Path C:\Temp\i_ctrljebwuo.exe
Size 389KB
SHA256 587afdb261598c37bd65cec80a40b33489c95731e9f9d0a52d0291c7a4f428ba
MD5 5f537146baeea7938a63198eb9f130f8
SHA1 bc063f97c81d90c5ed33456dd64036df85c0a896
SHA512 b2335ffafd25bedf42571c3ebe169b35ad678347cf8aa8e2a86b33ffa09c9c8dd605c307895542c75d2fee6bc5d728b9865e6ae86d4b246d4180a05d8bdb78bb
SSDEEP 3072:guxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:guxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T190847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gbytrojdbw.exe

Path C:\Temp\i_gbytrojdbw.exe
Size 389KB
SHA256 e4507f06367e20b6f924f1627cf7e9f4725ca5f098ed0e180fd8f0e4f5f3cc0c
MD5 eba1435fbe5cb5686f84ca52cbec9a15
SHA1 7ca766b639f283e624c2f1909fbdf180161a5ecf
SHA512 c24df68a5e6678d6cbf8dffcc6fac6896d57826c73286caa70f2331458a5436f249916989c5b51a3556f7e3e0a6e1644d47f4cecb6106d47d10a3f8e29f58d36
SSDEEP 3072:Buxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:BuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A3847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_heczurmjhf.exe

Path C:\Temp\i_heczurmjhf.exe
Size 389KB
SHA256 499c5188edb1257b37706e7b0ec777baaab0771394decdd79f94af7099e90a0b
MD5 bbccd3a675a55255128748bf448bb50d
SHA1 1ad129879f0ce7b0975a8405ddfcbcb95cb41cb2
SHA512 186e73a9f254d844781e5cc6de7355296b84efda6f53994d2caf43edf64c839e4746289510cc5fa0107f6dbca9db02328350a47794ff3c953535f2b45ec42ad7
SSDEEP 3072:ruxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:ruxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D4847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nljgaywqnl.exe

Path C:\Temp\i_nljgaywqnl.exe
Size 389KB
SHA256 51848af63a868da100cdca7bf1c07293b6fb1c84694552f6de5378b3c8e9f8b9
MD5 1fd951053cdc3f38d7062a9a5f59c228
SHA1 c5599286223384a03ad261f43ab1115ccc094a38
SHA512 b763c12a5680ef1a8f942832ce5adaab7dc82bef5edab1c50bd6dedff721779bee185aef7765145bde91c594f7a930ab70de400c4ce14313ba9847cd59e5a1f8
SSDEEP 3072:7uxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:7uxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1BB847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_olgdytqlig.exe

Path C:\Temp\i_olgdytqlig.exe
Size 389KB
SHA256 41188553acbdc28d5357866035585388792902f511e012501d25a300f628ca11
MD5 a4058b23d49869111169b0b60257ed4b
SHA1 a78dae528125e85d65fd2e5c3090bf0c4c9512cd
SHA512 074164b8e93e617522f09fe7710878ccfe504674353d349d162d4becefeeedf684399ec7dfb276fd0ed97d7433983193da04735e0172cf5bd9e3b5b1776dad6b
SSDEEP 3072:quxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:quxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T116847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdbwtrljdb.sys

Path C:\Temp\jdbwtrljdb.sys
Size 293KB
SHA256 9461b82acb7f91ac0f829c4bbb087516b17bb809c507d550355f3a3ff88d5be7
MD5 85cd5a6c1c53c1b5425022cf232ebd67
SHA1 d6573129d4a4277396e939d05ccfb609f8672ad4
SHA512 b18e2b034b6e29faefff648c22de5cd60b7b26d557a686c2d8a8b021f0c99caf4e79f885c79184ad0b159dcd923f129f864cfcf2d81f6e9008080053e3f7a2c6
SSDEEP 3072:mtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:mIJjiJcbI03GBc3ucY5DCSj
TLSH
T14C545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nljgaywqnl.exe

Path C:\Temp\nljgaywqnl.exe
Size 389KB
SHA256 cc77cf596b830c1a47b6832861a4d3e13655b63e0343e0ccf02925ea52795c61
MD5 aeee524fa234f6b78ca8ddbfb2446a7f
SHA1 c55708cfe254b73213b4d91f3643ddc9cca08fdc
SHA512 3a1b6f0b088c3de27e104f6c1bd054073b9ec9d526ac58f9158713225ef5a9a18b8f1a9975ac1ff9e3ea048dca1b463f83cc5ed3d2e114f834321f6ad6472681
SSDEEP 3072:Nuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:NuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T13F847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

olgdytqlig.exe

Path C:\Temp\olgdytqlig.exe
Size 389KB
SHA256 600292477153afb718a18f94e0a74dc220d6cbcbbda39f3b28bb2429532821d7
MD5 6387355def61b288d7b151b3a75debf2
SHA1 d3146cd1f78053decab4b2f8453805dc15a450c3
SHA512 3664a4dcc184c7cea862588c5216d2fd0e92e31e0167f7361f212bc302d8c7ecf9013089704f4dfd87dde7a9ae2e7ffd5545fc0370d64ca6ca534baf7ad74f08
SSDEEP 3072:huxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:huxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T16F847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtrljdbytr.sys

Path C:\Temp\vtrljdbytr.sys
Size 293KB
SHA256 c48d71c1baa60dd67356734f68fd4c532aaa135ea175dfa253dc5bc474a1e02d
MD5 dff79f556df177c90c63f589a70a2068
SHA1 6168229915869b4f596b96f1ac1b2d2bd9a6323e
SHA512 4bd68e6deaf88e370b0465aa5e2cc3dd6de71bf22f91969fd972457518bba459bc3c991f9ead6c46040e918ecb455bfedb49b692df94d9678f5b6b8e0ab64d9f
SSDEEP 3072:6tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:6IJjiJcbI03GBc3ucY5DCSj
TLSH
T182545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wtnlfdyvtn.sys

Path C:\Temp\wtnlfdyvtn.sys
Size 293KB
SHA256 e7d3b8e67679e509f627708f01e77ee951d093c7ae3e1d32c4da7883c6f3e7d6
MD5 116ac284661bec2446684ba0d85fcc13
SHA1 c02412ee11cd529ee0f7baeededbf45f94d0e54d
SHA512 a28774de69b7ffeeedc307abe00ef3830f1cf2bc0490ef544787b02ab64b36491a1c8aeb18e8ec69876a88e17bfbb900159aff0b97c826c38678110788b58a9b
SSDEEP 3072:VtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:VIJjiJcbI03GBc3ucY5DCSj
TLSH
T150545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 18a644ba613d5b4137dabc346f57eca622b6888922eaec751025ab3c0a002fd5
MD5 5eddc74c05def624cfd47ea0a7e304a5
SHA1 b5f795fcc3846bb781e66e0373fce119975b2659
SHA512 1c777d774c154e89b80817ce7344495d83eecf133c36e0ad7c60dd14d76e628697535cc3fc379ca4eeb776f3bea5096f94d0fd76a2394ecd2e52f5ca8dc0053f
TLSH
T133D09B5672455C4CD641343224E55217E3008821654546194353F0768DD668717ABD9A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 da739d58d61b2ac7b5d9bb7ad60982cb15b364d9c7c9297fd0c9719c271cd985
MD5 2d2e0ac0da9a175b4b6a8be7c9d51cce
SHA1 ff15c8a5ff11faefae3f7491c7968a2163702b81
SHA512 0ae78f15909f04e1a81109917b8eeb5b8062a49558d8a40f15c02076b087f36e82b88b329e9d984fc68c62cb15408123b9db7f705f2745bfefc30b5aa2e164e6
TLSH
T1EAD09B5A72455D4CD641343224E55217E3108821754546194253F0768DD668717ABD9E
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 028de7e44f3a23b9f465e4952ff9489e049502715eac1ba42053824e55185e22
MD5 f6ddb0c041e123872199a8b5ebb3c2ed
SHA1 ca6de97efd6ecb2817db1077b5bd431855cd0267
SHA512 79a3a7f860a10378b1473b8e1e49d7678ac2e7b8eb07fe6deb179df953149855b26f6df5fe3c59cc2792207e7a64ac3b00b81f6cb622fe2f6c0aa3ecddeb66f2
TLSH
T14A513EC7132659E9E72089BFEAE2645A72F5A4655E0F2E0018BCDFB45D02F21D1F021F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe597064.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe597064.TMP
Size 2KB
SHA256 0447d61aa4a8b2cf00b5b5573d5e30be6b0427246913af8029cdda1c2b49695c
MD5 15d1eb7df4f5ddb95a5bb22c675ed2cb
SHA1 cce0358af9d36e443b6f71b521fd10372fce4768
SHA512 8dbcabf257d49a39d58e81a31bc026a2b712fc55b909d7f0dc14089ac36ce38488e6404bb1527cf421a21db0d5ac69d50e899e67fa3c44ca59bf300bd3d9080d
TLSH
T1CC514FC7132659E8E72089BFEAE2645A72F5A4695E0F2E0018BCDFB45D02F21D1F021F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 e544adc595f8ad52e7c0b6a756c464091ae6a423ecf6d1db4034691243c93351
MD5 066790b4286ff82221981291b364f4f7
SHA1 19e68ebfaf7a22f067ccec2016092e58066845b7
SHA512 07bc8d6372768e80243c275c8039583b954778ed01a784e8d359d7db2c52087b5a6f89ebace2acf425cd3e97b101c3a5985800048409102a7bf34cb080ae329f
TLSH
T16B41A0F383F4857E8A1156F0AB14AE1FCE2D0515432C7D5AC9E4AE2793E3471E141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 a1f3926aece973bd07f035a1333a01fd2424d2533b3e2559cdcee92d3dd68418
MD5 7faca30e3429dde736058e81506bc95c
SHA1 085acf4ed9dd8636a7c1a55ebd140e2715c061d3
SHA512 69fe45ff3ad7b6da8974df8fc819963d63b64c96e6c4ef5dffdd0ac527658f52b3ec8723174efeb457ec3cdbb45e51855b11c05c6202b6bba16b9c804e226276
SSDEEP 192:sxRaR3Cu/fzscUlYCbRzoA8p9d/g6+WNCVGD/YEChi3zG4dIgVDJ:sxRasu/fzscUlPM//5B/dbv
TLSH
T12042C8166E28AD3B4CC7E21DBA55BF53E7F91072A1D11E48ABFC8A1C05E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 888d688d758d3b3d6619ddff2de9cf61c3c9b02f520308f4ee9961d5d6857208
MD5 8d65af8cae1cf2439ed164f9ed9838be
SHA1 729aa6fc065ef2dee339f5957e48a5b53bc70974
SHA512 4154d23ffd0086ae65918368739ac1877e94c83bab18304349983e1179d3e95ac491dd455f720cea8eb46533208bab9f0e306f8f89ae42baa835f4c2ac1efdab
SSDEEP 192:sxRxR3Cu/fzs+HlhZMSwzoA8p9d/g6+WNCVGD/YEC0k3zG4dIgDaDJ:sxRxsu/fzs+Hlvt//5B/Mbu
TLSH
T13B42B7166A28AD3B5CC7E21DBB557F57E3F81072A1911E48ABFC8A1C05E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 0eb641a9a05a1c5bd9ee401f0d397c03ceb10ca41d2d3a2eb7af712aab8e5118
MD5 9dec382b5a91e7514150932672cee4e8
SHA1 e21f4d482f6c77c44bbd7e1fc03b7c827c0919e6
SHA512 40f023c08294c94a28d32ef04b939740e763ad1daec0da9b475b5229c5c573e39226b6c6b32ed0d2312ab503456c6b9b353565e4d5420e8dcbca90d464872b45
SSDEEP 192:sxRxR3Cu/fzs+UlYCbRzoA8p9d/g6+WNCVGD/YEChi3zG4dIgD4DJ:sxRxsu/fzs+UlPM//5B/dbY
TLSH
T1FD42C815AE28AD3B4CC7E21DBA55BF53E7F91072A0D11E48ABFC8A1C05E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 4614b033946fbd8d3ff213fdd31a44580ec2d1e290bbbea864ec77f369038bbd
MD5 0ceb6b4f6135dc41b41c9abf2b19570a
SHA1 c04d17a15b3f7d2e899a1f7535b9869aeb8789f5
SHA512 fb18fe7b18e04a48a654c4cae5245c62f25cc6d8677a2667e55f69f020684c64088eff539c5ced42b5afdd19bf50e5bc81442a32cfd94653dd7b8921693acb46
SSDEEP 768:40Dk6DJQD8eF7pLuL7N0DbWgQ6DjfIQDF8F1+UoAYDCx9Tuqh0VfUC9xbog/OV+w:40Dk6DJQD8eTE7N0DbWgQ6DjfIQDFu1f
TLSH
T130D2DA7B640CCB7F4F804ADDAD197ACE6D6802CB96D8C98047FE991C02C7BEA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 fd854875f9df534878d34d1938c4813a8001dc17fa7fcc034b94784173401d28
MD5 bf2b1546c2041326c6810d4027c90a75
SHA1 df341b3028472cbb5d81b4e82f2b3ee834947c36
SHA512 d5b447ce9f71cd0f72ab3d5805878e58a712684b9aef09675855b722663f884b1c60f0fec8be56711c5c561dffea6e7ff9d882bd907f1b9b127e844023aed206
SSDEEP 96:KRjsJ9rhhdW1aQgldK4cgLdczLiVhmHhevL5bfrWvsagzrK4Sg9rchJEXaiYK3qg:CjsJ9rhhY1ahl3cgLyzLiVhmHhevL5bL
TLSH
T1AB918100747A42403C7E794D94F9D92B52823D72340AA5BB7BA852A30FEAE435DFDDC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 8117851bd7c81b22fcc94e65cc25bbbaea1bdaf205f2a7531226fff8d797ec8b
MD5 a97896ea7ec0a07c4ac40c5a72ce02ff
SHA1 1e0023d236c2b838f5fbd4eddb1bf00b8610700e
SHA512 f2e9dccf69240f7920d5de766e1fd4611838f467d55b43cf97117bedfe77a54266ffab29cbbb184d8a919596801541360355f2835b5aeac434cf2cdd45328b3d
SSDEEP 768:srv+4UNbdV3nfr5+DTd+ZsnUZ6eX6+qTko0u229a4vsTJ2:sbsbX3z5WUZZvVTVKa4g2
TLSH
T19603CF32F8659D738DF6D684724B35877FB811A389C40E44EADEAA4C054B1AD270FD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 624d1f0cc5200218bc69ba9b7ada56955a13760210068068af340f75101818cb
MD5 0ce1885aefd10a988cb2369793843052
SHA1 712d110c05d4ce05da20b5d0849b520cce6e2fe4
SHA512 f49e6497d64232a2992b66dacc0efb5d25e6e14fd31e6dbf6ad4314c22b9e7f8aebe5fc09ce82cdc9a0911a463d07c5e016cb6d0025ee9ca28d546eb843c439d
SSDEEP 768:prv+4UNbdG3ZvUJYDTd+ZsnUGeX6+qTko0u229a4vsDVeVH1SdW:pbsbU3ZMjWU1vVTVKa48EH1h
TLSH
T1DC03CF33E86589778DE6D7C4724B35473EB91163CA880B90D9ED6F0D029B5AC270BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 f9c9b8349b369225fae57ea8771055db6f0c2a6fd75aee82816ff30dfffee3e3
MD5 99cff7390b8be8e93d073435081c3765
SHA1 cbf18a46d6bdd5cb286aace22b4c86109585aa54
SHA512 7508d81c97ead8e3ea05bdc0e34cba209607272f95a153cce04bb77a8dc868e1b77af9c97f1f50748b135330a6342547f9f69f3d2929280122d187c5e79cc0aa
SSDEEP 768:Hrv+4UNbdG3M3J8DTd+ZsnUZveX6+qTko0u229a4vsSJeVH1SdW:HbsbU3WfWUZuvVTVKa4vEH1h
TLSH
T1C803CF32E8698D734DE7D684714B76872EB921B3CAC40B84D9EDAB4D054B19C270F93B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 3831cbcae1ab53b5d74d3e3593baf37e60f8480433398f511a4cabbef22fe659
MD5 aae78932b354ae13f19065d7332cfde6
SHA1 25d3f316d46061dc068c26792cea47ed78b7176d
SHA512 f5b2671d4378f71c680d7323460320a2938205b2af8938d162c332a0568999804f63aeb8e1f9fd5dbdafc696986337d29272dc3e1d110482b28f4f2cc760b592
SSDEEP 768:IC3JfH7+DTd+ZsnUZ4eX6+qTko0u229a4vsTJPi9PvybM:IC3ZfWUZXvVTVKa4gPGyA
TLSH
T1CDF2CF71F8B59C734CF6D684B25726476EB812B3D9C41E08AAEDE60D058726C1B4B83B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 4f664f2c70556f64e9dfa2538fc2184d4ad282dd223edf437a691498421d9cdc
MD5 38ee8e5e789212057d7b133929105ae0
SHA1 17e1c6e88c32d76d388fc4f407ed1c63a958f828
SHA512 07475bbb368181ce34a9367a2de98e125d9d18052cfb26311ddbf0220cedf380ff0c71620abfe117d90ea30469f9be89e4e86c70bcd308447ebf9617394fc01d
SSDEEP 768:hU30fq79nZsnUZ4eX6+qTko0u229a4vsTJPi9PvybM:hU3xLWUZXvVTVKa4gPGyA
TLSH
T1731328F1A8E39977C8EE9383637D2D465DBCD163B5881984BBD8990CCC8217FD70A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 37a4d6db1668cacbebc938cc6f400fc71f640071cf15a0214928ee549e2c9fdd
MD5 56a118252f2090aa25b27c75ae227be7
SHA1 40561de1d16633940d1832453424102dca138baa
SHA512 72af7889e54c73942bf94bf4947254617bc58aaa8b51c305ee42ffad3027321c7fe1ec47bf912b4a168c6c47e643dd2f461377392193733c415faed1645f0366
SSDEEP 768:eC30fH7+DTd+ZsnUZ4eX6+qTko0u229a4vsTJPi9PvybM:eC38fWUZXvVTVKa4gPGyA
TLSH
T160F2CF71F8B59C734CFAD684725726476EB811B3D9C41E08AAEDE60D058726C1B4BC3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

6fd21990-4625-4831-8778-7cb483f63967.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6fd21990-4625-4831-8778-7cb483f63967.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4244_1857090514\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 d00121c65e23d904c58fabfdd3f6b5d141e603b765666c36783029113dc22276
MD5 089737d8db8dffd6eeaf69541b0b9935
SHA1 87c184241495f926fb2369ee70c60d4b839f83c2
SHA512 930524c66764d91364a95934987f096781cce9958ad7be4cbb28b9c781abdfe15f0e9a95d75503ec98f57fd92bbff958214880d93915ea24d1eafdb893876d2a
TLSH
T1D671239356B9D9F2C1DA5BF002835648F1FF227C0B2330614B55558AAB30E7E64B9F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/428-411-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/704-452-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/720-378-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/976-358-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1796-238-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2804-286-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3036-447-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3196-325-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3592-321-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3720-414-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3784-329-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4380-65-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4572-266-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4904-427-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/5284-469-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5528-401-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5552-317-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5796-307-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5828-191-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5956-425-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5968-473-0x0000000000010000-0x00000000000AB000-memory.dmp

Download