systex | a180d24e4293c0635c5eb7382d9bf395755411e89d0a4b758f681ca9e932d10f

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 16:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_34b8433ce81924361ed1675f76da1c0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Size 376KB
Sample260813-vb858attbz
SHA256 a180d24e4293c0635c5eb7382d9bf395755411e89d0a4b758f681ca9e932d10f
MD5 34b8433ce81924361ed1675f76da1c0f
SHA1 2cda4ffe980a00a7758fb55c728019f887d32ab0
SHA512 92d22a3771694718576214a02ec969536eea00f9c77d888e24f9938254a5a9d2a0b7767b70422742c9a4d19d491af67566cbb322a4bb2d173ca5c3a265cb1653
SSDEEP 3072:OFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:OFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T110847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
5500	bytqoigaytqljdbv.exe
4540	bytqoigaytqljdbv.sys
3152	CreateProcess.exe
2840	dbytnlgdyt.exe
3200	CreateProcess.exe
4820	CreateProcess.exe
5768	i_dbytnlgdyt.exe
2792	qkigaysqli.sys
3044	CreateProcess.exe
3404	ifaysqkica.exe
4784	CreateProcess.exe
1316	CreateProcess.exe
4720	i_ifaysqkica.exe
5664	avsnlfdavs.sys
4524	CreateProcess.exe
3912	nkfdxvpnhf.exe
2140	CreateProcess.exe
1740	CreateProcess.exe
5484	i_nkfdxvpnhf.exe
1332	kfdxvpnhfa.sys
5044	CreateProcess.exe
548	hcauspnhfc.exe
5284	CreateProcess.exe
2764	CreateProcess.exe
4728	i_hcauspnhfc.exe
4500	hcausmkecw.sys
4068	CreateProcess.exe
3012	czuspjhczu.exe
3316	CreateProcess.exe
3624	CreateProcess.exe
3608	i_czuspjhczu.exe
3120	zurmjeczur.sys
4568	CreateProcess.exe
2884	zwrpjhbzxr.exe
2180	CreateProcess.exe
1792	CreateProcess.exe
5712	i_zwrpjhbzxr.exe
3360	ecwuomhezw.sys
4248	CreateProcess.exe
3644	trljhbzwuo.exe
5804	CreateProcess.exe
3240	CreateProcess.exe
4284	i_trljhbzwuo.exe
1500	hbztrljebw.sys
2452	CreateProcess.exe
3412	gbytrljdbz.exe
996	CreateProcess.exe
3268	CreateProcess.exe
5780	i_gbytrljdbz.exe
2124	gdywqoigey.sys
3464	CreateProcess.exe
5568	aytqljdbvt.exe
2496	CreateProcess.exe
5440	CreateProcess.exe
1064	i_aytqljdbvt.exe
1516	yoigayvtnl.sys
3676	CreateProcess.exe
5860	sqkidaytnl.exe
1876	CreateProcess.exe
3360	CreateProcess.exe
1076	i_sqkidaytnl.exe
5080	qlidbvtnlf.sys
4084	CreateProcess.exe
4284	causnkfdxv.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2484_437183315\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2484_437183315\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2484_12414996\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2484_1048493863\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2484_1048493863\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aytqljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aytqljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spkecxupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmkebzwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vqoidbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbytnlgdyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkfdxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomgeywro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vqoidbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqlidsnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_34b8433ce81924361ed1675f76da1c0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbytnlgdyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljhbzwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkidaytnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbwtomgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkidaytnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causnkfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_causnkfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmkebzwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwuomzwrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqlidsnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czuspjhczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifaysqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkfdxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hcauspnhfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwrpjhbzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbytrljdbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spkecxupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbwtomgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bytqoigaytqljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwrpjhbzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljhbzwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hcauspnhfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faxsqkifax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwuomzwrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifaysqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbytrljdbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faxsqkifax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomgeywro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czuspjhczu.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1816	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
940	ipconfig.exe
2792	ipconfig.exe
4276	ipconfig.exe
3296	ipconfig.exe
4916	ipconfig.exe
1088	ipconfig.exe
2180	ipconfig.exe
1752	ipconfig.exe
5768	ipconfig.exe
2876	ipconfig.exe
3032	ipconfig.exe
3068	ipconfig.exe
2688	ipconfig.exe
1788	ipconfig.exe
4380	ipconfig.exe
5376	ipconfig.exe
1624	ipconfig.exe
2124	ipconfig.exe
4276	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134311134158887970"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-189034102-168398478-1159367937-1000\{8946DF96-349A-447C-BB3D-F236700BDCE2}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1796	2026-08-13_34b8433ce81924361ed1675f76da1c0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1796	2026-08-13_34b8433ce81924361ed1675f76da1c0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1796	2026-08-13_34b8433ce81924361ed1675f76da1c0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1796	2026-08-13_34b8433ce81924361ed1675f76da1c0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1796	2026-08-13_34b8433ce81924361ed1675f76da1c0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1796	2026-08-13_34b8433ce81924361ed1675f76da1c0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1796	2026-08-13_34b8433ce81924361ed1675f76da1c0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1796	2026-08-13_34b8433ce81924361ed1675f76da1c0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1796	2026-08-13_34b8433ce81924361ed1675f76da1c0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1796	2026-08-13_34b8433ce81924361ed1675f76da1c0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1796	2026-08-13_34b8433ce81924361ed1675f76da1c0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1796	2026-08-13_34b8433ce81924361ed1675f76da1c0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1796	2026-08-13_34b8433ce81924361ed1675f76da1c0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1796	2026-08-13_34b8433ce81924361ed1675f76da1c0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1796	2026-08-13_34b8433ce81924361ed1675f76da1c0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1796	2026-08-13_34b8433ce81924361ed1675f76da1c0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1796	2026-08-13_34b8433ce81924361ed1675f76da1c0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1796	2026-08-13_34b8433ce81924361ed1675f76da1c0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1796	2026-08-13_34b8433ce81924361ed1675f76da1c0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1796	2026-08-13_34b8433ce81924361ed1675f76da1c0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1796	2026-08-13_34b8433ce81924361ed1675f76da1c0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1796	2026-08-13_34b8433ce81924361ed1675f76da1c0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1796	2026-08-13_34b8433ce81924361ed1675f76da1c0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1796	2026-08-13_34b8433ce81924361ed1675f76da1c0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1796	2026-08-13_34b8433ce81924361ed1675f76da1c0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1796	2026-08-13_34b8433ce81924361ed1675f76da1c0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1796	2026-08-13_34b8433ce81924361ed1675f76da1c0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1796	2026-08-13_34b8433ce81924361ed1675f76da1c0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1796	2026-08-13_34b8433ce81924361ed1675f76da1c0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1796	2026-08-13_34b8433ce81924361ed1675f76da1c0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1796	2026-08-13_34b8433ce81924361ed1675f76da1c0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1796	2026-08-13_34b8433ce81924361ed1675f76da1c0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1796	2026-08-13_34b8433ce81924361ed1675f76da1c0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1796	2026-08-13_34b8433ce81924361ed1675f76da1c0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1796	2026-08-13_34b8433ce81924361ed1675f76da1c0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1796	2026-08-13_34b8433ce81924361ed1675f76da1c0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1796	2026-08-13_34b8433ce81924361ed1675f76da1c0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1796	2026-08-13_34b8433ce81924361ed1675f76da1c0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1796	2026-08-13_34b8433ce81924361ed1675f76da1c0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1796	2026-08-13_34b8433ce81924361ed1675f76da1c0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1796	2026-08-13_34b8433ce81924361ed1675f76da1c0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1796	2026-08-13_34b8433ce81924361ed1675f76da1c0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1796	2026-08-13_34b8433ce81924361ed1675f76da1c0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1796	2026-08-13_34b8433ce81924361ed1675f76da1c0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1796	2026-08-13_34b8433ce81924361ed1675f76da1c0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1796	2026-08-13_34b8433ce81924361ed1675f76da1c0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1796	2026-08-13_34b8433ce81924361ed1675f76da1c0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1796	2026-08-13_34b8433ce81924361ed1675f76da1c0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1796	2026-08-13_34b8433ce81924361ed1675f76da1c0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1796	2026-08-13_34b8433ce81924361ed1675f76da1c0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1796	2026-08-13_34b8433ce81924361ed1675f76da1c0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1796	2026-08-13_34b8433ce81924361ed1675f76da1c0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1796	2026-08-13_34b8433ce81924361ed1675f76da1c0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1796	2026-08-13_34b8433ce81924361ed1675f76da1c0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1796	2026-08-13_34b8433ce81924361ed1675f76da1c0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
1796	2026-08-13_34b8433ce81924361ed1675f76da1c0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5500	bytqoigaytqljdbv.exe
5500	bytqoigaytqljdbv.exe
5500	bytqoigaytqljdbv.exe
5500	bytqoigaytqljdbv.exe
5500	bytqoigaytqljdbv.exe
5500	bytqoigaytqljdbv.exe
5500	bytqoigaytqljdbv.exe
5500	bytqoigaytqljdbv.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	5768	i_dbytnlgdyt.exe
Token: SeDebugPrivilege	4720	i_ifaysqkica.exe
Token: SeDebugPrivilege	5484	i_nkfdxvpnhf.exe
Token: SeDebugPrivilege	4728	i_hcauspnhfc.exe
Token: SeDebugPrivilege	3608	i_czuspjhczu.exe
Token: SeDebugPrivilege	5712	i_zwrpjhbzxr.exe
Token: SeDebugPrivilege	4284	i_trljhbzwuo.exe
Token: SeDebugPrivilege	5780	i_gbytrljdbz.exe
Token: SeDebugPrivilege	1064	i_aytqljdbvt.exe
Token: SeDebugPrivilege	1076	i_sqkidaytnl.exe
Token: SeDebugPrivilege	3196	i_causnkfdxv.exe
Token: SeDebugPrivilege	3376	i_faxsqkifax.exe
Token: SeDebugPrivilege	2368	i_spkecxupmh.exe
Token: SeDebugPrivilege	5940	i_pmkebzwuom.exe
Token: SeDebugPrivilege	2056	i_cwuomzwrpj.exe
Token: SeDebugPrivilege	3608	i_wuomgeywro.exe
Token: SeDebugPrivilege	3684	i_ljdbwtomgd.exe
Token: SeDebugPrivilege	1976	i_vqoidbvtnl.exe
Token: SeDebugPrivilege	2408	i_ysqlidsnkf.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2484	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1796 wrote to memory of 5500	1796	2026-08-13_34b8433ce81924361ed1675f76da1c0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 1796 wrote to memory of 5200	1796	2026-08-13_34b8433ce81924361ed1675f76da1c0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 5200 wrote to memory of 2484	5200	iexplore.exe	91
PID 2484 wrote to memory of 2044	2484	msedge.exe	92
PID 2484 wrote to memory of 5368	2484	msedge.exe	93
PID 2484 wrote to memory of 1816	2484	msedge.exe	94
PID 2484 wrote to memory of 5368	2484	msedge.exe	93
PID 2484 wrote to memory of 5368	2484	msedge.exe	93
PID 2484 wrote to memory of 4632	2484	msedge.exe	95
PID 2484 wrote to memory of 4632	2484	msedge.exe	95
PID 2484 wrote to memory of 5852	2484	msedge.exe	97
PID 2484 wrote to memory of 5852	2484	msedge.exe	97
PID 2484 wrote to memory of 5852	2484	msedge.exe	97
PID 2484 wrote to memory of 5608	2484	msedge.exe	98
PID 2484 wrote to memory of 5608	2484	msedge.exe	98
PID 2484 wrote to memory of 5608	2484	msedge.exe	98
PID 2484 wrote to memory of 1168	2484	msedge.exe	99
PID 2484 wrote to memory of 5568	2484	msedge.exe	100
PID 2484 wrote to memory of 1168	2484	msedge.exe	99
PID 2484 wrote to memory of 1168	2484	msedge.exe	99
PID 2484 wrote to memory of 5568	2484	msedge.exe	100
PID 2484 wrote to memory of 5568	2484	msedge.exe	100
PID 2484 wrote to memory of 3228	2484	msedge.exe	101
PID 2484 wrote to memory of 3228	2484	msedge.exe	101
PID 2484 wrote to memory of 5072	2484	msedge.exe	102
PID 2484 wrote to memory of 5072	2484	msedge.exe	102
PID 2484 wrote to memory of 5072	2484	msedge.exe	102
PID 2484 wrote to memory of 2608	2484	msedge.exe	105
PID 2484 wrote to memory of 2608	2484	msedge.exe	105
PID 2484 wrote to memory of 2608	2484	msedge.exe	105
PID 2484 wrote to memory of 4600	2484	msedge.exe	108
PID 2484 wrote to memory of 1108	2484	msedge.exe	107
PID 2484 wrote to memory of 4600	2484	msedge.exe	108
PID 2484 wrote to memory of 1108	2484	msedge.exe	107
PID 2484 wrote to memory of 1752	2484	msedge.exe	110
PID 5500 wrote to memory of 3152	5500	bytqoigaytqljdbv.exe	111
PID 2840 wrote to memory of 3200	2840	dbytnlgdyt.exe	114
PID 2484 wrote to memory of 5340	2484	msedge.exe	117
PID 2484 wrote to memory of 5340	2484	msedge.exe	117
PID 2484 wrote to memory of 4288	2484	msedge.exe	120
PID 2484 wrote to memory of 4288	2484	msedge.exe	120
PID 5500 wrote to memory of 4820	5500	bytqoigaytqljdbv.exe	121
PID 5500 wrote to memory of 3044	5500	bytqoigaytqljdbv.exe	125
PID 3404 wrote to memory of 4784	3404	ifaysqkica.exe	127
PID 5500 wrote to memory of 1316	5500	bytqoigaytqljdbv.exe	130
PID 5500 wrote to memory of 4524	5500	bytqoigaytqljdbv.exe	134
PID 3912 wrote to memory of 2140	3912	nkfdxvpnhf.exe	136
PID 5500 wrote to memory of 1740	5500	bytqoigaytqljdbv.exe	139
PID 5500 wrote to memory of 5044	5500	bytqoigaytqljdbv.exe	144
PID 548 wrote to memory of 5284	548	hcauspnhfc.exe	146
PID 5500 wrote to memory of 2764	5500	bytqoigaytqljdbv.exe	149
PID 2484 wrote to memory of 4812	2484	msedge.exe	151
PID 2484 wrote to memory of 4324	2484	msedge.exe	152
PID 2484 wrote to memory of 4488	2484	msedge.exe	153
PID 5500 wrote to memory of 4068	5500	bytqoigaytqljdbv.exe	156
PID 3012 wrote to memory of 3316	3012	czuspjhczu.exe	158
PID 5500 wrote to memory of 3624	5500	bytqoigaytqljdbv.exe	161
PID 5500 wrote to memory of 4568	5500	bytqoigaytqljdbv.exe	165
PID 2884 wrote to memory of 2180	2884	zwrpjhbzxr.exe	167
PID 5500 wrote to memory of 1792	5500	bytqoigaytqljdbv.exe	170
PID 5500 wrote to memory of 4248	5500	bytqoigaytqljdbv.exe	174
PID 3644 wrote to memory of 5804	3644	trljhbzwuo.exe	176
PID 5500 wrote to memory of 3240	5500	bytqoigaytqljdbv.exe	179
PID 5500 wrote to memory of 2452	5500	bytqoigaytqljdbv.exe	183

C:\Users\Admin\AppData\Local\Temp\2026-08-13_34b8433ce81924361ed1675f76da1c0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_34b8433ce81924361ed1675f76da1c0f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1796
- C:\Temp\bytqoigaytqljdbv.exe
  C:\Temp\bytqoigaytqljdbv.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5500
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbytnlgdyt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3152
  - - C:\Temp\dbytnlgdyt.exe
      C:\Temp\dbytnlgdyt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2840
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3200
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:940
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbytnlgdyt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4820
  - - C:\Temp\i_dbytnlgdyt.exe
      C:\Temp\i_dbytnlgdyt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5768
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ifaysqkica.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3044
  - - C:\Temp\ifaysqkica.exe
      C:\Temp\ifaysqkica.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3404
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4784
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1788
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ifaysqkica.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1316
  - - C:\Temp\i_ifaysqkica.exe
      C:\Temp\i_ifaysqkica.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4720
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nkfdxvpnhf.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4524
  - - C:\Temp\nkfdxvpnhf.exe
      C:\Temp\nkfdxvpnhf.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3912
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2140
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2180
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nkfdxvpnhf.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1740
  - - C:\Temp\i_nkfdxvpnhf.exe
      C:\Temp\i_nkfdxvpnhf.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5484
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hcauspnhfc.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5044
  - - C:\Temp\hcauspnhfc.exe
      C:\Temp\hcauspnhfc.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:548
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5284
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2792
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hcauspnhfc.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2764
  - - C:\Temp\i_hcauspnhfc.exe
      C:\Temp\i_hcauspnhfc.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4728
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\czuspjhczu.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4068
  - - C:\Temp\czuspjhczu.exe
      C:\Temp\czuspjhczu.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3012
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3316
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1752
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_czuspjhczu.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3624
  - - C:\Temp\i_czuspjhczu.exe
      C:\Temp\i_czuspjhczu.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3608
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zwrpjhbzxr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4568
  - - C:\Temp\zwrpjhbzxr.exe
      C:\Temp\zwrpjhbzxr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2884
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2180
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4276
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zwrpjhbzxr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1792
  - - C:\Temp\i_zwrpjhbzxr.exe
      C:\Temp\i_zwrpjhbzxr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5712
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\trljhbzwuo.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4248
  - - C:\Temp\trljhbzwuo.exe
      C:\Temp\trljhbzwuo.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3644
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5804
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5768
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_trljhbzwuo.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3240
  - - C:\Temp\i_trljhbzwuo.exe
      C:\Temp\i_trljhbzwuo.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4284
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gbytrljdbz.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2452
  - - C:\Temp\gbytrljdbz.exe
      C:\Temp\gbytrljdbz.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3412
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:996
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4380
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gbytrljdbz.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3268
  - - C:\Temp\i_gbytrljdbz.exe
      C:\Temp\i_gbytrljdbz.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5780
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\aytqljdbvt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3464
  - - C:\Temp\aytqljdbvt.exe
      C:\Temp\aytqljdbvt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5568
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2496
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5376
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_aytqljdbvt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5440
  - - C:\Temp\i_aytqljdbvt.exe
      C:\Temp\i_aytqljdbvt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1064
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqkidaytnl.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3676
  - - C:\Temp\sqkidaytnl.exe
      C:\Temp\sqkidaytnl.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5860
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1876
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1624
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqkidaytnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3360
  - - C:\Temp\i_sqkidaytnl.exe
      C:\Temp\i_sqkidaytnl.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1076
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\causnkfdxv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4084
  - - C:\Temp\causnkfdxv.exe
      C:\Temp\causnkfdxv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4284
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2592
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2876
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_causnkfdxv.exe ups_ins
    3⤵
    PID:3660
  - - C:\Temp\i_causnkfdxv.exe
      C:\Temp\i_causnkfdxv.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3196
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\faxsqkifax.exe ups_run
    3⤵
    PID:6076
  - - C:\Temp\faxsqkifax.exe
      C:\Temp\faxsqkifax.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4956
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:820
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3296
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_faxsqkifax.exe ups_ins
    3⤵
    PID:2296
  - - C:\Temp\i_faxsqkifax.exe
      C:\Temp\i_faxsqkifax.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3376
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\spkecxupmh.exe ups_run
    3⤵
    PID:6036
  - - C:\Temp\spkecxupmh.exe
      C:\Temp\spkecxupmh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:956
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5636
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2688
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_spkecxupmh.exe ups_ins
    3⤵
    PID:2792
  - - C:\Temp\i_spkecxupmh.exe
      C:\Temp\i_spkecxupmh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2368
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pmkebzwuom.exe ups_run
    3⤵
    PID:6016
  - - C:\Temp\pmkebzwuom.exe
      C:\Temp\pmkebzwuom.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3172
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2656
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3032
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pmkebzwuom.exe ups_ins
    3⤵
    PID:1432
  - - C:\Temp\i_pmkebzwuom.exe
      C:\Temp\i_pmkebzwuom.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5940
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cwuomzwrpj.exe ups_run
    3⤵
    PID:5688
  - - C:\Temp\cwuomzwrpj.exe
      C:\Temp\cwuomzwrpj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3184
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4612
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2124
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cwuomzwrpj.exe ups_ins
    3⤵
    PID:5220
  - - C:\Temp\i_cwuomzwrpj.exe
      C:\Temp\i_cwuomzwrpj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2056
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wuomgeywro.exe ups_run
    3⤵
    PID:5836
  - - C:\Temp\wuomgeywro.exe
      C:\Temp\wuomgeywro.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2340
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4436
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4276
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wuomgeywro.exe ups_ins
    3⤵
    PID:5992
  - - C:\Temp\i_wuomgeywro.exe
      C:\Temp\i_wuomgeywro.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3608
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljdbwtomgd.exe ups_run
    3⤵
    PID:672
  - - C:\Temp\ljdbwtomgd.exe
      C:\Temp\ljdbwtomgd.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3192
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3716
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4916
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljdbwtomgd.exe ups_ins
    3⤵
    PID:1988
  - - C:\Temp\i_ljdbwtomgd.exe
      C:\Temp\i_ljdbwtomgd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3684
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vqoidbvtnl.exe ups_run
    3⤵
    PID:2268
  - - C:\Temp\vqoidbvtnl.exe
      C:\Temp\vqoidbvtnl.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6060
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4564
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3068
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vqoidbvtnl.exe ups_ins
    3⤵
    PID:4488
  - - C:\Temp\i_vqoidbvtnl.exe
      C:\Temp\i_vqoidbvtnl.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1976
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ysqlidsnkf.exe ups_run
    3⤵
    PID:772
  - - C:\Temp\ysqlidsnkf.exe
      C:\Temp\ysqlidsnkf.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5236
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2088
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1088
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ysqlidsnkf.exe ups_ins
    3⤵
    PID:5056
  - - C:\Temp\i_ysqlidsnkf.exe
      C:\Temp\i_ysqlidsnkf.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2408
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2c8,0x300,0x7ffc81dac188,0x7ffc81dac194,0x7ffc81dac1a0
      4⤵
      PID:2044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1696,i,4513835650819574189,5056131402467643927,262144 --field-trial-handle=2640,i,8622992009402139815,1199998777989818416,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:2
      4⤵
      PID:5368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,14075014209944075659,13581002792243586086,524288 --field-trial-handle=2640,i,8622992009402139815,1199998777989818416,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:11
      4⤵
      System Time Discovery
      PID:1816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2268,i,4854090241302681862,10260010911743274454,524288 --field-trial-handle=2640,i,8622992009402139815,1199998777989818416,262144 --variations-seed-version --mojo-platform-channel-handle=2784 /prefetch:13
      4⤵
      PID:4632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3572,i,4556380683152291252,9906273590226024717,2097152 --field-trial-handle=2640,i,8622992009402139815,1199998777989818416,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
      4⤵
      PID:5852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3580,i,322840558577778161,7053252372415547490,2097152 --field-trial-handle=2640,i,8622992009402139815,1199998777989818416,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
      4⤵
      PID:5608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4360,i,17276851270267336032,1614364430229027626,2097152 --field-trial-handle=2640,i,8622992009402139815,1199998777989818416,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:1
      4⤵
      PID:1168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4380,i,17699730185994385228,3848367324386132923,2097152 --field-trial-handle=2640,i,8622992009402139815,1199998777989818416,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:9
      4⤵
      PID:5568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3752,i,17589444316201959982,8955413762384920053,524288 --field-trial-handle=2640,i,8622992009402139815,1199998777989818416,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:14
      4⤵
      PID:3228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5256,i,9679912031586852812,2057584177066173679,2097152 --field-trial-handle=2640,i,8622992009402139815,1199998777989818416,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:1
      4⤵
      PID:5072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3740,i,12957280057118514770,4949275709018448441,2097152 --field-trial-handle=2640,i,8622992009402139815,1199998777989818416,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:1
      4⤵
      PID:2608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5576,i,3822597222897372803,5161000082518027533,524288 --field-trial-handle=2640,i,8622992009402139815,1199998777989818416,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:14
      4⤵
      PID:1108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,12396167548093121950,15458684076837823770,524288 --field-trial-handle=2640,i,8622992009402139815,1199998777989818416,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:14
      4⤵
      PID:4600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,2694986053045136311,4719526308645527245,524288 --field-trial-handle=2640,i,8622992009402139815,1199998777989818416,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:14
      4⤵
      PID:756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,2694986053045136311,4719526308645527245,524288 --field-trial-handle=2640,i,8622992009402139815,1199998777989818416,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:14
      4⤵
      PID:1752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,4915590504457879870,15612234378677611551,524288 --field-trial-handle=2640,i,8622992009402139815,1199998777989818416,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:14
      4⤵
      PID:5340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6704,i,10853850064856207457,6789485365499977412,524288 --field-trial-handle=2640,i,8622992009402139815,1199998777989818416,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:14
      4⤵
      PID:4288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3748,i,14999722741575058595,7682293003333119969,524288 --field-trial-handle=2640,i,8622992009402139815,1199998777989818416,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:14
      4⤵
      PID:4812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4472,i,10648477098110471786,17312697183189174525,524288 --field-trial-handle=2640,i,8622992009402139815,1199998777989818416,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:14
      4⤵
      PID:4324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4444,i,15653694631164334696,16200514687580800459,524288 --field-trial-handle=2640,i,8622992009402139815,1199998777989818416,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:14
      4⤵
      PID:4488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6460,i,264467224484052801,12318323875526595429,524288 --field-trial-handle=2640,i,8622992009402139815,1199998777989818416,262144 --variations-seed-version --mojo-platform-channel-handle=2132 /prefetch:14
      4⤵
      PID:292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,864475963335512509,1188456477938568029,524288 --field-trial-handle=2640,i,8622992009402139815,1199998777989818416,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:14
      4⤵
      PID:4976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,9700332110684583902,604681082911381110,524288 --field-trial-handle=2640,i,8622992009402139815,1199998777989818416,262144 --variations-seed-version --mojo-platform-channel-handle=924 /prefetch:14
      4⤵
      PID:2352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6756,i,15836876045114168690,4256860018513641699,262144 --field-trial-handle=2640,i,8622992009402139815,1199998777989818416,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:10
      4⤵
      PID:5720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,12943104825072667789,10677451314749080624,524288 --field-trial-handle=2640,i,8622992009402139815,1199998777989818416,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:14
      4⤵
      PID:4268

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4808

C:\Temp\bytqoigaytqljdbv.sys
C:\Temp\bytqoigaytqljdbv.sys
1⤵
- Executes dropped EXE
PID:4540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4608

C:\Temp\qkigaysqli.sys
C:\Temp\qkigaysqli.sys
1⤵
- Executes dropped EXE
PID:2792

C:\Temp\avsnlfdavs.sys
C:\Temp\avsnlfdavs.sys
1⤵
- Executes dropped EXE
PID:5664

C:\Temp\kfdxvpnhfa.sys
C:\Temp\kfdxvpnhfa.sys
1⤵
- Executes dropped EXE
PID:1332

C:\Temp\hcausmkecw.sys
C:\Temp\hcausmkecw.sys
1⤵
- Executes dropped EXE
PID:4500

C:\Temp\zurmjeczur.sys
C:\Temp\zurmjeczur.sys
1⤵
- Executes dropped EXE
PID:3120

C:\Temp\ecwuomhezw.sys
C:\Temp\ecwuomhezw.sys
1⤵
- Executes dropped EXE
PID:3360

C:\Temp\hbztrljebw.sys
C:\Temp\hbztrljebw.sys
1⤵
- Executes dropped EXE
PID:1500

C:\Temp\gdywqoigey.sys
C:\Temp\gdywqoigey.sys
1⤵
- Executes dropped EXE
PID:2124

C:\Temp\yoigayvtnl.sys
C:\Temp\yoigayvtnl.sys
1⤵
- Executes dropped EXE
PID:1516

C:\Temp\qlidbvtnlf.sys
C:\Temp\qlidbvtnlf.sys
1⤵
- Executes dropped EXE
PID:5080

C:\Temp\kfcavsnlfc.sys
C:\Temp\kfcavsnlfc.sys
1⤵
PID:564

C:\Temp\xrpkhczxsm.sys
C:\Temp\xrpkhczxsm.sys
1⤵
PID:1624

C:\Temp\ukeczurpmh.sys
C:\Temp\ukeczurpmh.sys
1⤵
PID:1744

C:\Temp\bzxrpjeczu.sys
C:\Temp\bzxrpjeczu.sys
1⤵
PID:5504

C:\Temp\trljebzwro.sys
C:\Temp\trljebzwro.sys
1⤵
PID:3900

C:\Temp\olgdbwtomg.sys
C:\Temp\olgdbwtomg.sys
1⤵
PID:2540

C:\Temp\dbvtndbytq.sys
C:\Temp\dbvtndbytq.sys
1⤵
PID:1184

C:\Temp\vtqoigaysq.sys
C:\Temp\vtqoigaysq.sys
1⤵
PID:4584

C:\Temp\vpnlfaysqk.sys
C:\Temp\vpnlfaysqk.sys
1⤵
PID:5984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

avsnlfdavs.sys

Path C:\Temp\avsnlfdavs.sys
Size 293KB
SHA256 90a2c6177bdad4d7dc38f59cb9acb3698c6097b2b60c05da33d39501c04eaf0b
MD5 49eec86fa34e1df04074421b0ac43a38
SHA1 62d155a90722312c2443092432d128c0cf93e87e
SHA512 aecc87d6bd003e39858ad9efcf25883d47e650fefbac0411175a2125b205f94608fab6e4abc4a35b6ea50a309bac262fd225bda4ce5ea3f8368f310bbd0377dd
SSDEEP 3072:EtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:EIJjiJcbI03GBc3ucY5DCSj
TLSH
T139545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bytqoigaytqljdbv.exe

Path C:\Temp\bytqoigaytqljdbv.exe
Size 376KB
SHA256 90e24baecd0d48111c0c97882ca63aca4aa7238d97eb2dae572d48ef5c8508f7
MD5 a604e4218202994bc2b76e224188beba
SHA1 c73e2688b34e9d122273ca3f9b360b093ef87fc7
SHA512 3024c1e428d718d67c5740ec1072f67f1b14ee1edea482389f102858679fe2739497157680227d5531010d0b4e21599c97e70b001450c1ef73d71f7110e0ea83
SSDEEP 3072:KFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:KFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1EA847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bytqoigaytqljdbv.sys

Path C:\Temp\bytqoigaytqljdbv.sys
Size 293KB
SHA256 aa152fba5aa3d5d4d6e6c108bfd1a7414f9ee5c367669608043c4a0b3babe218
MD5 f0132d2fb65eda01bb7c116c22b43720
SHA1 ebca9554cbb15d809eca83cfa71718e19b1466fc
SHA512 646816dd4b30dd69aa51bbc42d7747f10ded1bc50878b191147179684b516731368dfa44d6b7d1eae9a5c4825212bdd4b07e6a858e90077a049ac8fdd66cc4b4
SSDEEP 3072:vtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:vIJjiJcbI03GBc3ucY5DCSj
TLSH
T175545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

czuspjhczu.exe

Path C:\Temp\czuspjhczu.exe
Size 376KB
SHA256 7e037defb2e3830a7b077ef64f70fd8901dc210389ccaf89d114026aecc33952
MD5 07ad98cfaaaeb2034084ed945b2a5f2c
SHA1 aecb09125d7845d3515ab849fbf91b690fc591f5
SHA512 96257ace31ed3a9fbbe082ed4f74a345c69afbb72ac213b3d08f0dba2f6e47f06916194c74714d38be5afe1771bd29f296c737d74b9070a0eb5039606aa4800e
SSDEEP 3072:bFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:bFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T10D847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbytnlgdyt.exe

Path C:\Temp\dbytnlgdyt.exe
Size 376KB
SHA256 26bcd8298e469287f26acd7838b1ca0b3612dd6e779e8516ac7f02072cb87f47
MD5 483c75aa4a1858ed27a8d917882de483
SHA1 170a018b8e411f8c03de814e87878c7ee0948046
SHA512 fd088637f939c9874ba60aa3ec994109c95f98998c8e6c36c7ddea2dbc146a172a2479e910a9d82d57fc3af1e1951ae4bb9ae1ecca4bc243c30e4883b1846a6f
SSDEEP 3072:TFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:TFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T141847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hcausmkecw.sys

Path C:\Temp\hcausmkecw.sys
Size 293KB
SHA256 c5cc92bbec887cad4468881a005915af8f80956b58643572adc471ea689345fc
MD5 953f76618c6978e0ba3dc982709339b4
SHA1 c63489b553584fef05059930f4b1e18f7fbbcf5b
SHA512 771393493ba189a2893281dc17cb12450b66301520dc3a029ee8472e3ad5e8f29b1cfe2287babf1c45f51173f97fca451501ec30804a59ef8f2ece494b71d47a
SSDEEP 3072:7tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:7IJjiJcbI03GBc3ucY5DCSj
TLSH
T148545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hcauspnhfc.exe

Path C:\Temp\hcauspnhfc.exe
Size 376KB
SHA256 09c2dabead882b59baf1e202623f7c7c3eab92000e4369621ed021cbd270374c
MD5 67113b352da057530ed7f897187b445c
SHA1 f87ea9f9b5d43c141e45202a31ad882d132492d1
SHA512 318a463b019978accbf6c410c9cf4d4274aa2c28927fe553302c3f679a489617ba8541bbf0ba0f3b7d256c1b2c2304a716d102f86086dc472573672ec62d3777
SSDEEP 3072:iFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:iFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B7847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_czuspjhczu.exe

Path C:\Temp\i_czuspjhczu.exe
Size 376KB
SHA256 fdc56027362b29f690975f2e48e9c63a7279baffb8527e6a50f7b4c928f12b7f
MD5 8833268962f37ad90ed93d81ce4c3c48
SHA1 1b800f44e77ad2e54b2045d0fe0888895dcee422
SHA512 d67e0edf2bfcc6fa8e0a1fb36b914fec5bba48132ec3a37316332e6a65920c6af7177f94980fac7512b7c54ae867b1dbd8de2c56217d158117beb26042d991d8
SSDEEP 3072:uFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:uFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T14E847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dbytnlgdyt.exe

Path C:\Temp\i_dbytnlgdyt.exe
Size 376KB
SHA256 15e99da07a77b91976369a3c6cce1e48854a0e554b9995e881f6d53d1d84d3e2
MD5 049636571bf4ed50f601f7dda69e61ab
SHA1 a2f10363dd1fbb5811e057ffbac138814b2db5f5
SHA512 b00226ac9e5c425ac38eecf0913e81d57b8d79fd4801c7ee42a52a8dcf2d08f9a63ae6a07a2a43ac98daaee8448897d31f197a6ff5a0bfff33ba3a9c0d2e5c46
SSDEEP 3072:MFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:MFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1BC847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hcauspnhfc.exe

Path C:\Temp\i_hcauspnhfc.exe
Size 376KB
SHA256 7ea8b3e7536428bbf43e9f651ad2482a5493ee1eeb6b535c25a3908f2fb4b8a7
MD5 4ff8908c2dec17f5ac35086b7773e190
SHA1 46ec28bcbc9140027b153a312da2cdd1cd272cf3
SHA512 9b778b3a7c14cd4ed49a167578c99742eb031d7d441715d5db529f9b1b8d16c1bd56c0bfba132b4c4917cbb7eb5d459e675c142972ab47f0644986699b1e057f
SSDEEP 3072:CFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:CFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T106847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ifaysqkica.exe

Path C:\Temp\i_ifaysqkica.exe
Size 376KB
SHA256 3423a048c5d7f36d5ffbd0f3e9f6490e400672c328fae642fb3247d5ff2de7d7
MD5 b3f1c0f9800ae5bb00c9ee2154247ddd
SHA1 b1b48623df014eb3d3e312394a5571a22a922d24
SHA512 b54ab7cdf44471b4648f5dd9135fdf2d076fdb6a0686e068f79c62a85741f35172137403fd1f90aeaa07eb24cfe9d053c308909a5067d7913308c17b17e7618d
SSDEEP 3072:dFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:dFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T184847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nkfdxvpnhf.exe

Path C:\Temp\i_nkfdxvpnhf.exe
Size 376KB
SHA256 4259ed0df5c356331ad00cf9ca5d00b401803c7bd28c11989e21c208bfa43dc0
MD5 d626747afa3430fdb5d5a1ca1d016acd
SHA1 3828ca03f5832ffff758ce6758980006c84c0469
SHA512 59c21dd9ba866dcd8aa5996f0b46eda3ece367468f70280ed9bbac9853b53691815cc0a522a60fe53c4ca4269efb4fa8adf1d5fa39e26085a2528d470ccab176
SSDEEP 3072:vFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:vFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C6847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ifaysqkica.exe

Path C:\Temp\ifaysqkica.exe
Size 376KB
SHA256 8d0c34be79325b9524ebf78bdae817740182d28ed7eb5414202587cbf9dd471b
MD5 f30a7ee3cdfc757d1952a87fb1885174
SHA1 b0f6dc131ba9a2766fb4db1beeb5ce335f337ef9
SHA512 06f4f98cdbda9952260264442cb37db6e95bc0865add293d09f17bc6d0e7a4726f578427ec2de706919da1fcd7c0f72ea067733cfa2ff409e6b14f2069f94b04
SSDEEP 3072:qFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:qFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T184847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kfdxvpnhfa.sys

Path C:\Temp\kfdxvpnhfa.sys
Size 293KB
SHA256 494626a8e72389c51d45fbaaac8079582b8235d06ec1bb8759e8e0b98a7ef465
MD5 8311f38408ba75ad85a7d3d1d5195bf9
SHA1 41eebb241fd46d0f5ca4923d14792f73295a9ecb
SHA512 606c8c85071a5a52b99bb4d2452250bbd022a0190e1954530bdd51393050515cd21c0033387b7935f509cdd57e712e0f5f2df5de157d3091a545e36e943965a7
SSDEEP 3072:/tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:/IJjiJcbI03GBc3ucY5DCSj
TLSH
T112545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nkfdxvpnhf.exe

Path C:\Temp\nkfdxvpnhf.exe
Size 376KB
SHA256 a25264ca89014306cf18df21676ea0087b975569ef4de158f5cdef5c322a3d20
MD5 9f6cc8f42ad043032a549614c445ff9c
SHA1 17b38edd21e74c5d90f9474689320c9fcc01875d
SHA512 aa122fef54a747e1034b1ad29463db2489c665111126b6fa5f4726a6a1f2c5c302172f5d016933de1602798649c192510ba79c40e1771304893c22f96891ca60
SSDEEP 3072:PFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:PFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A7847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qkigaysqli.sys

Path C:\Temp\qkigaysqli.sys
Size 293KB
SHA256 fbd1e29f44e6e47662c2c1430a623a587df4b412397e447f859a681fe044157a
MD5 067bacea92eb3735001d8d088fcfd145
SHA1 f5326e33fbd549a1d0936bd70a46d778bf503f6e
SHA512 7c91e35f299480d5ceee4d72ca08046945b46db028fa8f710a41b51fda4d0c6d3f3a60f6bc5ad1382fbb165f56690508c1df89b9d88b34e17f220db432ecc521
SSDEEP 3072:vtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:vIJjiJcbI03GBc3ucY5DCSj
TLSH
T1ED545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zurmjeczur.sys

Path C:\Temp\zurmjeczur.sys
Size 293KB
SHA256 8a11182b3e6acec4ab5640b0011aadd6a94aaa4c292fbd0828b23f804380f8e9
MD5 44ff88f62e87ed9abed730777cd384af
SHA1 18ceac8f20dab55352423a717e3f81f79fa7f7cf
SHA512 38b32b4fd616544d2d93f8df70e876b3d8e039bc777e92d155149f5e03f01fe5f1c54383c3af3be9c44af18d7142e8de3976b2518c26ce176c1cb778122932a1
SSDEEP 3072:etKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:eIJjiJcbI03GBc3ucY5DCSj
TLSH
T139545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zwrpjhbzxr.exe

Path C:\Temp\zwrpjhbzxr.exe
Size 376KB
SHA256 6bb38f99c3c2d396a5fa732958cc49a5a0417512b0062c4dcf39a708dc79072c
MD5 33971e139aab7f6f05a9d8866e5e5278
SHA1 2f39a93b2b8f71e35d0056d56c926ae584781183
SHA512 625df58986641c4c50383b885820dff196e42602826678338c66f263dbf0d418575b0db5190200a6da861a1e195e693ef14793dbde0a619b529f1b5dd76d4444
SSDEEP 3072:QFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:QFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T152847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ffe13798c5910685872d371e84c30baa9eefaaa5db1419603eb30d473d7b2e37
MD5 03c111f9396889c77f6d9883c5df333f
SHA1 be65300843096dba92c5695fd35e2dffcbb7eb0a
SHA512 a77dfe3b48fcb72648f1adfafbf0d0fcd4d88690dcf41609a03e1d6b645d1336b6e322931b2205673283b920d20ed0225c6aa320a83a2d3a410771f18d120c19
TLSH
T1B1D09BD079145D78C4C1353231A773155A516435865C46481151F3BACD65141667E59D
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7add6572365d752d8c3a090b9a256c43e3c5ff716f29ed7aa3c53dc57a08ba60
MD5 0da70f521ac5aee3489abf6e3eb4e375
SHA1 0f3cd9919820116ecc86bab93f4712c08485dc56
SHA512 a9cddd04863b2ac842fe4f91265c19a41d8b7442be8f07a91747705beca52c1e1d563e3c46cf68e1b73606695624f13ca69a8246653c2535d0684ced42c37d33
TLSH
T182D09BD479045D78C4C1353231A673155A616435DA5C46481051F3AACD65141667F5AD
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 3890eb0483158559c6ae7eb094cf552427da722c4b251c1f86f58991a1fdef85
MD5 4f291fc44dcc2f202e9a2a50049e6aa9
SHA1 923e94c94769623ac3ced83f7f2e9137413a4626
SHA512 78c93fbc97c575d03ed2390a7ce5393fc1be3f6cd73446ce057dfb9866fcfe34ce39dc39d941727d3973bf22d4cb6ce605273443291ca10a9662959050480a56
TLSH
T1C3612DD69F221993EB20487154A3644B7AF184EA1D0B2F41E07CEDB95906FF890F817F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 4cb4a5940e31679dfff1d46fd052300a87e9647b0d49a122d00b3b76b34e0f41
MD5 4d11412e43b0632b0957f1f43624f0ca
SHA1 8b936e5405e2b52d2b9102daaad3bcb5480a95bd
SHA512 6933b2699e56c7247f9b15a48965ece96794b18c8d780a0c85cda643b7b0d1c13c7d20e850d9b9e497d63df605c3f0e06bd9dc522cf8ffba2782261a651e98e6
TLSH
T12041C0F783F4857D8A11D6F0AA146E1FCE2D0515432C7C56C9E4AE2B93E3471E141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 837a75d2d7930d382dc62c0be978b6568e0a34e9e73085c9175e26a830ca74d0
MD5 0352ef10ee03b755f99a58fe97339d54
SHA1 19993ccd0473e9876b188231f4c805eb9588a05b
SHA512 e34a0227ded63d1383679a11a34dccd555a5846129fe232bc9f2cf8e8a1ddf949bf3c1e130dcebb7a36fe52d207d73b95f33ff1d10f5dcc7e93e96e2e21bf10e
SSDEEP 192:sxR8RqCv/f+skkFBdRtZtlzoA8p9c/g6+WNCwn/YlfZD7dGGIgVoBJ:sxR8Xv/f+skkFDRDtIC/5p/S5a
TLSH
T18242A9166E68AD374CC7E219BA557F53E3F95032B0D51E48EAFD861C04E76DE120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 8b7e4c3c664b6e32965105de4be7afbf8802dc8f081f71ccaf38bb59a8b7b5f5
MD5 ccbee3d918feff8781505b913a4b1362
SHA1 df4906f995635cd4910ad45193059cbb7e13a625
SHA512 a594309a331f8ac04a03529c6a7e20091c0eabac5a58971908f9c10e76fd13f39f4f97890cd46e3d9e1c6ee0ac8d1c799a49cd0e98e010cf754b70f9ce19ab67
SSDEEP 192:sxRTRqCv/f+s8kFBdRtZtlzoA8p9c/g6+WNCwn/YlfZD7dGGIgDmoBJ:sxRTXv/f+s8kFDRDtIC/5p/S5T
TLSH
T16B42B91A6E68AD374CC7E219BA55BF53E3F95072B0D11E48EAFD8A1C04E76DE120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 c3426562f296e63bd8318f7a94467a6717ff67717160e3a2f2dce875b6781525
MD5 112e18b3a2260199df20c84856055fd5
SHA1 769cd926630b4414315342659f43295638daa63a
SHA512 e438f6da9ee837570ab525129300903b2e0cd6cf44f6ebf6338e6348af17abf95b0e57be2ac69f6c5ca41ef9d99b4500650d058d8b4f3e328be4bc950dc030e9
SSDEEP 192:sxRTRqCv/f+s8kFBTRtZtlzoA8p9c/g6+WNCwn/YlWnZl7dGGIgDcoBJ:sxRTXv/f+s8kFtRDtIC/5p/75d
TLSH
T12442C91A6E286D379CC7E219BA557F53E3F95072A0D11E48EAFCCA1C04E76CE120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 7d6c74526a387712468f2e6b84346156e32dafe3ff4f505330a7d6d7fac3263c
MD5 caf1d8c45a3e013cb3a07442260798e9
SHA1 ab9d09bbb9d5254eb6eeef1ae1979032618a4749
SHA512 6ef79b430afa66ff5dd62b4b2722032bf014f011ac68a9440e5aeb3baf023a9177ea697daa31204fd5cd400b4dd1a07bbd9932bd0eaaa18c28ad5f43c6d99ffc
SSDEEP 768:dofACj7pLuL7AxWgg+fJJ8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3aN1314roYs:dofACVE7AxWgg+fJJu1jawaNl1DYs
TLSH
T11DD2DA7B640CCA7E4F804ADDEC19BA9F6D6802CB9698C94047FE981C03C6BEB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a1692458d83a9448551023db8b29851a48e26d15c5ad202b28fcea3591c04eea
MD5 ca1c8d5785b82ce163462b780fa62988
SHA1 5c544637ac69d20e82382240a2949913ed215f9d
SHA512 cd70ae79207728d15428d6a672061c451e984391659122084a182a406e800b1e973ed726a4eeb3a8361104ce85608ac48ba7e0d9ad396b6b9702106e66bbdbee
SSDEEP 96:KRdqjXNn7vWj4mgfvK4+gBvcldQzLkHGbqGAoouWYN1gmuK4bgUucumFEJKQKHqP:CdqjXNn7Oj4XfV+gBkldQzLkHGbqGAoR
TLSH
T199917615357742803C7E664C92B99D5B928274B37016BA6F3BB801A20F6BE835DFDCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a7234.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a7234.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 28917afc47223a0a1489eb4f918d5a08ce313dc00b9d86feca05242c8eda72ac
MD5 53fab739609634a1f97eb8d88ff48d83
SHA1 35858d11b1722e3b29b3c630aa73a30c8912fa66
SHA512 728322cec5a240d025e7caf9cae126e0cd95c2df2826c3ecb38c016623a32de9e978ffa2d16b932230ea6c46816b4fff5a9f7d7162bd794bdcc8e94c5bb78775
SSDEEP 384:nSNZcII38NyvBH6OcwadCzRfY9bYb0mhqDgfWQPlLJQXmIkdP9IimIMWEfMbc+Hs:KI3Eya4iJbhENHXmTWTbc+HjPi9PXj
TLSH
T105F2BF70ECF99E639DF6DF84A6466A02BEF50163E0C41998CDD9AB0E168755E0307C3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 88ca30990fa951e4f708d8a30fa3e758e262136d9f80845084cc07ce5829dfa2
MD5 84aa793b679566c7858c98608fa30b63
SHA1 d47c048a820ac979a26d8dc33ff1138897599437
SHA512 347d850c91399ffd11eb8c1457dae8b297ce86fc0b5946852584d37af941673a3eeea9f7d52aec05d8a194e020ad3f9855935870aebe4e0f07b4d7bacbca96f8
SSDEEP 768:hrv+4UNbdM358GiJbh8NHXmTWTbc+ejeVH1SvyZ:hbsb+3n9eWn14EH1dZ
TLSH
T16903BF319CAD9A37AEF69B84B44BBA177FF9015395C40994CDC92B4E068748D034BD3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 0d2ef8337a2c944293d2aedf1cf84d029eac89bc13bb53cf504527292fc30c9d
MD5 100dda4937ecf4963f4308ab9472ce64
SHA1 5dc878c57ad7bbaf38e3c13bc144fe3869e54826
SHA512 244c3cdbb50363a6b869127f39f26fc329ed25994142395748eb7399b324e94af81c0d6a12ec0c46a7e9436aae9da3d77521767612baed25190ec40b98562e0d
SSDEEP 384:ndZcII38NyiBH6OcwadCzRfY9bYb0mhqDgfWQPlLJQXmIkdP9IimIMWEfMbc+HjY:FI3Vya4iJbhENHXmTWTbc+HjPi9PXj
TLSH
T108F2BF70ECF99E639DF6DF84A6466A06AEF50163E0C41988CDD9AB0E16C755E0307C3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 9c284d139625176480a0fa9c001adbfc63dd68acc75ebba189c5302365d64548
MD5 7a3d06d5c46b0f21fdb4711d9af937e9
SHA1 378bf75f9afc277511ebd42c82dbad4a5febf858
SHA512 fbb8df9225d40f9b45d8557517bd14923e4944d7eb04873d3552d0f0af9364dd717b58fcdfc392e82c348d4ff68bc7f9ac66d1e38746689f6d0cad9cc7ef7008
SSDEEP 768:vrv+4UNbdz3BWWa4iJbhENHXmTWTbc+HjPi9PTT:vbsbZ33zeWn1DPeT
TLSH
T18313BF71ECAD9A739DF69B84A14B6A077FF801A3A4C40598CDC96B4D16CB45E031BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 37121a6cd7e06090ee724aa1f0bcae5ad0ccdfa45f572d57ec5500d4bd645806
MD5 c08a1b83aa2943d4cccba7578069b09d
SHA1 22938f9036657da59256111f98c5bf53837b114e
SHA512 3283985ce98ae4f76f0186d6ed2090018eb4548f6b91841957fad3f220fe5e3b8f06186b297b23fa0502b4b9a54fe9bf1c0e7f4d9e018def761a3dc7cdeee9b2
SSDEEP 768:arv+4UNbdM35EEiJbh3NHXmTWTbc+/1eVH1SvyZ:absb+3RIeWn1dEH1dZ
TLSH
T14A03BF319CE98F37ADF65788718BBA573EB8016389C40684C9C96B4E428B48D170BD3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 a565ff581dcc4a79cd6c1e973fb894eed435eb1ad3afb7b94fcf2d14858188bd
MD5 e06f832d4bafbbd21c08a9584a85bede
SHA1 9a1bce0b894f4b63ddfc8bc2fe0409d77938cad0
SHA512 f11cbe7508a0aa4d754cf0b0d49b07bc121e1f3d017ed8b42e8914965815cdda77e2a16421b60bd7ccee01de57aedab54c37d3ab4ba27ee72d7b2de3609fefa2
SSDEEP 768:zFQK3twgGZa45Ju/jbhyNHXmTWTbc+HjPi9PXj:WK3CeceWn1DPg
TLSH
T1F5134AF198DB8A37DDAE8B87A77E2E01AEBDC163B0841554BBC9550DDD4207FC306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2484_1240272755\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 846e0bcc26a65334d89451fdfb38b6030cfc66d180e9a16331d9bc84199ff843
MD5 dbdd30f20f206c83a1040cf0627c80ac
SHA1 f849c0c285d933a9691b20f9366bc1fad550dd7c
SHA512 b14e416fe8f7cbbeaac0e851866f6f00522edd0c5337e83eda9d29fa562faf5921e3abe89495cad0f1852447570c43957d6be74b812436228de43f852e0c03d8
TLSH
T1C171274357B8D5B3C2DE5FF002835544F5FF223C07633120076555869B30A3654B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/564-369-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1184-446-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1332-261-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1500-313-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1516-332-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1624-382-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1744-390-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2124-328-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2540-442-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2792-189-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3120-286-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3360-309-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3900-421-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4500-273-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4540-64-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4584-457-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5080-357-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5504-410-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5664-236-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5984-477-0x0000000000010000-0x00000000000AB000-memory.dmp

Download