systex | 785e6c0ef21168b22dfcb7c11dace5fa2f795210ae552157054130e9a9be6975

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 22:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_f34ba4394a14749633aaaf751ff214fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Size 376KB
Sample260814-2pacdaaq2x
SHA256 785e6c0ef21168b22dfcb7c11dace5fa2f795210ae552157054130e9a9be6975
MD5 f34ba4394a14749633aaaf751ff214fc
SHA1 7ac74012efebfc7d37298d073ec84ed415d73d0f
SHA512 c110789e524b039d87665d301dc37125754d8d3b5c73911b71a3c6e3d79397e6ad5aec0a06378d49fc3363cfccc0b52854609f6dc21f05b92372a071d26362b5
SSDEEP 3072:nFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:nFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T18B847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
5952	bwuomgerojgbztro.exe
2696	bwuomgerojgbztro.sys
4660	CreateProcess.exe
1108	ywtrlgebwt.exe
5316	CreateProcess.exe
4160	CreateProcess.exe
5568	i_ywtrlgebwt.exe
1764	mgeywqojge.sys
2432	CreateProcess.exe
3564	eywigbytql.exe
3344	CreateProcess.exe
3740	CreateProcess.exe
4632	i_eywigbytql.exe
2400	nlidbvtqoi.sys
420	CreateProcess.exe
2804	olgbytqlid.exe
2308	CreateProcess.exe
4904	CreateProcess.exe
3036	i_olgbytqlid.exe
3900	dyvpnliday.sys
2888	CreateProcess.exe
4892	dayvqnigay.exe
1728	CreateProcess.exe
5568	CreateProcess.exe
3480	i_dayvqnigay.exe
4124	aqnifaysqk.sys
5936	CreateProcess.exe
2936	kfcxvpnhfa.exe
5780	CreateProcess.exe
1756	CreateProcess.exe
4272	i_kfcxvpnhfa.exe
4832	icaxspnhfz.sys
1112	CreateProcess.exe
3000	xusmkecxup.exe
5652	CreateProcess.exe
5404	CreateProcess.exe
5512	i_xusmkecxup.exe
1056	hfzxrpjhcz.sys
4436	CreateProcess.exe
5876	hezxrpjhcz.exe
4420	CreateProcess.exe
5524	CreateProcess.exe
5228	i_hezxrpjhcz.exe
4828	jebzwromjh.sys
2364	CreateProcess.exe
2588	jhezwurpjg.exe
960	CreateProcess.exe
2952	CreateProcess.exe
5800	i_jhezwurpjg.exe
2476	rmjecwugey.sys
4200	CreateProcess.exe
5816	bztrojhbzt.exe
4132	CreateProcess.exe
5980	CreateProcess.exe
2720	i_bztrojhbzt.exe
5552	bywrojhbzt.sys
1764	CreateProcess.exe
2000	wtrljytqol.exe
3552	CreateProcess.exe
4668	CreateProcess.exe
1136	i_wtrljytqol.exe
4952	eyvtnlgdyw.sys
1520	CreateProcess.exe
5964	eywqoigbyt.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4520_69167269\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4520_69167269\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4520_472768605\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4520_627585700\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4520_627585700\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnhfdavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtrljebwup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbytrligey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_olgbytqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dayvqnigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dayvqnigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrojhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywqoigbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbytrligey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywtrlgebwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywqoigbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdavtnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upmkifaxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomhezwur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywtrlgebwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywigbytql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hezxrpjhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtrljytqol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_upmkifaxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axrpkhcaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywigbytql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kfcxvpnhfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xusmkecxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrojhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbolgeywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhezwurpjg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdavtnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtrljebwup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhezwurpjg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtrljytqol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axrpkhcaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomhezwur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbolgeywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_f34ba4394a14749633aaaf751ff214fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwuomgerojgbztro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	olgbytqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfcxvpnhfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xusmkecxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hezxrpjhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnhfdavs.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
204	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5228	ipconfig.exe
1416	ipconfig.exe
5244	ipconfig.exe
5700	ipconfig.exe
3692	ipconfig.exe
2968	ipconfig.exe
2444	ipconfig.exe
2632	ipconfig.exe
548	ipconfig.exe
616	ipconfig.exe
5276	ipconfig.exe
4192	ipconfig.exe
900	ipconfig.exe
6028	ipconfig.exe
4724	ipconfig.exe
4932	ipconfig.exe
3512	ipconfig.exe
4796	ipconfig.exe
944	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134312211070029718"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2301830172-776172150-2531349243-1000\{F0AD11A2-ADA6-4609-A8A0-03C89B16870A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3380	2026-08-14_f34ba4394a14749633aaaf751ff214fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3380	2026-08-14_f34ba4394a14749633aaaf751ff214fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3380	2026-08-14_f34ba4394a14749633aaaf751ff214fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3380	2026-08-14_f34ba4394a14749633aaaf751ff214fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3380	2026-08-14_f34ba4394a14749633aaaf751ff214fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3380	2026-08-14_f34ba4394a14749633aaaf751ff214fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3380	2026-08-14_f34ba4394a14749633aaaf751ff214fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3380	2026-08-14_f34ba4394a14749633aaaf751ff214fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3380	2026-08-14_f34ba4394a14749633aaaf751ff214fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3380	2026-08-14_f34ba4394a14749633aaaf751ff214fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3380	2026-08-14_f34ba4394a14749633aaaf751ff214fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3380	2026-08-14_f34ba4394a14749633aaaf751ff214fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3380	2026-08-14_f34ba4394a14749633aaaf751ff214fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3380	2026-08-14_f34ba4394a14749633aaaf751ff214fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3380	2026-08-14_f34ba4394a14749633aaaf751ff214fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3380	2026-08-14_f34ba4394a14749633aaaf751ff214fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3380	2026-08-14_f34ba4394a14749633aaaf751ff214fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3380	2026-08-14_f34ba4394a14749633aaaf751ff214fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3380	2026-08-14_f34ba4394a14749633aaaf751ff214fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3380	2026-08-14_f34ba4394a14749633aaaf751ff214fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3380	2026-08-14_f34ba4394a14749633aaaf751ff214fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3380	2026-08-14_f34ba4394a14749633aaaf751ff214fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3380	2026-08-14_f34ba4394a14749633aaaf751ff214fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3380	2026-08-14_f34ba4394a14749633aaaf751ff214fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3380	2026-08-14_f34ba4394a14749633aaaf751ff214fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3380	2026-08-14_f34ba4394a14749633aaaf751ff214fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3380	2026-08-14_f34ba4394a14749633aaaf751ff214fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3380	2026-08-14_f34ba4394a14749633aaaf751ff214fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3380	2026-08-14_f34ba4394a14749633aaaf751ff214fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3380	2026-08-14_f34ba4394a14749633aaaf751ff214fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3380	2026-08-14_f34ba4394a14749633aaaf751ff214fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3380	2026-08-14_f34ba4394a14749633aaaf751ff214fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3380	2026-08-14_f34ba4394a14749633aaaf751ff214fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3380	2026-08-14_f34ba4394a14749633aaaf751ff214fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5952	bwuomgerojgbztro.exe
5952	bwuomgerojgbztro.exe
3380	2026-08-14_f34ba4394a14749633aaaf751ff214fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3380	2026-08-14_f34ba4394a14749633aaaf751ff214fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3380	2026-08-14_f34ba4394a14749633aaaf751ff214fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5952	bwuomgerojgbztro.exe
3380	2026-08-14_f34ba4394a14749633aaaf751ff214fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5952	bwuomgerojgbztro.exe
3380	2026-08-14_f34ba4394a14749633aaaf751ff214fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5952	bwuomgerojgbztro.exe
3380	2026-08-14_f34ba4394a14749633aaaf751ff214fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5952	bwuomgerojgbztro.exe
3380	2026-08-14_f34ba4394a14749633aaaf751ff214fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3380	2026-08-14_f34ba4394a14749633aaaf751ff214fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5952	bwuomgerojgbztro.exe
5952	bwuomgerojgbztro.exe
3380	2026-08-14_f34ba4394a14749633aaaf751ff214fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3380	2026-08-14_f34ba4394a14749633aaaf751ff214fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5952	bwuomgerojgbztro.exe
5952	bwuomgerojgbztro.exe
3380	2026-08-14_f34ba4394a14749633aaaf751ff214fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3380	2026-08-14_f34ba4394a14749633aaaf751ff214fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5952	bwuomgerojgbztro.exe
5952	bwuomgerojgbztro.exe
3380	2026-08-14_f34ba4394a14749633aaaf751ff214fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3380	2026-08-14_f34ba4394a14749633aaaf751ff214fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5952	bwuomgerojgbztro.exe
5952	bwuomgerojgbztro.exe
3380	2026-08-14_f34ba4394a14749633aaaf751ff214fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3380	2026-08-14_f34ba4394a14749633aaaf751ff214fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	5568	i_ywtrlgebwt.exe
Token: SeDebugPrivilege	4632	i_eywigbytql.exe
Token: SeDebugPrivilege	3036	i_olgbytqlid.exe
Token: SeDebugPrivilege	3480	i_dayvqnigay.exe
Token: SeDebugPrivilege	4272	i_kfcxvpnhfa.exe
Token: SeDebugPrivilege	5512	i_xusmkecxup.exe
Token: SeDebugPrivilege	5228	i_hezxrpjhcz.exe
Token: SeDebugPrivilege	5800	i_jhezwurpjg.exe
Token: SeDebugPrivilege	2720	i_bztrojhbzt.exe
Token: SeDebugPrivilege	1136	i_wtrljytqol.exe
Token: SeDebugPrivilege	3724	i_eywqoigbyt.exe
Token: SeDebugPrivilege	588	i_fdavtnlfdx.exe
Token: SeDebugPrivilege	900	i_xvpnhfdavs.exe
Token: SeDebugPrivilege	5972	i_upmkifaxup.exe
Token: SeDebugPrivilege	5592	i_axrpkhcaus.exe
Token: SeDebugPrivilege	5040	i_wuomhezwur.exe
Token: SeDebugPrivilege	1888	i_wtrljebwup.exe
Token: SeDebugPrivilege	1916	i_dbolgeywqo.exe
Token: SeDebugPrivilege	2884	i_dbytrligey.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4520	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3380 wrote to memory of 5952	3380	2026-08-14_f34ba4394a14749633aaaf751ff214fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 3380 wrote to memory of 4112	3380	2026-08-14_f34ba4394a14749633aaaf751ff214fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 4112 wrote to memory of 4520	4112	iexplore.exe	91
PID 4520 wrote to memory of 3660	4520	msedge.exe	92
PID 4520 wrote to memory of 352	4520	msedge.exe	93
PID 4520 wrote to memory of 204	4520	msedge.exe	94
PID 4520 wrote to memory of 352	4520	msedge.exe	93
PID 4520 wrote to memory of 352	4520	msedge.exe	93
PID 4520 wrote to memory of 3164	4520	msedge.exe	95
PID 4520 wrote to memory of 3164	4520	msedge.exe	95
PID 4520 wrote to memory of 696	4520	msedge.exe	97
PID 4520 wrote to memory of 4464	4520	msedge.exe	98
PID 4520 wrote to memory of 696	4520	msedge.exe	97
PID 4520 wrote to memory of 696	4520	msedge.exe	97
PID 4520 wrote to memory of 4464	4520	msedge.exe	98
PID 4520 wrote to memory of 4464	4520	msedge.exe	98
PID 4520 wrote to memory of 5976	4520	msedge.exe	99
PID 4520 wrote to memory of 548	4520	msedge.exe	100
PID 4520 wrote to memory of 5976	4520	msedge.exe	99
PID 4520 wrote to memory of 5976	4520	msedge.exe	99
PID 4520 wrote to memory of 548	4520	msedge.exe	100
PID 4520 wrote to memory of 548	4520	msedge.exe	100
PID 4520 wrote to memory of 4892	4520	msedge.exe	118
PID 4520 wrote to memory of 4892	4520	msedge.exe	118
PID 4520 wrote to memory of 2468	4520	msedge.exe	105
PID 4520 wrote to memory of 4256	4520	msedge.exe	106
PID 4520 wrote to memory of 2468	4520	msedge.exe	105
PID 4520 wrote to memory of 4256	4520	msedge.exe	106
PID 5952 wrote to memory of 4660	5952	bwuomgerojgbztro.exe	107
PID 4520 wrote to memory of 4952	4520	msedge.exe	110
PID 1108 wrote to memory of 5316	1108	ywtrlgebwt.exe	112
PID 4520 wrote to memory of 1484	4520	msedge.exe	115
PID 4520 wrote to memory of 1484	4520	msedge.exe	115
PID 4520 wrote to memory of 460	4520	msedge.exe	116
PID 4520 wrote to memory of 460	4520	msedge.exe	116
PID 5952 wrote to memory of 4160	5952	bwuomgerojgbztro.exe	119
PID 5952 wrote to memory of 2432	5952	bwuomgerojgbztro.exe	123
PID 3564 wrote to memory of 3344	3564	eywigbytql.exe	125
PID 5952 wrote to memory of 3740	5952	bwuomgerojgbztro.exe	128
PID 5952 wrote to memory of 420	5952	bwuomgerojgbztro.exe	132
PID 2804 wrote to memory of 2308	2804	olgbytqlid.exe	134
PID 5952 wrote to memory of 4904	5952	bwuomgerojgbztro.exe	137
PID 5952 wrote to memory of 2888	5952	bwuomgerojgbztro.exe	142
PID 4892 wrote to memory of 1728	4892	dayvqnigay.exe	144
PID 5952 wrote to memory of 5568	5952	bwuomgerojgbztro.exe	147
PID 4520 wrote to memory of 5812	4520	msedge.exe	149
PID 4520 wrote to memory of 1572	4520	msedge.exe	150
PID 4520 wrote to memory of 4976	4520	msedge.exe	151
PID 5952 wrote to memory of 5936	5952	bwuomgerojgbztro.exe	154
PID 2936 wrote to memory of 5780	2936	kfcxvpnhfa.exe	156
PID 5952 wrote to memory of 1756	5952	bwuomgerojgbztro.exe	159
PID 5952 wrote to memory of 1112	5952	bwuomgerojgbztro.exe	163
PID 3000 wrote to memory of 5652	3000	xusmkecxup.exe	165
PID 5952 wrote to memory of 5404	5952	bwuomgerojgbztro.exe	168
PID 5952 wrote to memory of 4436	5952	bwuomgerojgbztro.exe	172
PID 5876 wrote to memory of 4420	5876	hezxrpjhcz.exe	174
PID 5952 wrote to memory of 5524	5952	bwuomgerojgbztro.exe	177
PID 5952 wrote to memory of 2364	5952	bwuomgerojgbztro.exe	181
PID 2588 wrote to memory of 960	2588	jhezwurpjg.exe	183
PID 5952 wrote to memory of 2952	5952	bwuomgerojgbztro.exe	186
PID 4520 wrote to memory of 1280	4520	msedge.exe	188
PID 4520 wrote to memory of 1280	4520	msedge.exe	188
PID 5952 wrote to memory of 4200	5952	bwuomgerojgbztro.exe	194
PID 5816 wrote to memory of 4132	5816	bztrojhbzt.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-08-14_f34ba4394a14749633aaaf751ff214fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_f34ba4394a14749633aaaf751ff214fc_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3380
- C:\Temp\bwuomgerojgbztro.exe
  C:\Temp\bwuomgerojgbztro.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5952
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ywtrlgebwt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4660
  - - C:\Temp\ywtrlgebwt.exe
      C:\Temp\ywtrlgebwt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1108
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5316
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:616
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ywtrlgebwt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4160
  - - C:\Temp\i_ywtrlgebwt.exe
      C:\Temp\i_ywtrlgebwt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5568
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\eywigbytql.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2432
  - - C:\Temp\eywigbytql.exe
      C:\Temp\eywigbytql.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3564
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3344
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4724
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_eywigbytql.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3740
  - - C:\Temp\i_eywigbytql.exe
      C:\Temp\i_eywigbytql.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4632
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\olgbytqlid.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:420
  - - C:\Temp\olgbytqlid.exe
      C:\Temp\olgbytqlid.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2804
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2308
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5276
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_olgbytqlid.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4904
  - - C:\Temp\i_olgbytqlid.exe
      C:\Temp\i_olgbytqlid.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3036
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dayvqnigay.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2888
  - - C:\Temp\dayvqnigay.exe
      C:\Temp\dayvqnigay.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4892
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1728
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5228
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dayvqnigay.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5568
  - - C:\Temp\i_dayvqnigay.exe
      C:\Temp\i_dayvqnigay.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3480
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kfcxvpnhfa.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5936
  - - C:\Temp\kfcxvpnhfa.exe
      C:\Temp\kfcxvpnhfa.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2936
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5780
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4192
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kfcxvpnhfa.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1756
  - - C:\Temp\i_kfcxvpnhfa.exe
      C:\Temp\i_kfcxvpnhfa.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4272
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xusmkecxup.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1112
  - - C:\Temp\xusmkecxup.exe
      C:\Temp\xusmkecxup.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3000
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5652
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2968
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xusmkecxup.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5404
  - - C:\Temp\i_xusmkecxup.exe
      C:\Temp\i_xusmkecxup.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5512
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hezxrpjhcz.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4436
  - - C:\Temp\hezxrpjhcz.exe
      C:\Temp\hezxrpjhcz.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5876
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4420
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1416
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hezxrpjhcz.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5524
  - - C:\Temp\i_hezxrpjhcz.exe
      C:\Temp\i_hezxrpjhcz.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5228
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jhezwurpjg.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2364
  - - C:\Temp\jhezwurpjg.exe
      C:\Temp\jhezwurpjg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2588
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:960
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2444
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jhezwurpjg.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2952
  - - C:\Temp\i_jhezwurpjg.exe
      C:\Temp\i_jhezwurpjg.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5800
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bztrojhbzt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4200
  - - C:\Temp\bztrojhbzt.exe
      C:\Temp\bztrojhbzt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5816
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4132
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5244
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bztrojhbzt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5980
  - - C:\Temp\i_bztrojhbzt.exe
      C:\Temp\i_bztrojhbzt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2720
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wtrljytqol.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1764
  - - C:\Temp\wtrljytqol.exe
      C:\Temp\wtrljytqol.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2000
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3552
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2632
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wtrljytqol.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4668
  - - C:\Temp\i_wtrljytqol.exe
      C:\Temp\i_wtrljytqol.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1136
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\eywqoigbyt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1520
  - - C:\Temp\eywqoigbyt.exe
      C:\Temp\eywqoigbyt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5964
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5324
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:900
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_eywqoigbyt.exe ups_ins
    3⤵
    PID:5364
  - - C:\Temp\i_eywqoigbyt.exe
      C:\Temp\i_eywqoigbyt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3724
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fdavtnlfdx.exe ups_run
    3⤵
    PID:5016
  - - C:\Temp\fdavtnlfdx.exe
      C:\Temp\fdavtnlfdx.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2852
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2720
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6028
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fdavtnlfdx.exe ups_ins
    3⤵
    PID:1308
  - - C:\Temp\i_fdavtnlfdx.exe
      C:\Temp\i_fdavtnlfdx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:588
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvpnhfdavs.exe ups_run
    3⤵
    PID:3040
  - - C:\Temp\xvpnhfdavs.exe
      C:\Temp\xvpnhfdavs.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5536
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3936
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4796
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xvpnhfdavs.exe ups_ins
    3⤵
    PID:3432
  - - C:\Temp\i_xvpnhfdavs.exe
      C:\Temp\i_xvpnhfdavs.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:900
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\upmkifaxup.exe ups_run
    3⤵
    PID:2968
  - - C:\Temp\upmkifaxup.exe
      C:\Temp\upmkifaxup.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5244
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5276
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:944
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_upmkifaxup.exe ups_ins
    3⤵
    PID:5512
  - - C:\Temp\i_upmkifaxup.exe
      C:\Temp\i_upmkifaxup.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5972
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\axrpkhcaus.exe ups_run
    3⤵
    PID:5808
  - - C:\Temp\axrpkhcaus.exe
      C:\Temp\axrpkhcaus.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5956
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3232
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5700
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_axrpkhcaus.exe ups_ins
    3⤵
    PID:4924
  - - C:\Temp\i_axrpkhcaus.exe
      C:\Temp\i_axrpkhcaus.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5592
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wuomhezwur.exe ups_run
    3⤵
    PID:1712
  - - C:\Temp\wuomhezwur.exe
      C:\Temp\wuomhezwur.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5724
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2784
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:548
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wuomhezwur.exe ups_ins
    3⤵
    PID:5640
  - - C:\Temp\i_wuomhezwur.exe
      C:\Temp\i_wuomhezwur.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5040
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wtrljebwup.exe ups_run
    3⤵
    PID:4284
  - - C:\Temp\wtrljebwup.exe
      C:\Temp\wtrljebwup.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5212
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3584
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4932
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wtrljebwup.exe ups_ins
    3⤵
    PID:2956
  - - C:\Temp\i_wtrljebwup.exe
      C:\Temp\i_wtrljebwup.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1888
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbolgeywqo.exe ups_run
    3⤵
    PID:3180
  - - C:\Temp\dbolgeywqo.exe
      C:\Temp\dbolgeywqo.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1508
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1588
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3512
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbolgeywqo.exe ups_ins
    3⤵
    PID:3524
  - - C:\Temp\i_dbolgeywqo.exe
      C:\Temp\i_dbolgeywqo.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1916
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbytrligey.exe ups_run
    3⤵
    PID:4108
  - - C:\Temp\dbytrligey.exe
      C:\Temp\dbytrligey.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6108
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3860
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3692
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbytrligey.exe ups_ins
    3⤵
    PID:3176
  - - C:\Temp\i_dbytrligey.exe
      C:\Temp\i_dbytrligey.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2884
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x258,0x7ffc2932c188,0x7ffc2932c194,0x7ffc2932c1a0
      4⤵
      PID:3660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1604,i,16414401306951688959,16419821892925448173,262144 --field-trial-handle=2788,i,13369367950876421342,12938237577668465543,262144 --variations-seed-version --mojo-platform-channel-handle=2852 /prefetch:2
      4⤵
      PID:352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,16448351582221087929,5543811223853057924,524288 --field-trial-handle=2788,i,13369367950876421342,12938237577668465543,262144 --variations-seed-version --mojo-platform-channel-handle=2996 /prefetch:11
      4⤵
      System Time Discovery
      PID:204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2284,i,15405811487037962567,17837738910670343587,524288 --field-trial-handle=2788,i,13369367950876421342,12938237577668465543,262144 --variations-seed-version --mojo-platform-channel-handle=3224 /prefetch:13
      4⤵
      PID:3164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3536,i,828599719739553494,4354324728478518440,2097152 --field-trial-handle=2788,i,13369367950876421342,12938237577668465543,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
      4⤵
      PID:696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3604,i,14905209425100325057,5062092673786168640,2097152 --field-trial-handle=2788,i,13369367950876421342,12938237577668465543,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
      4⤵
      PID:4464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4324,i,12216585663632569419,5193218345971842826,2097152 --field-trial-handle=2788,i,13369367950876421342,12938237577668465543,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:1
      4⤵
      PID:5976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4344,i,9767154304828097783,17203393860466150942,2097152 --field-trial-handle=2788,i,13369367950876421342,12938237577668465543,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:9
      4⤵
      PID:548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3928,i,1314943565757865201,7915502436573675822,524288 --field-trial-handle=2788,i,13369367950876421342,12938237577668465543,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:14
      4⤵
      PID:4892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,3657834033133610294,2648176232430518236,524288 --field-trial-handle=2788,i,13369367950876421342,12938237577668465543,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:14
      4⤵
      PID:2468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,1289679379647009750,14817278403453684174,524288 --field-trial-handle=2788,i,13369367950876421342,12938237577668465543,262144 --variations-seed-version --mojo-platform-channel-handle=3900 /prefetch:14
      4⤵
      PID:4256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,3570973638257507033,1403812777309135790,524288 --field-trial-handle=2788,i,13369367950876421342,12938237577668465543,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:14
      4⤵
      PID:1260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,3570973638257507033,1403812777309135790,524288 --field-trial-handle=2788,i,13369367950876421342,12938237577668465543,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:14
      4⤵
      PID:4952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6200,i,10233295567626141599,14260278658638628964,524288 --field-trial-handle=2788,i,13369367950876421342,12938237577668465543,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:14
      4⤵
      PID:1484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6536,i,8503678248744270869,2906671859653085141,524288 --field-trial-handle=2788,i,13369367950876421342,12938237577668465543,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:14
      4⤵
      PID:460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,14195133759495471767,3488807036295466633,524288 --field-trial-handle=2788,i,13369367950876421342,12938237577668465543,262144 --variations-seed-version --mojo-platform-channel-handle=4612 /prefetch:14
      4⤵
      PID:5812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,2395645685850136997,5145962960503312289,524288 --field-trial-handle=2788,i,13369367950876421342,12938237577668465543,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:14
      4⤵
      PID:1572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,14627867457332628016,18246209444807967128,524288 --field-trial-handle=2788,i,13369367950876421342,12938237577668465543,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:14
      4⤵
      PID:4976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5648,i,9835176916044871327,18028811908177933117,524288 --field-trial-handle=2788,i,13369367950876421342,12938237577668465543,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:14
      4⤵
      PID:1280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,12529362724117099799,18166572843563883339,524288 --field-trial-handle=2788,i,13369367950876421342,12938237577668465543,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:14
      4⤵
      PID:3488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,915741190337916187,17318814373836715317,524288 --field-trial-handle=2788,i,13369367950876421342,12938237577668465543,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:14
      4⤵
      PID:2760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=924,i,7709080440244060172,14440691564928085630,524288 --field-trial-handle=2788,i,13369367950876421342,12938237577668465543,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:14
      4⤵
      PID:5108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,4825586928784167193,4476775664311695484,524288 --field-trial-handle=2788,i,13369367950876421342,12938237577668465543,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:14
      4⤵
      PID:6036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6788,i,10423062938927238812,9926070078878744914,262144 --field-trial-handle=2788,i,13369367950876421342,12938237577668465543,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:10
      4⤵
      PID:4640

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1376

C:\Temp\bwuomgerojgbztro.sys
C:\Temp\bwuomgerojgbztro.sys
1⤵
- Executes dropped EXE
PID:2696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4892

C:\Temp\mgeywqojge.sys
C:\Temp\mgeywqojge.sys
1⤵
- Executes dropped EXE
PID:1764

C:\Temp\nlidbvtqoi.sys
C:\Temp\nlidbvtqoi.sys
1⤵
- Executes dropped EXE
PID:2400

C:\Temp\dyvpnliday.sys
C:\Temp\dyvpnliday.sys
1⤵
- Executes dropped EXE
PID:3900

C:\Temp\aqnifaysqk.sys
C:\Temp\aqnifaysqk.sys
1⤵
- Executes dropped EXE
PID:4124

C:\Temp\icaxspnhfz.sys
C:\Temp\icaxspnhfz.sys
1⤵
- Executes dropped EXE
PID:4832

C:\Temp\hfzxrpjhcz.sys
C:\Temp\hfzxrpjhcz.sys
1⤵
- Executes dropped EXE
PID:1056

C:\Temp\jebzwromjh.sys
C:\Temp\jebzwromjh.sys
1⤵
- Executes dropped EXE
PID:4828

C:\Temp\rmjecwugey.sys
C:\Temp\rmjecwugey.sys
1⤵
- Executes dropped EXE
PID:2476

C:\Temp\bywrojhbzt.sys
C:\Temp\bywrojhbzt.sys
1⤵
- Executes dropped EXE
PID:5552

C:\Temp\eyvtnlgdyw.sys
C:\Temp\eyvtnlgdyw.sys
1⤵
- Executes dropped EXE
PID:4952

C:\Temp\tnlidbvsqk.sys
C:\Temp\tnlidbvsqk.sys
1⤵
PID:944

C:\Temp\faysqkicav.sys
C:\Temp\faysqkicav.sys
1⤵
PID:2540

C:\Temp\causnkfdxv.sys
C:\Temp\causnkfdxv.sys
1⤵
PID:1812

C:\Temp\causmkhcau.sys
C:\Temp\causmkhcau.sys
1⤵
PID:2156

C:\Temp\wurmjhczur.sys
C:\Temp\wurmjhczur.sys
1⤵
PID:4884

C:\Temp\zwuomjebwu.sys
C:\Temp\zwuomjebwu.sys
1⤵
PID:3384

C:\Temp\jdbwtomgey.sys
C:\Temp\jdbwtomgey.sys
1⤵
PID:4140

C:\Temp\eywtoljgby.sys
C:\Temp\eywtoljgby.sys
1⤵
PID:432

C:\Temp\dyvqoigayt.sys
C:\Temp\dyvqoigayt.sys
1⤵
PID:2088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aqnifaysqk.sys

Path C:\Temp\aqnifaysqk.sys
Size 293KB
SHA256 b06a8ea5514e940544c20016925ba8ec473ecd2ac43033a1d7baf776d849204c
MD5 189edde9e3d1dbae38c7c2207197ea4a
SHA1 4015e17310cc60222cfe9abedd0cf73da9e265af
SHA512 58654a74f775ddab127085877f3f752f3449093b9e46889aec10ab7838c22331d0de4a2b025a78fab06915e95d8df177dbfdc382b26744f14607dbc90817be0e
SSDEEP 3072:CtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:CIJjiJcbI03GBc3ucY5DCSj
TLSH
T1DA545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bwuomgerojgbztro.exe

Path C:\Temp\bwuomgerojgbztro.exe
Size 376KB
SHA256 21b54189b7889eb44dc30754f1c88636ff3cdc8e96a1d3e3df6174f1f53288aa
MD5 139531ce982e9924f51452c92b9a6591
SHA1 211e3047aa3769a56b4949a4deeec095e198d62b
SHA512 b060c9d27c15722377ca1dd89ac484ebadd7bc4a206c0391473dbb8c1a786c0a14372560305d63af45d70a41696e0581ab190d1eb132409e7ed04e20cf24d493
SSDEEP 3072:dFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:dFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E4847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bwuomgerojgbztro.sys

Path C:\Temp\bwuomgerojgbztro.sys
Size 293KB
SHA256 55a1bb7d7d0d95545508f8a7ffd988ca84a62a15b5b0ba46279baef49084222f
MD5 0b912b63059e1ca72e446115e5fb3338
SHA1 ab995f839c611d765bb37a87ac69bac68db5882a
SHA512 b752eb6ec8cdb9231f83848e0ede3eaa8a660b0c96813fb52dfc2d69a472c2fe6b1c59aeece310cbd4047c9dca39e1c5815894fb270df27f93c8510c6331406a
SSDEEP 3072:/tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:/IJjiJcbI03GBc3ucY5DCSj
TLSH
T1B3545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dayvqnigay.exe

Path C:\Temp\dayvqnigay.exe
Size 376KB
SHA256 012b34c0955d19fa2c6ccc9e7ebbcd82c272bde2e68ec0ecd2368184f748eaaf
MD5 22f5ea8ec608e03a0b601ff71dfa65fa
SHA1 de0d5cabb52a92bcfd5a3b9b99f855982f505a0f
SHA512 b253b61be582f755921da632364ba0e0a0ac5ad5fa0612662108259d24cace3738ff1b704f6a89245fd6427b709d6c044c89da54f2b55a8504195814ec901a54
SSDEEP 3072:dFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:dFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T160847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dyvpnliday.sys

Path C:\Temp\dyvpnliday.sys
Size 293KB
SHA256 332ea58cc22d7ef6900540f0e999eeda9d5237054a6358fcb72fb5166885bbf6
MD5 75c09ed8d54833c4f799f4c66dd57f1d
SHA1 57787fd4611a4889407a4fe2f0a681afc56883b1
SHA512 36cf03d550c3245a85912a125d7622db64fe4b08d597a1b4230cdd0395d05391c644c9840b8169793fdf56efccb7e44efd556fcf04681d850dd7dd163ae22a32
SSDEEP 3072:xtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:xIJjiJcbI03GBc3ucY5DCSj
TLSH
T194545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eywigbytql.exe

Path C:\Temp\eywigbytql.exe
Size 376KB
SHA256 389592ab46209912e1d2ac5b0c70d3bec38abf9aac5e29bb04d33f94af5a111e
MD5 efdef917621e071b7d2db1d67c9bcd5f
SHA1 1ebb7bfaf9a3857ca61e4c4b99ce957877a58408
SHA512 80759d43a6c4b13a295c3a1c8bc7e6ccd28269d8b46d38769c366ca7533017cf2d4174e01149c27c8363345f85a6981647213de394627103f35e46f660e77a38
SSDEEP 3072:/FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:/FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T192847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dayvqnigay.exe

Path C:\Temp\i_dayvqnigay.exe
Size 376KB
SHA256 7b7e4569cb271800497863e88d8df44504daa5156c4822b99b3adb1df991a670
MD5 f034c635a790cd87ee4b1944fb260c49
SHA1 b7fa1231e84153c79ce7f4987e9d28c9c61a53dd
SHA512 c53431dbe5ed905db52d2500541694ca39ca1d4deb63e2611edf0e75949fbd794db1c2c2e88291b9b7d05e413c85fe7bee5a308c1dc9a484c3de3d7421a93d57
SSDEEP 3072:MFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:MFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T10A847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_eywigbytql.exe

Path C:\Temp\i_eywigbytql.exe
Size 376KB
SHA256 cbdc234f1bb16d49b08a241da0ba5d9f06fefaee79ac6ca61f3cd64fea80199c
MD5 2342f410109d26cfb9a7ccaf89b91006
SHA1 a65d17870f148996f291a038a5f16c789775bb45
SHA512 cd6d3e85c1026d6f867800b277e7ebf4d405f0df0374bdba5c727c5002df64714334609869f9211953da70afde4b98a17cf5e364d841d7df2d39228905972045
SSDEEP 3072:kFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:kFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T183847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_kfcxvpnhfa.exe

Path C:\Temp\i_kfcxvpnhfa.exe
Size 376KB
SHA256 63b24b94050d96dd9bad4a9740dd8d9730ed0a6e7c6fbbee1ae9b7453fdb3204
MD5 0a89981328b7fa0677932670f4c41978
SHA1 228acd89e1d33dd7957cf89156c18070060ffe5d
SHA512 ff01827b102ba0bd2ca69d0f2b517dd1276f818dbeaa5b823ac2e33b2a9a286f2e8153ca397c3d21e1681c7b45f2368070957d0123e19c023d094cfa9f9c230e
SSDEEP 3072:4FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:4FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T18D847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_olgbytqlid.exe

Path C:\Temp\i_olgbytqlid.exe
Size 376KB
SHA256 f53f4f508251f0d57d143b7a93fa469b48b25812730a768a8fc0d25bd5e6ba0a
MD5 6618b93a4542d17e729292e4084219b6
SHA1 efe72d762fd6be6516438768ba1d70c36a838a92
SHA512 8bd71d9f4487ae5d9a5e85364a2b70faa2c845dd407b9af196e042f9f491a71cecbfae81fdad6437a4e2befe8fabeb6e99c453c52b42bf7db37cef691b269b67
SSDEEP 3072:jFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:jFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B5847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ywtrlgebwt.exe

Path C:\Temp\i_ywtrlgebwt.exe
Size 376KB
SHA256 974f3a83cb28043052b56536e0f22afd947a15ca3f39cf8a6ae4a440b95e6e13
MD5 7d884c0da4f5c46d347b25522bc508ea
SHA1 2d06ba98ecf9556c71d50824b3bb25106630e3ed
SHA512 9ee009d7f900c50df7c0dc7d2b76bf16d4a82a40a3513712808bdb99a8349d62a971f4ed0217adcfdbf4de2322b371c0e5cc03583fd46598cb486bb354d51434
SSDEEP 3072:YFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:YFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1DC847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icaxspnhfz.sys

Path C:\Temp\icaxspnhfz.sys
Size 293KB
SHA256 b6b986da5d40a1ddbd8066f128327d6f1501b429a8a5b8ee1826437b0b350a1d
MD5 6d94d1f5c7b27e4c23f92e1c8d17bd59
SHA1 74adf08b5c8fd969852ab8af7d7092b654d98943
SHA512 f88dd98ce8057cb14bcb08e64c9262d57d3e62512373052ceb591f77352f29b4dd3f9b69b2086e2e91e3103e131716043d83516b23ed7f034f44df7b495cf36e
SSDEEP 3072:QtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:QIJjiJcbI03GBc3ucY5DCSj
TLSH
T1D7545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kfcxvpnhfa.exe

Path C:\Temp\kfcxvpnhfa.exe
Size 376KB
SHA256 66396c1f7459c5f3564484498ad891c825fc49a1b443325e178b28de2f6e6a94
MD5 b683643530fe0ee134ac1e49a29aca3a
SHA1 1fc391a4ac6fb4d0042c32cf4f2453d39925e516
SHA512 b3c3ba4222c587e5ec8a9120cc65b0be90455f2b3f06122f5f7eba33e6063a518b45501facc8eadf047e34ee0ac59264dec9531919020ab7c26ffe9cc6c4e33b
SSDEEP 3072:EFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:EFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T195847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mgeywqojge.sys

Path C:\Temp\mgeywqojge.sys
Size 293KB
SHA256 28151f2d606b9588f4370f56fd3230752d4d4bde1a0b2b9f69508329394dfa1b
MD5 0928fc7c64c39a549e175ba499f3a43a
SHA1 27bfb971af85372fbe21cf449f054add80a5fbfa
SHA512 a21d899b76baf488661a2e04008c5712be11e2fe105e2d6ff84d21e06233827c8ff4b755a2ed6c825bc94fa29d7ecc38ec50f378612c932c959576120013f847
SSDEEP 3072:itKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:iIJjiJcbI03GBc3ucY5DCSj
TLSH
T109545B44AAA4B0F6D9D5043C00EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlidbvtqoi.sys

Path C:\Temp\nlidbvtqoi.sys
Size 293KB
SHA256 80d0295fa40c80dfd761f99753c8621e89f0979fccf84b55cba72cdb3808a45e
MD5 bf0c6e335996a5b6b4b81a3ee8768ded
SHA1 ace2db82f0d58759743df7cd19ece8b64c62add5
SHA512 ce703835f0418a9e42ffedefb646ccdb24c550bd6449d9c2e4a3d15821482bb3a1b6ccc17aa46aa8e7fb82bac943de813663c00eecd25935b54da77fcdf6ff15
SSDEEP 3072:btKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:bIJjiJcbI03GBc3ucY5DCSj
TLSH
T125545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

olgbytqlid.exe

Path C:\Temp\olgbytqlid.exe
Size 376KB
SHA256 d2b712fc2b59076bfc90395c671e94b2251f63a3b10bc9f7341dc496ca583843
MD5 d53d923e0f0ad5f1eefadae0eebd0fee
SHA1 37f3016dc50587b99db3c42b1fb6f33e2273beb7
SHA512 757cac2605be14cc9261f1b978556c77379f15a37e1d06c4e9f49711e4e4c89681f09162f6c3143488c6c5facd8651402d280874cf2036b8dea371906b3ac233
SSDEEP 3072:mFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:mFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E8847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xusmkecxup.exe

Path C:\Temp\xusmkecxup.exe
Size 376KB
SHA256 b90858224c12ee5f2c9824513c564ce071f675e49a6bf4bcc997f165f9f6cdac
MD5 029630267bd4fb19d725b6c87f08b699
SHA1 3a49ec5cdf46f56210d70f4abe82984849f323c2
SHA512 da89136e1b4ba108deeda5e0faea9b19b9e886051ace3e7a4b6814e2c49afcfd8540a30a9f36d37e301f0cce9f1602b20b0a209f2002d85257e869bad70cb0c8
SSDEEP 3072:tFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:tFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T167847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywtrlgebwt.exe

Path C:\Temp\ywtrlgebwt.exe
Size 376KB
SHA256 416e2ecaa9659663db65ae8ecaafbbd0044027f27670f3e683fc688ca7614bce
MD5 7c3d6ec89909b1f1a674f0d03e5090e7
SHA1 e7912601338a68efbe0d1c6ff41b05d741521c9e
SHA512 68f572e4a32490ca7ae040399204918574684890fb55a59ecae66cc3fdcb3f9b84cd4f6ddab40064c9f88ddffb01fea09f7e99da3d885935645f640a95a153e2
SSDEEP 3072:aFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:aFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T11B847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 e0424f12e2966d4edd61d48eb03e7a78e7aa9d384165acd4a8973fc664dca54a
MD5 7acb47b9e36d0b80e2fc9707e9c8e89d
SHA1 551a4ce1b41fc63afca9012e67ab4229c732feb7
SHA512 9b137ab83de648a2382112e33229e3ec6225fb81e794374fa123d6e7e13e4de7bc9858a11d08d360a0f72c10415e71a0f49f1cffe9e27deeea1ca3cbacdcc9b3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7K:fwUQC5VwBIiElEd2K57P7K
TLSH
T16BB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b53c58762bff2a5723ae446675e8f65fd50818b95383c8f3c7efef01af06e466
MD5 629a18fe1b7a241215c77a30d7d8d7ee
SHA1 5e7bd5b514f4e46a4b986c8b89d0025cf81a1f36
SHA512 04fd58619789dc107f680a57dba3aec42e4bab7c29c0defd7e1b8ca2d078ca4c91317932ff076171bae60d370b28de32c94039c6ab690d5004ddcb857977f38a
TLSH
T182D09BD575146914C5A1303E21D2935392504835601945874051E56D5C5479743FB5AD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c36ac766a384a109222b8b647d2f5c1c2e6c4672a4a2c6b8a01f6eac0a5df074
MD5 f9f896b0e6f281d55b1ca3fa3c1ccdcd
SHA1 db44df3874cd86a961c82d25f3ae2004f249b2df
SHA512 6b8c8d305c2d7e4a3b5efb6e1967d7db1b1ffdb7979edd315013037da369c923060dae4ef8a7219176aa7e0bc1fa4cb98e48470ea2f569243a95d3301f5a40bd
TLSH
T160D09BD575046A14C5A1303A21D1935392604835741945874051E55D5C5479743FB5BD
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7e22fe023e142c645ff8ce0498b55e07ba1e6a0aeb7918047656ef2de66a5441
MD5 edddd46ea7ccbab690d6e1a6a96c2d21
SHA1 917c8b1bce12078a09c8841583338ff90a47b9ff
SHA512 1b4ee5c1ff6ea79a7112c3e693c90128625a9ee68917b57a55c11fab9ea3d274649d8ec09ca697a2ec3778f923f4d6a43f606197d2aca3da8eeae022d07d20a5
TLSH
T15A61C55EC32EACE2C72490B315E208C9367484E1EACF2E9B82B6F57C940E795721433D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59a82d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59a82d.TMP
Size 3KB
SHA256 da20f8649f0c21f119a4c9aa21f10dfd6c06743746eaa5641a0fdbd50c18ba0d
MD5 cedbacd8da5281bbcc0b29d39d54ef05
SHA1 9cdbd2d4b284f1c161d70deef6991ca2e4945afe
SHA512 6de30507baee6f1cff70f04e38336bbc107bf36e2c6d36c5250e663b5cfe3808e56c1f7bb6883f37c6fbf6ad3954fb2c19aa940fce78c9716339e894b36c8277
TLSH
T1A961C55EC32EA8E2C72490B315E208C9367484E1E6CF2E9B82B6F57C940E795761433D
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 eac410281e823fffeec3747018fa79d95b48d8211f75bdfcf10d004c58fbca63
MD5 c299bc982e8bfc37b77c615710db4d91
SHA1 a4cfbebd3f28a4f7b78c3488ed889ae322adbaa9
SHA512 c53cfd5ab863097950a99cf637b0f0acf4c8eaadfc99ef3d4b37b8fd7f253483efc9c18bdc5900be7432130b80ec38d8614f6a50cdaeed4ff14855b8023de664
TLSH
T14D31ABB3C2E8C56E891156F0AB286E2BCE1D0A15832C7D5AC9E4EF2B93E3475D10158F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 6386bd2b87810e39e9185a23d11a8b1bddd229ae879b09cbae85ec579045503d
MD5 d568dab8dab9eebac96f8594389b9a49
SHA1 cbd765df1410a5241edcb3d452d00de70aaae843
SHA512 20149b650a928c57a9b991b8752b602c7b511fc8c5f5bf926d7618b09114dca906190241b405d3092ad54aab4acf5bdc946db7cedde37c9a035b08f9d3627f28
SSDEEP 192:sxRFURS4yM/jK1Ml8wCj/fRsJmysmZ8zoA8p9FL/g6+WNCFehKI/YxORlEJ7Goh5:sxRFUcw8j/fRsJmyDfL/5ocKI/5mpN2u
TLSH
T1C062C815AA7499778CDBD209FA55BB93D6F81562A1901E44AEFC8A0C00E67ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 e543b0484599096386950440ffd7f2824d171d7fd796db7c30a9f7de810cace3
MD5 7e3fd869df4b157fa9d85894c42e8969
SHA1 842d323d41a5a404dce5b0c1c2d0a4551673d628
SHA512 058d8ee8ccc72ce5cfd249e0ccaca5f1a4004da0c5eb3505ca5458631bc4a716276ff36cb943042d5c6e719c60a69df191dc1c44a10d02020c602743f881f726
SSDEEP 192:sxRF7RS4yM/jK1Ml8wCj/fRs3mysmZ8zoA8p9FL/g6+WNCFehKI/YxORlEJ7Goh0:sxRF7cw8j/fRs3myDfL/5ocKI/5mpNxu
TLSH
T1DF62D815AA7499778CDBD209FA45BB93D6F81572A1911E44AEFC8B0C00E67ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 b551f3128c58db2c414bb13a2e0ac0c131c1c3ee6fc441a471442abb1d974344
MD5 77d5c49f1e9956a9e5255e4fc3e3a60a
SHA1 273dca52e6f05930340564d63c1448b792cb0690
SHA512 964967d4f9a0e2de395c8fa374fb4578e406b995af84b7c7305b3bb40be56cf54325b212475d5dd681158e0bf94d6a969756aff188df492682543ff9009044f6
SSDEEP 384:sxRF7cwqbj/fRs3qyLGAHBL/5ocKI/56pNnu:sR7c3bj/fMqy1L/5ocKa56W
TLSH
T16062C715AA2499778CDBD209FA95BB93D6F81573A1900E44AAFC8F1C00E6BDD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 b3b930d92435efaf35151e4a8890ef360bcd6e1f8d26b3dc243b3e6bb3faf613
MD5 1221de22734c53c27a4f091996494f47
SHA1 6a76b037b9395fb3ba27a625cf76df4b4cf03b69
SHA512 dc9fb882ba00ad9d6441f5df06a3130a2cc584117de06eec29bbf0fe4cb14f1069e9bad62c853635c71e3cc3803713554a4be6340f655d495f868b7aa4c388e9
SSDEEP 768:0xCyUZs7pLuL7ijWgbrfM18F1+UoAYDCx9Tuqh0VfUC9xbog/OVYDHrVAzroJJdT:0xCy4QE7ijWgbrfM1u1ja/DHpAAJJYq
TLSH
T103E2EC7B680CCB7F4F404A9DEC297EDAADE802CB96D8C95447EA480C03C67EB51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 96790ebbaa6c1e2c4829d542b4fda688fc01981c3a807e76c6a02d334d621b87
MD5 4014e7fc1c6ccf73866c64f01cfcc4f2
SHA1 0bb8d76b98fba0b7e38053ddd9a324eff5addf42
SHA512 5eaf73d9920909685856bfae12c69e2e6cfb715de6810362905d8199db2c26be948ab619dd665afaaf2be45d8ee5d1444e70cf26a55b7f8e73ce8a29cec25f18
SSDEEP 48:KyOXQse8IXVhIpKKcM7ypGIPK/aUjEITK5yMzyc:KAVhWKKca6GYK/a8EoK5yil
TLSH
T104A1D1A2B5BA13422DBE69089594C626CA8271E33014A42F7BA900764FBFF514DFC9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a43f0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a43f0.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 cbcb7a61cbd1c706250ff49345ca2fe9925337daeba9f3e5e88cd6c11903023f
MD5 f117bf7886de03b3f7d1131839dda01b
SHA1 1b451c8d0f02662c9b0a32beab0fc2674085d390
SHA512 1e4e12241be23a58407ff7804aa642216c6b2819720b45ff03855c23ba7d7ec9f4224cb93fbfd2c8bd79e4cb70d0493ac64b4b64c20d9b24927542ca14ceb102
SSDEEP 768:NFQe3QwgaRVnF669yrqUjWiIwwxMt0Pi9Pd:ce39nF66INWZTMSPi
TLSH
T1741329F098D78A77D8EE9783633D6E829ABCD053B5844994B7C89E0CCC861BFD706815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 c2ee1d4826fd07978278590a33f973f84b40d1e1713495188255621762316c1d
MD5 60b806e049aa714b0afaf9de28aabfdf
SHA1 0791775f854649f6df969a7f2d3cc4d521d05ce3
SHA512 4c2c1f0a135c19b23140d842abd19bb12c5e8e7ca344227a588bc53d9b964dc026b62201ce8292c837a95f33595b86056330d9025cd0687c259e85b7547faf90
SSDEEP 768:arv+4UNbdl3tPkKL2+jF669yrqUjWiIwwxMRbUiler:absbX362jF66INWZTMFUsQ
TLSH
T16E03CE35AC589AB3CDF2D28672437783BFB4109396C40B98CACD670D469B4DD2343A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 1c6d07bca6daa030c3b1286052ef0e1bab496bddbe7994a5583e43c839203d86
MD5 ff0dacdb6e2088a8c0d9817e90e89695
SHA1 7262499934aad8bafd1fba38668f22110d746390
SHA512 2899900832e69366fe846dea26b1f9af06754f43c27106ba3610b30c1f98fd7086b1cffc338d8bcbdffbc61465bcc2214b18fada438abb4e55d30e257d3818b0
SSDEEP 768:/G3A0kKL2rjF669yrqUjWiIwwxMt0Pi9Pd:/G3ETjF66INWZTMSPi
TLSH
T124F2AF70B8A45EA7CCFAEB81725233C2EEB45163E6C40E9CDADCD70D058759D174B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 f63593a86ab80252963c448253f9fb99ca005d3533287bf41d14513d5b4877ba
MD5 a1705988c537e0020273148860627408
SHA1 856941e9c35f5820e03910fababd7afb4e62f3a1
SHA512 82eca6c3b464603fed73e6f4b2185f7f21b1ab4986991ae3c85a2cdac3a1a3ca203441aaa909c5d3fc02683acc5dd324d936ab1065b34eb59e348c96ade7f2e7
SSDEEP 768:rG3m0kKL2rjF669yrqUjWiIwwxMt0Pi9Pd:rG3KTjF66INWZTMSPi
TLSH
T1ECF2AF70B8A45EA7C8FAEB81725233C2EEB45163E6C40F9CDADCD70D058759D174B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 5956221ea3bd4909a35e50f2be8b75233e0f8b82190aa952c9b68a39327beb76
MD5 1763c71dfb115845a0c35c4591675942
SHA1 ed0e1fc750a16f3621e587accd2177eef3d12397
SHA512 761e268a99f836fec63fc743623ea6313231939ffcdf9e2cc3a29ac32986e8ef651399f84841887569a36d99050825ababdff5d197aae6a7cff81532d7f3ee40
SSDEEP 768:Drv+4UNbdl3QukKL2ejF669yrqUjWiIwwxMA0Uiler:DbsbX3CmjF66INWZTMVUsQ
TLSH
T18203CF30A8989A73CDF6D246B15377C3BF74209399C50F98CAD9570D464B1CE2B4B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4520_525507611\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 7c7a666153d3bbef164d9838e15b2ed996cf39345317eef5ad08022e3cc31530
MD5 09a9b75b2c3d0076d2167479351a2162
SHA1 2c374c88b8c8886d60d23ce27593b9f4723c33b8
SHA512 c1447ff91654991abb4895d346129a9c20f58daa6c01563648ee151bc38a833c3531f15a3db396a5d3b6c3a78904dab9ab4e8cd597d021b9427145f6add7d080
TLSH
T10171008357B9C5B2C1DA9FF102835608F6BB22784B2330210BA1554AAB30A7A24B8F08
MD5 SHA1 SHA512 TLSH

Submit Download

memory/432-496-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/944-424-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/944-403-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1056-319-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1764-194-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1812-428-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2088-500-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2156-448-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2400-241-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2476-346-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2540-423-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2696-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3384-472-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3900-269-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4124-281-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4140-484-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4828-323-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4832-294-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4884-459-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4952-383-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5552-354-0x0000000000010000-0x00000000000AB000-memory.dmp

Download