systex | 0f2a36cf079f2cee30adf2b4d9a127b587985fc745a3d49b28ee478dd8fd6ce7

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 04:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_50bed47a333e8033caadea78c598094e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Size 389KB
Sample260814-e3zsvsfb97
SHA256 0f2a36cf079f2cee30adf2b4d9a127b587985fc745a3d49b28ee478dd8fd6ce7
MD5 50bed47a333e8033caadea78c598094e
SHA1 9eff7163b6f85efe136de3b978ac912c3a6ec34b
SHA512 427e5a5fcbe710afdafe674d485e8d74c591f3ca73f4b7a036f0795383b4bf64edcc3ba2b23c48da4fe79b9801b80d74ed5ac4a3246ac6d1a0ee5d07815d7d20
SSDEEP 3072:Luxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:LuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T179847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
1232	ywqomgdbzwqoigeb.exe
2044	ywqomgdbzwqoigeb.sys
4068	CreateProcess.exe
6756	jgeywtomdb.exe
424	CreateProcess.exe
6344	CreateProcess.exe
724	i_jgeywtomdb.exe
3484	qljdbvtnlf.sys
1132	CreateProcess.exe
4212	qligayvtnl.exe
5468	CreateProcess.exe
2184	CreateProcess.exe
6972	i_qligayvtnl.exe
6256	ysqlidavtn.sys
6216	CreateProcess.exe
4576	icavsnlida.exe
6604	CreateProcess.exe
4128	CreateProcess.exe
4764	i_icavsnlida.exe
4280	caysqnifdx.sys
6412	CreateProcess.exe
4868	davsqnlfdx.exe
5760	CreateProcess.exe
1960	CreateProcess.exe
6272	i_davsqnlfdx.exe
4716	kicausnkfd.sys
5820	CreateProcess.exe
1832	fcxvpkicau.exe
3456	CreateProcess.exe
1944	CreateProcess.exe
5156	i_fcxvpkicau.exe
4700	ecxupmkfcw.sys
4572	CreateProcess.exe
5628	czxrpnkecz.exe
3052	CreateProcess.exe
4932	CreateProcess.exe
5200	i_czxrpnkecz.exe
5132	pmhfzwupmh.sys
6104	CreateProcess.exe
2148	hczurmkecw.exe
6648	CreateProcess.exe
6296	CreateProcess.exe
2072	i_hczurmkecw.exe
1400	rpjhbztrmj.sys
1364	CreateProcess.exe
6124	trmjecwuom.exe
1664	CreateProcess.exe
6280	CreateProcess.exe
2692	i_trmjecwuom.exe
5372	ywqoljhbyw.sys
5060	CreateProcess.exe
2864	bwtomgeywt.exe
6064	CreateProcess.exe
1240	CreateProcess.exe
2380	i_bwtomgeywt.exe
1216	gbytrojgby.sys
7092	CreateProcess.exe
6120	dywqoigayt.exe
5328	CreateProcess.exe
3672	CreateProcess.exe
3116	i_dywqoigayt.exe
4652	vtqoigdbyt.sys
1692	CreateProcess.exe
6848	tqlidbvtnl.exe

Loads dropped DLL 1 IoCs

pid	Process
6932	msedge.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6932_251211539\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6932_493055869\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6932_1062139517\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6932_1062139517\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6932_1062139517\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6932_1874197099\domain_actions.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6932_251211539\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6932_854796663\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6932_854796663\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6932_493055869\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6932_1062139517\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6932_1874197099\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	davsqnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_davsqnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hczurmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxvsmkhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxupmkhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgeywtomdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljhecwur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqlidbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdayvqnlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcxvpkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czxrpnkecz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwtomgeywt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dywqoigayt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bzxupmkhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqolgdbytr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_50bed47a333e8033caadea78c598094e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqomgdbzwqoigeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwtomgeywt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqlidbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzxupmkhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljhecwur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gebwtroigd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ayvqnljdav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgeywtomdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qligayvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czxrpnkecz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxvsmkhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ayvqnljdav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trmjecwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdayvqnlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkifaxvsqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkifaxvsqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icavsnlida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fcxvpkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hczurmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trmjecwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxupmkhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqolgdbytr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qligayvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icavsnlida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dywqoigayt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gebwtroigd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4872	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2776	ipconfig.exe
4784	ipconfig.exe
6536	ipconfig.exe
6836	ipconfig.exe
2652	ipconfig.exe
6804	ipconfig.exe
4292	ipconfig.exe
6804	ipconfig.exe
5324	ipconfig.exe
5112	ipconfig.exe
1728	ipconfig.exe
5764	ipconfig.exe
6368	ipconfig.exe
2196	ipconfig.exe
1036	ipconfig.exe
1092	ipconfig.exe
2780	ipconfig.exe
6896	ipconfig.exe
5524	ipconfig.exe
6140	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134311553299333159"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{A3ACDD5A-184D-4568-BEB1-91B26299C76B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2604	2026-08-14_50bed47a333e8033caadea78c598094e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2604	2026-08-14_50bed47a333e8033caadea78c598094e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2604	2026-08-14_50bed47a333e8033caadea78c598094e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2604	2026-08-14_50bed47a333e8033caadea78c598094e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2604	2026-08-14_50bed47a333e8033caadea78c598094e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2604	2026-08-14_50bed47a333e8033caadea78c598094e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2604	2026-08-14_50bed47a333e8033caadea78c598094e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2604	2026-08-14_50bed47a333e8033caadea78c598094e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2604	2026-08-14_50bed47a333e8033caadea78c598094e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2604	2026-08-14_50bed47a333e8033caadea78c598094e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2604	2026-08-14_50bed47a333e8033caadea78c598094e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2604	2026-08-14_50bed47a333e8033caadea78c598094e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2604	2026-08-14_50bed47a333e8033caadea78c598094e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2604	2026-08-14_50bed47a333e8033caadea78c598094e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2604	2026-08-14_50bed47a333e8033caadea78c598094e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2604	2026-08-14_50bed47a333e8033caadea78c598094e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2604	2026-08-14_50bed47a333e8033caadea78c598094e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2604	2026-08-14_50bed47a333e8033caadea78c598094e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2604	2026-08-14_50bed47a333e8033caadea78c598094e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2604	2026-08-14_50bed47a333e8033caadea78c598094e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2604	2026-08-14_50bed47a333e8033caadea78c598094e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2604	2026-08-14_50bed47a333e8033caadea78c598094e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2604	2026-08-14_50bed47a333e8033caadea78c598094e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2604	2026-08-14_50bed47a333e8033caadea78c598094e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2604	2026-08-14_50bed47a333e8033caadea78c598094e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2604	2026-08-14_50bed47a333e8033caadea78c598094e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2604	2026-08-14_50bed47a333e8033caadea78c598094e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2604	2026-08-14_50bed47a333e8033caadea78c598094e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2604	2026-08-14_50bed47a333e8033caadea78c598094e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2604	2026-08-14_50bed47a333e8033caadea78c598094e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2604	2026-08-14_50bed47a333e8033caadea78c598094e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2604	2026-08-14_50bed47a333e8033caadea78c598094e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2604	2026-08-14_50bed47a333e8033caadea78c598094e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2604	2026-08-14_50bed47a333e8033caadea78c598094e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2604	2026-08-14_50bed47a333e8033caadea78c598094e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2604	2026-08-14_50bed47a333e8033caadea78c598094e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2604	2026-08-14_50bed47a333e8033caadea78c598094e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2604	2026-08-14_50bed47a333e8033caadea78c598094e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2604	2026-08-14_50bed47a333e8033caadea78c598094e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2604	2026-08-14_50bed47a333e8033caadea78c598094e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2604	2026-08-14_50bed47a333e8033caadea78c598094e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2604	2026-08-14_50bed47a333e8033caadea78c598094e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2604	2026-08-14_50bed47a333e8033caadea78c598094e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2604	2026-08-14_50bed47a333e8033caadea78c598094e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2604	2026-08-14_50bed47a333e8033caadea78c598094e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2604	2026-08-14_50bed47a333e8033caadea78c598094e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2604	2026-08-14_50bed47a333e8033caadea78c598094e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2604	2026-08-14_50bed47a333e8033caadea78c598094e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2604	2026-08-14_50bed47a333e8033caadea78c598094e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2604	2026-08-14_50bed47a333e8033caadea78c598094e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1232	ywqomgdbzwqoigeb.exe
1232	ywqomgdbzwqoigeb.exe
2604	2026-08-14_50bed47a333e8033caadea78c598094e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2604	2026-08-14_50bed47a333e8033caadea78c598094e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1232	ywqomgdbzwqoigeb.exe
1232	ywqomgdbzwqoigeb.exe
2604	2026-08-14_50bed47a333e8033caadea78c598094e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2604	2026-08-14_50bed47a333e8033caadea78c598094e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1232	ywqomgdbzwqoigeb.exe
1232	ywqomgdbzwqoigeb.exe
2604	2026-08-14_50bed47a333e8033caadea78c598094e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2604	2026-08-14_50bed47a333e8033caadea78c598094e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
1232	ywqomgdbzwqoigeb.exe
1232	ywqomgdbzwqoigeb.exe

Suspicious behavior: LoadsDriver 21 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
6932	msedge.exe
6932	msedge.exe
6932	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	724	i_jgeywtomdb.exe
Token: SeDebugPrivilege	6972	i_qligayvtnl.exe
Token: SeDebugPrivilege	4764	i_icavsnlida.exe
Token: SeDebugPrivilege	6272	i_davsqnlfdx.exe
Token: SeDebugPrivilege	5156	i_fcxvpkicau.exe
Token: SeDebugPrivilege	5200	i_czxrpnkecz.exe
Token: SeDebugPrivilege	2072	i_hczurmkecw.exe
Token: SeDebugPrivilege	2692	i_trmjecwuom.exe
Token: SeDebugPrivilege	2380	i_bwtomgeywt.exe
Token: SeDebugPrivilege	3116	i_dywqoigayt.exe
Token: SeDebugPrivilege	2876	i_tqlidbvtnl.exe
Token: SeDebugPrivilege	6268	i_fdayvqnlid.exe
Token: SeDebugPrivilege	5476	i_nkifaxvsqk.exe
Token: SeDebugPrivilege	2196	i_fzxvsmkhfz.exe
Token: SeDebugPrivilege	6420	i_fzxupmkhcz.exe
Token: SeDebugPrivilege	2412	i_bzxupmkhbz.exe
Token: SeDebugPrivilege	2652	i_trljhecwur.exe
Token: SeDebugPrivilege	5028	i_tqolgdbytr.exe
Token: SeDebugPrivilege	2908	i_gebwtroigd.exe
Token: SeDebugPrivilege	5216	i_ayvqnljdav.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6932	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2604 wrote to memory of 1232	2604	2026-08-14_50bed47a333e8033caadea78c598094e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	91
PID 2604 wrote to memory of 6732	2604	2026-08-14_50bed47a333e8033caadea78c598094e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	92
PID 6732 wrote to memory of 6932	6732	iexplore.exe	93
PID 6932 wrote to memory of 1096	6932	msedge.exe	94
PID 6932 wrote to memory of 6352	6932	msedge.exe	95
PID 6932 wrote to memory of 4872	6932	msedge.exe	96
PID 6932 wrote to memory of 6352	6932	msedge.exe	95
PID 6932 wrote to memory of 6352	6932	msedge.exe	95
PID 6932 wrote to memory of 7068	6932	msedge.exe	97
PID 6932 wrote to memory of 7068	6932	msedge.exe	97
PID 6932 wrote to memory of 2084	6932	msedge.exe	99
PID 6932 wrote to memory of 2084	6932	msedge.exe	99
PID 6932 wrote to memory of 5872	6932	msedge.exe	100
PID 6932 wrote to memory of 2084	6932	msedge.exe	99
PID 6932 wrote to memory of 5872	6932	msedge.exe	100
PID 6932 wrote to memory of 5872	6932	msedge.exe	100
PID 6932 wrote to memory of 832	6932	msedge.exe	103
PID 6932 wrote to memory of 832	6932	msedge.exe	103
PID 6932 wrote to memory of 1316	6932	msedge.exe	104
PID 6932 wrote to memory of 1316	6932	msedge.exe	104
PID 1232 wrote to memory of 4068	1232	ywqomgdbzwqoigeb.exe	105
PID 6932 wrote to memory of 3336	6932	msedge.exe	108
PID 6756 wrote to memory of 424	6756	jgeywtomdb.exe	110
PID 1232 wrote to memory of 6344	1232	ywqomgdbzwqoigeb.exe	115
PID 1232 wrote to memory of 1132	1232	ywqomgdbzwqoigeb.exe	119
PID 4212 wrote to memory of 5468	4212	qligayvtnl.exe	121
PID 1232 wrote to memory of 2184	1232	ywqomgdbzwqoigeb.exe	124
PID 1232 wrote to memory of 6216	1232	ywqomgdbzwqoigeb.exe	128
PID 4576 wrote to memory of 6604	4576	icavsnlida.exe	130
PID 1232 wrote to memory of 4128	1232	ywqomgdbzwqoigeb.exe	133
PID 1232 wrote to memory of 6412	1232	ywqomgdbzwqoigeb.exe	137
PID 4868 wrote to memory of 5760	4868	davsqnlfdx.exe	139
PID 1232 wrote to memory of 1960	1232	ywqomgdbzwqoigeb.exe	143
PID 6932 wrote to memory of 1904	6932	msedge.exe	145
PID 6932 wrote to memory of 2608	6932	msedge.exe	146
PID 6932 wrote to memory of 4828	6932	msedge.exe	147
PID 1232 wrote to memory of 5820	1232	ywqomgdbzwqoigeb.exe	150
PID 1832 wrote to memory of 3456	1832	fcxvpkicau.exe	152
PID 1232 wrote to memory of 1944	1232	ywqomgdbzwqoigeb.exe	155
PID 1232 wrote to memory of 4572	1232	ywqomgdbzwqoigeb.exe	159
PID 5628 wrote to memory of 3052	5628	czxrpnkecz.exe	161
PID 1232 wrote to memory of 4932	1232	ywqomgdbzwqoigeb.exe	164
PID 1232 wrote to memory of 6104	1232	ywqomgdbzwqoigeb.exe	168
PID 2148 wrote to memory of 6648	2148	hczurmkecw.exe	170
PID 1232 wrote to memory of 6296	1232	ywqomgdbzwqoigeb.exe	173
PID 1232 wrote to memory of 1364	1232	ywqomgdbzwqoigeb.exe	177
PID 6124 wrote to memory of 1664	6124	trmjecwuom.exe	179
PID 1232 wrote to memory of 6280	1232	ywqomgdbzwqoigeb.exe	182
PID 6932 wrote to memory of 468	6932	msedge.exe	186
PID 6932 wrote to memory of 468	6932	msedge.exe	186
PID 1232 wrote to memory of 5060	1232	ywqomgdbzwqoigeb.exe	188
PID 2864 wrote to memory of 6064	2864	bwtomgeywt.exe	190
PID 1232 wrote to memory of 1240	1232	ywqomgdbzwqoigeb.exe	193
PID 6932 wrote to memory of 6652	6932	msedge.exe	195
PID 6932 wrote to memory of 6652	6932	msedge.exe	195
PID 1232 wrote to memory of 7092	1232	ywqomgdbzwqoigeb.exe	198
PID 6120 wrote to memory of 5328	6120	dywqoigayt.exe	200
PID 1232 wrote to memory of 3672	1232	ywqomgdbzwqoigeb.exe	203
PID 6932 wrote to memory of 3032	6932	msedge.exe	205
PID 6932 wrote to memory of 3032	6932	msedge.exe	205
PID 1232 wrote to memory of 1692	1232	ywqomgdbzwqoigeb.exe	208
PID 6848 wrote to memory of 1440	6848	tqlidbvtnl.exe	210
PID 1232 wrote to memory of 6168	1232	ywqomgdbzwqoigeb.exe	213
PID 1232 wrote to memory of 3356	1232	ywqomgdbzwqoigeb.exe	217

C:\Users\Admin\AppData\Local\Temp\2026-08-14_50bed47a333e8033caadea78c598094e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_50bed47a333e8033caadea78c598094e_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2604
- C:\Temp\ywqomgdbzwqoigeb.exe
  C:\Temp\ywqomgdbzwqoigeb.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1232
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jgeywtomdb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4068
  - - C:\Temp\jgeywtomdb.exe
      C:\Temp\jgeywtomdb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6756
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:424
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6804
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jgeywtomdb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6344
  - - C:\Temp\i_jgeywtomdb.exe
      C:\Temp\i_jgeywtomdb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:724
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qligayvtnl.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1132
  - - C:\Temp\qligayvtnl.exe
      C:\Temp\qligayvtnl.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4212
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5468
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2196
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qligayvtnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2184
  - - C:\Temp\i_qligayvtnl.exe
      C:\Temp\i_qligayvtnl.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6972
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\icavsnlida.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6216
  - - C:\Temp\icavsnlida.exe
      C:\Temp\icavsnlida.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4576
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6604
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6536
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_icavsnlida.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4128
  - - C:\Temp\i_icavsnlida.exe
      C:\Temp\i_icavsnlida.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4764
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\davsqnlfdx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6412
  - - C:\Temp\davsqnlfdx.exe
      C:\Temp\davsqnlfdx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4868
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5760
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5324
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_davsqnlfdx.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1960
  - - C:\Temp\i_davsqnlfdx.exe
      C:\Temp\i_davsqnlfdx.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6272
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fcxvpkicau.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5820
  - - C:\Temp\fcxvpkicau.exe
      C:\Temp\fcxvpkicau.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1832
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3456
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5112
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fcxvpkicau.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1944
  - - C:\Temp\i_fcxvpkicau.exe
      C:\Temp\i_fcxvpkicau.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5156
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\czxrpnkecz.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4572
  - - C:\Temp\czxrpnkecz.exe
      C:\Temp\czxrpnkecz.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5628
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3052
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5524
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_czxrpnkecz.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4932
  - - C:\Temp\i_czxrpnkecz.exe
      C:\Temp\i_czxrpnkecz.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5200
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hczurmkecw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6104
  - - C:\Temp\hczurmkecw.exe
      C:\Temp\hczurmkecw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2148
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6648
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1728
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hczurmkecw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6296
  - - C:\Temp\i_hczurmkecw.exe
      C:\Temp\i_hczurmkecw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2072
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\trmjecwuom.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1364
  - - C:\Temp\trmjecwuom.exe
      C:\Temp\trmjecwuom.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6124
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1664
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6836
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_trmjecwuom.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6280
  - - C:\Temp\i_trmjecwuom.exe
      C:\Temp\i_trmjecwuom.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2692
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bwtomgeywt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5060
  - - C:\Temp\bwtomgeywt.exe
      C:\Temp\bwtomgeywt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2864
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6064
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1036
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bwtomgeywt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1240
  - - C:\Temp\i_bwtomgeywt.exe
      C:\Temp\i_bwtomgeywt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2380
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dywqoigayt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:7092
  - - C:\Temp\dywqoigayt.exe
      C:\Temp\dywqoigayt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6120
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5328
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5764
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dywqoigayt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3672
  - - C:\Temp\i_dywqoigayt.exe
      C:\Temp\i_dywqoigayt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3116
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tqlidbvtnl.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1692
  - - C:\Temp\tqlidbvtnl.exe
      C:\Temp\tqlidbvtnl.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6848
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1440
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2652
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tqlidbvtnl.exe ups_ins
    3⤵
    PID:6168
  - - C:\Temp\i_tqlidbvtnl.exe
      C:\Temp\i_tqlidbvtnl.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2876
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fdayvqnlid.exe ups_run
    3⤵
    PID:3356
  - - C:\Temp\fdayvqnlid.exe
      C:\Temp\fdayvqnlid.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2740
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2772
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6804
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fdayvqnlid.exe ups_ins
    3⤵
    PID:2400
  - - C:\Temp\i_fdayvqnlid.exe
      C:\Temp\i_fdayvqnlid.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6268
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nkifaxvsqk.exe ups_run
    3⤵
    PID:4584
  - - C:\Temp\nkifaxvsqk.exe
      C:\Temp\nkifaxvsqk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2808
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6076
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4292
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nkifaxvsqk.exe ups_ins
    3⤵
    PID:5564
  - - C:\Temp\i_nkifaxvsqk.exe
      C:\Temp\i_nkifaxvsqk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5476
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fzxvsmkhfz.exe ups_run
    3⤵
    PID:908
  - - C:\Temp\fzxvsmkhfz.exe
      C:\Temp\fzxvsmkhfz.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1488
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2296
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1092
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fzxvsmkhfz.exe ups_ins
    3⤵
    PID:1052
  - - C:\Temp\i_fzxvsmkhfz.exe
      C:\Temp\i_fzxvsmkhfz.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2196
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fzxupmkhcz.exe ups_run
    3⤵
    PID:3536
  - - C:\Temp\fzxupmkhcz.exe
      C:\Temp\fzxupmkhcz.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3036
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:836
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6140
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fzxupmkhcz.exe ups_ins
    3⤵
    PID:4724
  - - C:\Temp\i_fzxupmkhcz.exe
      C:\Temp\i_fzxupmkhcz.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6420
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bzxupmkhbz.exe ups_run
    3⤵
    PID:5960
  - - C:\Temp\bzxupmkhbz.exe
      C:\Temp\bzxupmkhbz.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4392
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5808
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2780
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bzxupmkhbz.exe ups_ins
    3⤵
    PID:6532
  - - C:\Temp\i_bzxupmkhbz.exe
      C:\Temp\i_bzxupmkhbz.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2412
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\trljhecwur.exe ups_run
    3⤵
    PID:6588
  - - C:\Temp\trljhecwur.exe
      C:\Temp\trljhecwur.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3872
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:396
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6368
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_trljhecwur.exe ups_ins
    3⤵
    PID:5444
  - - C:\Temp\i_trljhecwur.exe
      C:\Temp\i_trljhecwur.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2652
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tqolgdbytr.exe ups_run
    3⤵
    PID:5112
  - - C:\Temp\tqolgdbytr.exe
      C:\Temp\tqolgdbytr.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2816
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1116
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2776
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tqolgdbytr.exe ups_ins
    3⤵
    PID:5608
  - - C:\Temp\i_tqolgdbytr.exe
      C:\Temp\i_tqolgdbytr.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5028
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gebwtroigd.exe ups_run
    3⤵
    PID:2404
  - - C:\Temp\gebwtroigd.exe
      C:\Temp\gebwtroigd.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4116
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2364
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4784
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gebwtroigd.exe ups_ins
    3⤵
    PID:1448
  - - C:\Temp\i_gebwtroigd.exe
      C:\Temp\i_gebwtroigd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2908
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ayvqnljdav.exe ups_run
    3⤵
    PID:5196
  - - C:\Temp\ayvqnljdav.exe
      C:\Temp\ayvqnljdav.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4048
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1880
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6896
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ayvqnljdav.exe ups_ins
    3⤵
    PID:5896
  - - C:\Temp\i_ayvqnljdav.exe
      C:\Temp\i_ayvqnljdav.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5216
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:6732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:6932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffb0c6ec188,0x7ffb0c6ec194,0x7ffb0c6ec1a0
      4⤵
      PID:1096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1608,i,17470276867110652884,6160224264317734360,262144 --field-trial-handle=2384,i,4149041555531554428,3081076271856305079,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:2
      4⤵
      PID:6352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,18341272113276251922,12834262939409173660,524288 --field-trial-handle=2384,i,4149041555531554428,3081076271856305079,262144 --variations-seed-version --mojo-platform-channel-handle=3080 /prefetch:11
      4⤵
      System Time Discovery
      PID:4872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2436,i,11800999861089257423,12339065052506077108,524288 --field-trial-handle=2384,i,4149041555531554428,3081076271856305079,262144 --variations-seed-version --mojo-platform-channel-handle=3112 /prefetch:13
      4⤵
      PID:7068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3528,i,17296177230080451825,13386712473351489000,2097152 --field-trial-handle=2384,i,4149041555531554428,3081076271856305079,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
      4⤵
      PID:2084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3548,i,12881769825051470229,14821132641962031416,2097152 --field-trial-handle=2384,i,4149041555531554428,3081076271856305079,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
      4⤵
      PID:5872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,10954655510127451785,16814833452231093175,524288 --field-trial-handle=2384,i,4149041555531554428,3081076271856305079,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:14
      4⤵
      PID:832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,12144782599770751522,18227115081137516770,524288 --field-trial-handle=2384,i,4149041555531554428,3081076271856305079,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:14
      4⤵
      PID:1316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,13842035469404127703,10922796957753812372,524288 --field-trial-handle=2384,i,4149041555531554428,3081076271856305079,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:14
      4⤵
      PID:5880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,13842035469404127703,10922796957753812372,524288 --field-trial-handle=2384,i,4149041555531554428,3081076271856305079,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:14
      4⤵
      PID:3336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4944,i,15488921611916509632,11214595171135330721,524288 --field-trial-handle=2384,i,4149041555531554428,3081076271856305079,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:14
      4⤵
      PID:1904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6412,i,5381025908059221025,1005431129868565548,524288 --field-trial-handle=2384,i,4149041555531554428,3081076271856305079,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:14
      4⤵
      PID:2608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6372,i,6741580330631519621,12311506814708758241,524288 --field-trial-handle=2384,i,4149041555531554428,3081076271856305079,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:14
      4⤵
      PID:4828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,17458168540052368680,3417468887496367982,524288 --field-trial-handle=2384,i,4149041555531554428,3081076271856305079,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:14
      4⤵
      PID:468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,3527192080136728255,12520180657789725685,524288 --field-trial-handle=2384,i,4149041555531554428,3081076271856305079,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:14
      4⤵
      PID:6652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,9829972033814568747,14557572688439085547,524288 --field-trial-handle=2384,i,4149041555531554428,3081076271856305079,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:14
      4⤵
      PID:3032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,7266139432038966966,1616014095131720332,524288 --field-trial-handle=2384,i,4149041555531554428,3081076271856305079,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:14
      4⤵
      PID:6612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6704,i,13743508849392439052,17780807319813047826,524288 --field-trial-handle=2384,i,4149041555531554428,3081076271856305079,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:14
      4⤵
      PID:4908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6704,i,8055293477271576088,10883828107218095372,262144 --field-trial-handle=2384,i,4149041555531554428,3081076271856305079,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:10
      4⤵
      PID:4620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,7452589699092065160,2110829269612449912,524288 --field-trial-handle=2384,i,4149041555531554428,3081076271856305079,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:14
      4⤵
      PID:7064

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3796

C:\Temp\ywqomgdbzwqoigeb.sys
C:\Temp\ywqomgdbzwqoigeb.sys
1⤵
- Executes dropped EXE
PID:2044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:7108

C:\Temp\qljdbvtnlf.sys
C:\Temp\qljdbvtnlf.sys
1⤵
- Executes dropped EXE
PID:3484

C:\Temp\ysqlidavtn.sys
C:\Temp\ysqlidavtn.sys
1⤵
- Executes dropped EXE
PID:6256

C:\Temp\caysqnifdx.sys
C:\Temp\caysqnifdx.sys
1⤵
- Executes dropped EXE
PID:4280

C:\Temp\kicausnkfd.sys
C:\Temp\kicausnkfd.sys
1⤵
- Executes dropped EXE
PID:4716

C:\Temp\ecxupmkfcw.sys
C:\Temp\ecxupmkfcw.sys
1⤵
- Executes dropped EXE
PID:4700

C:\Temp\pmhfzwupmh.sys
C:\Temp\pmhfzwupmh.sys
1⤵
- Executes dropped EXE
PID:5132

C:\Temp\rpjhbztrmj.sys
C:\Temp\rpjhbztrmj.sys
1⤵
- Executes dropped EXE
PID:1400

C:\Temp\ywqoljhbyw.sys
C:\Temp\ywqoljhbyw.sys
1⤵
- Executes dropped EXE
PID:5372

C:\Temp\gbytrojgby.sys
C:\Temp\gbytrojgby.sys
1⤵
- Executes dropped EXE
PID:1216

C:\Temp\vtqoigdbyt.sys
C:\Temp\vtqoigdbyt.sys
1⤵
- Executes dropped EXE
PID:4652

C:\Temp\xvtnlidavt.sys
C:\Temp\xvtnlidavt.sys
1⤵
PID:6776

C:\Temp\lfdxusqkic.sys
C:\Temp\lfdxusqkic.sys
1⤵
PID:5196

C:\Temp\vpnkeczxvp.sys
C:\Temp\vpnkeczxvp.sys
1⤵
PID:5108

C:\Temp\ausmkhczxr.sys
C:\Temp\ausmkhczxr.sys
1⤵
PID:2948

C:\Temp\rpmheczurp.sys
C:\Temp\rpmheczurp.sys
1⤵
PID:2336

C:\Temp\omgecwuomg.sys
C:\Temp\omgecwuomg.sys
1⤵
PID:3032

C:\Temp\omjebztrom.sys
C:\Temp\omjebztrom.sys
1⤵
PID:1156

C:\Temp\qolgdbywqo.sys
C:\Temp\qolgdbywqo.sys
1⤵
PID:2544

C:\Temp\vqolgdbvtn.sys
C:\Temp\vqolgdbvtn.sys
1⤵
PID:6188

C:\Temp\yvqnligayv.sys
C:\Temp\yvqnligayv.sys
1⤵
PID:5576

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

caysqnifdx.sys

Path C:\Temp\caysqnifdx.sys
Size 293KB
SHA256 cab05cf6713f6c7872d0aafdb2c8b81c2a1cbff8d990e402f5db27dd180a6349
MD5 794f2e96742fa1605ff7ad1dd8a57627
SHA1 37a1ca1700af0afe8f9c31471a47bc2eba584d5a
SHA512 63622af6868d51e20fc9539575241a438912d05b6a149e9c014b72a4ce456fb129f5c6fc56be5604b343ce11d01bd52c6994b9f913767ca207a2972a6057002a
SSDEEP 3072:7tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:7IJjiJcbI03GBc3ucY5DCSj
TLSH
T162545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

czxrpnkecz.exe

Path C:\Temp\czxrpnkecz.exe
Size 389KB
SHA256 b0fbe06787541d29e56c3fb82d7acafcc227d2fef73f7123c07e4bfa4ed49e69
MD5 8135567a37c61952ad2bbcf1830038f2
SHA1 431cf7987e219e98abbc29b651fecac5fb62e06d
SHA512 8fdac9c0410cac5a3e22d78590f7ec363bfb221b01c6a6459535ef820145be22128f847d203e04c740066f67e2fafcb6dc212b10c4339f8d49d5592180838f3d
SSDEEP 3072:suxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:suxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T164847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

davsqnlfdx.exe

Path C:\Temp\davsqnlfdx.exe
Size 389KB
SHA256 a7e03fa012bbe37893102b3d52048dfa99062bd240a547422c4aaf4c84042662
MD5 f52ff5ba5261e1294156f22c08f74a5d
SHA1 4273cc40653526d78f85ca02d87132f5d8ca71c2
SHA512 d1a4851b8d8ced5f38213fc8947c56eb52bd0a1d35e5ac80dd27f6832f33f9022d1d604333425ad07b55996c79fbe092f946ca8c1988e1c8cc9128046dc01176
SSDEEP 3072:muxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:muxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T117847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecxupmkfcw.sys

Path C:\Temp\ecxupmkfcw.sys
Size 293KB
SHA256 d9c33a5a8ccc5634d11b9d998ac01c30e26576a5768cb68e122156fdf5e1a1df
MD5 e62c853e905f82707cb64c6069bf3f70
SHA1 e0eefd53b4b903b700f03ed639a04761634f0fd0
SHA512 46120e55c54bd4110ed0a611cfdf6fe6a3f1a4d3fe0f8d032c195dd62184a75cf247f9f875d6e287d49b5df9e3d4e1f2ca19fdca02a28cb53f4b46ba687182e9
SSDEEP 3072:ztKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:zIJjiJcbI03GBc3ucY5DCSj
TLSH
T1BF545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fcxvpkicau.exe

Path C:\Temp\fcxvpkicau.exe
Size 389KB
SHA256 2b24b8babccb00b2c6e2d767c940f79b23acd864ea6f2ee8acbd0055d87e1dd7
MD5 b00bd3d79b635235d633419048bfb11b
SHA1 f3b01af76ba7d286abac39002f2014ef61a4254a
SHA512 d02d2e3a530abe0a5438e470885614ef1f12c837bdfdd0561ef513f097e8ac202e049ac26716168435070188cf474a3b9944d6b905f28ea89c6a953e109bcf55
SSDEEP 3072:huxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:huxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T182847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hczurmkecw.exe

Path C:\Temp\hczurmkecw.exe
Size 389KB
SHA256 e80954cbe52fea6a1aaa09a8efd9aba13463aed4cb5a8b8b03c97eb69bd40d28
MD5 bb6aa1498a02aad5500ea7026846c303
SHA1 5a1e2da0824e828d0be344c1092f6319f61ab496
SHA512 3fc54914aee7d34de434ece79dc753b488d9e9f075e87b831cf279e2b6b7ed7f14063dc76496583ebbfbc21eda1d5ac26369831b347c370d28c345f4b9939b45
SSDEEP 3072:iuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:iuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T170847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_czxrpnkecz.exe

Path C:\Temp\i_czxrpnkecz.exe
Size 389KB
SHA256 d1519445fb7793b953c9a0d132953e9003e6af0fc4cf7115c7fe191a23419113
MD5 f77f8e179fd7bf8fcc9b8c791fef2780
SHA1 16f667f1f770f54d3a71bcdb101ae14421546985
SHA512 c6d90590364c1ad2b53b9ae79a06e144e33360c734475a2995eb4ac23f4b29cb0ef385a51835fd6b26bf8dbcab4f5e43692e19b8e02d606cfc9b41c31c283492
SSDEEP 3072:4uxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:4uxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D8847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_davsqnlfdx.exe

Path C:\Temp\i_davsqnlfdx.exe
Size 389KB
SHA256 75ac71928710cf510095f4450982a302f3305cef6f0074342b291d92991eeea6
MD5 5095db86e9df8687fae220dfcd525538
SHA1 237bcaeb8923e42d979b379888d93836fa1eb20e
SHA512 d0fa0a1a31bd9cd80022ec5d0f15205a6e92a86495117c2fd6b90e68dc1dd8cdd0490feea44033dea13b79207fac527e121f80721ba7ab2892316f6f0c29fc11
SSDEEP 3072:3uxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:3uxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1FE847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fcxvpkicau.exe

Path C:\Temp\i_fcxvpkicau.exe
Size 389KB
SHA256 470234d1d204b466d76d36745e59ed78b7a7dcb0b0f6303f71f44b78f8bb4a9b
MD5 00dfef5c9541e36a79efbac8c1efd7ec
SHA1 d0079776bed407bb3ebc46fac69642b77377e886
SHA512 ecf2fb0bfb2f37e2f58c903b920c3e63751a9e90000744631039569c6a9346036fc8e4aea837d73168deac52fad52399002d74f441298a8863496de3c64952eb
SSDEEP 3072:6uxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:6uxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T167847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_icavsnlida.exe

Path C:\Temp\i_icavsnlida.exe
Size 389KB
SHA256 23ef1e3b41b08476953c553aedb5978d43dacc90aa33041e404b18294ccd8623
MD5 8fef96f5b529a8bc4747879619da9edc
SHA1 dfd266c03491dcaf6f5903a845989a6ca4902b1d
SHA512 e7124a882c9a974aedbfe15a74c3d22ac3e40932c9611e56d5337ae4cdd582ec9f9b928f8f92f94f2bdc8431373a4606ff1efc47c9dffedb0eee7eb87f062855
SSDEEP 3072:6uxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:6uxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T105847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jgeywtomdb.exe

Path C:\Temp\i_jgeywtomdb.exe
Size 389KB
SHA256 8443b7141b550c86b9f281f083a7ecdd71e89ead43301d49a7c5a03379884f6f
MD5 6fee6bd28b8920c1ed0a0be06d610c3a
SHA1 c018e087eb26eb0df28b1cc9ed4be77f8d3494b7
SHA512 06b4d111bd1b53e1193beeb5a5897f0d1e0823372abe554569b7b52a282949d000d2d476629163b3bcab9730dbeaa3ba02ac1222f55ff1b72a09e3b5f0f17832
SSDEEP 3072:Zuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:ZuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T118847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qligayvtnl.exe

Path C:\Temp\i_qligayvtnl.exe
Size 389KB
SHA256 7563fa37a223af05e6f49afbec05939b112c351db8bbe264d1b5ed179b48fa58
MD5 e24e72c5b43f6728fdb2effc02e6b9c5
SHA1 e81357bc1d7b9528a1719194f4194a6f43f36aac
SHA512 f051ab7ac4f85a5d52ed146dfde9f0bbc68293b8079e6976dc975411512b8265fbec07e13f8adc224f84f08b4662c120b5efca253a98f94e6ed92702dee475da
SSDEEP 3072:6uxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:6uxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T158847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icavsnlida.exe

Path C:\Temp\icavsnlida.exe
Size 389KB
SHA256 9f4d7cb04e391df8098577e18ba1ab5bccbacd69e99a549805be5d34484a64f7
MD5 a45593afba627fae09cfcff56fc0420e
SHA1 24c24ca685eff1e1d01b1649d3606ea7b3957c21
SHA512 42c06e18a846f212d7a0209b531543111a52726e7a0ba05b2d9058dc1b00161d26a22d7b7c9d046151ac5e4ab92012ed520cff7a95f8f1768b4e01f967ef1fcb
SSDEEP 3072:4uxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:4uxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T190847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jgeywtomdb.exe

Path C:\Temp\jgeywtomdb.exe
Size 389KB
SHA256 70ce6cf262ce3b947b4ca7d62f603d7626a12034c679f8b349cf394bdabd220b
MD5 ab3f935357ed3bf4a532021240c29562
SHA1 a632c0852ab047e5c9bc7eaa7829f57f59c9568b
SHA512 a7bbb76fda83a93655ff06f977271ec65effb28bb24ce9f40c5d7efd4b7b42d431b0e13f718df51fce4857e787b229cc6f9e44121a1ea442ae77dc7227433921
SSDEEP 3072:muxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:muxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1AA847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kicausnkfd.sys

Path C:\Temp\kicausnkfd.sys
Size 293KB
SHA256 8a04190b8d31540a7c0f40d733799ac67f7baf87155a31f2a52574702b2b79f0
MD5 aaf03cd7b49887825a504b715045cb30
SHA1 a24111094f0495f58fd080b4bd256ca38801b87a
SHA512 47dce0e8bfa69004a800127c35582a88e9d4ca13cff634b5e293d5e3cf020537e0ffb87613de02475510e69b2776308d9f411a9637cf2d9494d876563ab9426c
SSDEEP 3072:ttKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:tIJjiJcbI03GBc3ucY5DCSj
TLSH
T109545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmhfzwupmh.sys

Path C:\Temp\pmhfzwupmh.sys
Size 293KB
SHA256 b029f9333ccdcc6f606129ee8b636c015d9b0aac83d817e5908cc878b132a9e9
MD5 b0263f12c3f035bf2c6edd92e5d44681
SHA1 71cdc49fd63b75bd5f6db1a4db9d4b3c20db0200
SHA512 aa6c688b148cd5c76d8a56aa8d99e604e9f16a3abfba806cae0830ee6403b7b441211f76755049992f7694bffce17e22064aa23d837ae1e6eeae1e1e53a48a14
SSDEEP 3072:3tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:3IJjiJcbI03GBc3ucY5DCSj
TLSH
T158545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qligayvtnl.exe

Path C:\Temp\qligayvtnl.exe
Size 389KB
SHA256 15c8b17edf137c04eac00d8e14118865eaa8fd385b118666b03b9dd31dc7468b
MD5 6b9fa59c922f8e45fdd396418dfa6d35
SHA1 10bc2bf6c47d2fd2c0a6ded5a47ff2d40f190223
SHA512 33e22957d62e2def074387a4b4e9e4896863a75fd657c71cad1c95abb637482fcbbd1785810bf6add58a6741f5fd9bd025ac4342ce4f8a04e37e522dc8c22008
SSDEEP 3072:Ouxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:OuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T157847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qljdbvtnlf.sys

Path C:\Temp\qljdbvtnlf.sys
Size 293KB
SHA256 2a4efee5ae456cd52be5ea730d9df1b84c3407097eff8f45958e67cb0282c806
MD5 502fbdd6b55860b7bc689f467f59a7c5
SHA1 79eb1e9acd99335a696dfd1deca14ed93de85b1f
SHA512 0f6e6406c2aef0d80281c74331331cb679420e204a872456649f4b10e4accfc29e9c02b2f83a9dd05d6cd29c818591ac509cf85ce2abad80d4e32279a6845da8
SSDEEP 3072:ytKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:yIJjiJcbI03GBc3ucY5DCSj
TLSH
T1E2545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ysqlidavtn.sys

Path C:\Temp\ysqlidavtn.sys
Size 293KB
SHA256 c84221f3aad4529edf7bd363bb2e9db2aa6571e06139ae77bc0e872dd089a945
MD5 e23f3c3959ecbd3c1cac032befa0fe47
SHA1 469d05c788b7a7088d11278a4eb7e7c1d2359dae
SHA512 9ac9c47a3b526c7f72b57e750d2caa6c06a397f26f068a081bfb9bcfc1213ba34ad6bf5e6ac8cba0564f6436fe23aaa5054c8a2d0cae3c468731110951a6f37b
SSDEEP 3072:4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:4IJjiJcbI03GBc3ucY5DCSj
TLSH
T1F3545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywqomgdbzwqoigeb.exe

Path C:\Temp\ywqomgdbzwqoigeb.exe
Size 389KB
SHA256 7fd85d329c7edc949975cee9c1744622caf7d80a19072ee283fea6388d3deec2
MD5 dbf09793ae53a48eeafed226cd1dd638
SHA1 64740859c9773dd17e1ee9bb2f7382e0b6115ac8
SHA512 a88d84bcc4e97341fb2ffa3304c8ac610566fe34d1a70e1412b59ff96e746b590a81ec0954887a99b800a0837fb223da0acc48547fb61ef61f3f49612da8164a
SSDEEP 3072:/uxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:/uxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1AC847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywqomgdbzwqoigeb.sys

Path C:\Temp\ywqomgdbzwqoigeb.sys
Size 293KB
SHA256 36db30c32c08ddf2f318b4059a66373af3390a671e68542356413a2147458a23
MD5 4c2373082336991a0880a384368ec90e
SHA1 9336d2831cd85e98ebd49e8f953c0750fb514540
SHA512 52d92aaf64ef833006222026451cb79df4579505160e8823d6ee012cef9bb971dd2a52f39b7118b4c283f1095fc8f5a4c6539f7d883c9101ab10baa312eaded4
SSDEEP 3072:htKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:hIJjiJcbI03GBc3ucY5DCSj
TLSH
T16A545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e9e31f5fb014f6a7439a4e224bdae6d3d8b22db7c287d9c004b0184cc18e6bf8
MD5 00fe8112e1beaff1b09c3e772b0b70e6
SHA1 1d234f4d61d2fe0153bb63a7a246d37e6fc0aabe
SHA512 aaafc34862d38399e66858477aa9d3d624e9e071371fe2961aac0159845c41dbe1ed0ae62f8b9c52f327e4e4a97abdaf614ae741bcfd2627ec55b1d4f6fb6d74
TLSH
T1EAD08071B7286847D9551931D432CB017A57546365BAD1025160410C6C7BDB553CA155
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

9f1a25b4-01a0-4b99-85cd-e65136e19745.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9f1a25b4-01a0-4b99-85cd-e65136e19745.tmp
Size 414B
SHA256 138934bde4716ebcd8632c3c8898793e4c7760033104d5d3f7aa0900977ea611
MD5 8cd5417a6318d111a5919d96708dbe7b
SHA1 424bfe9ae9b5fe3dd1d3c40720dcfeb0a4311a3b
SHA512 0838cd40c2558e8c97049c82fbc925a2b20e90b2947dbac0e06302b63af44b95f537a5c711ba4f800d5e89beb982f887d3301019299cd4b968dfa8147abe38eb
TLSH
T183E02BA6C821BC2B1DFD2B5860540A8BE740235B3B41880B7F3C912C4FF173B468AC5C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 34dabd19f5c58b7137ab1bfbd84b106450f8283acd1086791d546970df2cf12a
MD5 ca0bcef9141bbf78d431faebe355655c
SHA1 f190a614658ff7aefd5818a5f0a83d78c67b07fd
SHA512 adf872e90fc7b51a7a4a8ba9de6464b7a5e84f26b4f3e5e7930bfc833346f9681dbd1dcdfd0cce2acbe052762f61481468eca7d2ae6c91bfe2ecc13de33fb4bd
TLSH
T146419FF783F4856ECA1195F0AA18AE1FCE1D0515432C7D9AC9E4AE2793E3471E041A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 d56525d351efb8ed2704703b9476c51069b4be5e931e5fffafca2a4f8f0301bc
MD5 eb60c506f9135722678e3639cb67388c
SHA1 8b999d762cd2ad045d0d95594a09746ff47a9545
SHA512 93dcd4367e802259a5a105c812427d0cc46e09ec19243521046eaba9e764db135ea839d01a7054a27f938f7d97acbc38be6f527f7bdb57948a91ead1e92ebaad
SSDEEP 384:sxRIW8W/f3s+BN/RII44/5K/WUqsGQWwj2:sMbW/fDTWc/5wWUqsGQWf
TLSH
T12D72E905AA689D3B8CDBD209FA957F93D3F9117391905E44AAFCCA0C04E66ED2107C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 86769dfcf73ac64980d7175d47fb6c77d903ffe9ec9fbefa2907ee54e6b4048c
MD5 b345e1a13baf9a1abd529f974faa30c3
SHA1 47cd7593b756e4c59972ed78717300a31b688635
SHA512 9229fbb78efdb516d56f8fc7f1f63d4067ed5e86ba78883d5ad2e5f60bc90f3441be7ae24ff9c0898e271b317e6bc781cbf5f5045978da87c5d6a0e94f0f3af8
SSDEEP 384:sxRIWqAW/f3suDN/RII44/5K/WUssGQWwDaC:sM5AW/f/JWc/5wWUssGQWY
TLSH
T12F72E715AA689D7B8CDBE209FA957F53D3F8116391901E44AAFCCA0C04E76ED2107C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 0c80fc4a2ce49abb650f35105d6bebb7118708927c4039831a9a647baa11a03c
MD5 590a11ca8a7a75ea4e594d7a685a0b57
SHA1 49771fbdef24a18f61f7d15d4c2f9fba6e8bd53f
SHA512 cbbae8b11af9a8f47b9631b1e532644ceaad1e711ee0d5e606fd4a93dd9478eb7043faf19b847536f1298a71f21582da40bed2843b653f0505a203046aaae8c7
SSDEEP 768:Ob4YZx7pLuL7yTWg1NfwB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVwobbDwzroQ4a:Ob4YZnE7yTWg1NfwBu1ja/obHwAna
TLSH
T181E2EC3B280CCB7E4F804ADDEC29BD9B6DA801CF5AD8895447FA450C03C6BEB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 1cd78dbc2fbe316fa0f9486444a5e9d2d0c096b03a33ae7d035e4a664f5fab22
MD5 ddb8d716832c4ba114725bfb6c9dbbe8
SHA1 6319b9dd625d9e447447a1ae6084c63b76ce8b48
SHA512 86a8688e3a62ab3d3d04f10ad7af2882c290e83a67692e5fd9cda210027e719db8c4e7098234c64dcb6f806cfd09fa921dd6e1e10b3e5e39052ca87aee4fa001
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9TLU:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRZ
TLSH
T166B25C11713F4290383EA90C91B9981E96C2B4A37519E53F7BA801A65F67E039DFECCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e75efa77-42da-4518-b264-d00f1c6bff8d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e75efa77-42da-4518-b264-d00f1c6bff8d.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 88561bf8d1dabfc74ba9d18e5f4384507c50eac9a76b479ddd1048f7f2d580cd
MD5 28f8c13761a30182cff23f7077c6bd4b
SHA1 697424ed30d5351159d37579ede3e6b161773bf2
SHA512 3d875c666ddb679176abca98ae43fd98d20477f8a4a71182d4d34b7e5e3606b297be962f768803793e37e6f557219e933b56fff9da9fde96dacc6a1bf76c150e
SSDEEP 384:nriF1tNn/s3n9Sn8NgK8TUNTUlIRiPvuTuWREqf+GGiwbjdYLWOObjI9G6w7xN8H:GF1j+9SXKwgUuzZGiwkW29M4
TLSH
T11DC25A36E859CEB7EDE64F99B34E7646EFE01163849C69D8EAD85E0C00C71AD0707C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 216e7b4c80800ecf93dfb14dbe186f1bbdb679606ec604be1b3c3de7352a886d
MD5 22e8f5de0fef4d375b6c5c17296d6b0f
SHA1 f34f85e2e19c2e8af8fc27d83d96b92a31f66064
SHA512 b415af723e963c915cfbe949ebed0cf5c6058304a687c3dc8a433194bedd48d416455571afc085908ffed1b95a644060d197056c19240b5e647cf41c0b4a5ff0
SSDEEP 384:nCsiF1tNn/s3n9SF8NLl8TUNTUlIRgPvuT0cGEqf+GGiwbjdsRJ2M58n38LEEIza:eF1j+94QlwguuDyGiwyRMMsM
TLSH
T16EB23B32E895DDB7ECEA4FD5B70A7686DFE451A388C89AD4E6D85D0C00C72AD070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 ff779a3d5c1ba2c51cc54b6927fe49e15f1416df511c6297e23176a4734d0528
MD5 e210739cb657fa9c15185d9c0c89add1
SHA1 2459570289aa36cb9b916124af0e0e3dc51ed47e
SHA512 cb9c728eed17497215ab472e6bf359eb0e80a4f695fa5fc8b5b603b1a3e039f6b903618e75f89d43fb000be28ec6b92b5a4d409203e706a0da368874c45e0e1a
SSDEEP 384:nBiF1tNn/s3n9Sn8Ngl8TUNTUlIRiPvuT5AGEqf+GGiwbjdsRJkMOObjI9G6w7xC:oF1j+9SXlwgUueyGiwyROM29M4
TLSH
T180C25C32E859CEB7EDE64F95B34E7686EEE051B3898C5AD4E6D85D0C00C71AD070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 9462e8624454873aa80e909d350616630503b8cea12d10528425aa859e52362d
MD5 6012e715bbb3559ce4318d236bb9bbae
SHA1 387ab52eb08981fdae43b0d0bb0f78e5e7afe20a
SHA512 a2a9d3f18bd8e9291e0ec207f606ef78110c23727140fe2115658cc01f28f815eb17e663787b1a9c03581454894906b409298e5cfa7da1646bfc3c0c5ec81a6f
SSDEEP 384:n3siFiZcIf8NLl8TUNTUlIRxPvuThcGEqf+GGiwbjdsRJ2MOOPrXLpe8C/hBV8LO:nFQfQlwgzuGyGiwyRMMOi9PubZ
TLSH
T16AD26C32E8A8CDA7BCEA9FC5A7497646EEF01163D4CC9AD4E5D89D0C00C71AE070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 8e083a56049b0b50871368b86be0e814c4725e655883e4e6b7ec91a4ec7c7c31
MD5 84d2f79329cd4ab63a454112650ac7c6
SHA1 d8fa1956519256f65a0831cbaafdc5452f70dee4
SHA512 8265feac2f954ba9a1d3c3b67f1dc5fe553b103c1f6ebd61dd149b357ac50ab98733a882360c3f25d1cfbe7c306b3e1ffb58eaa77ffff22dc6db07145ce75165
SSDEEP 384:n3ViFiZcIH8NLl8TUNTUlIRxPvuThuGEtf+GGiwbjdsRWuMOOPrXLpe8C/hBV8LO:sFQHQlwgzuULGiwyRvMOi9PubZ
TLSH
T172F2B2F298D78972E8EE4B87637D2E469AFCD163B4885594B7C45D0CCC821BFC70A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 4375f44293a2d84b666212ee363f482ce77518574d5c5a4e9a4b46a310b8f88c
MD5 99d71343be0e852e05c0bad8b90dda14
SHA1 8a243ebd02b6522701f529d59013043a701bc543
SHA512 65630c278d7c1380ccb89c009f00cc2c1ea2aa477a4a3b838a2a3ca57015e25e2c62ae6589167da62c0bf2622e6314e38b40395daea7257ae35d9d64b25a0810
SSDEEP 384:nCsiFiZcIf8NLl8TUNTUlIRxPvuThcGEqf+GGiwbjdsRJ2MOOPrXLpe8C/hBV8LO:eFQfQlwgzuGyGiwyRMMOi9PubZ
TLSH
T1ABD26C32E8A8CDA7BCEA9FC5A7497646EEF45163D4CC9AD4E5D89D0C00C71AE070BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 a3278f957234771d848a4b3ee9901aeec341d2434b924c995300d2e0713b1b7b
MD5 893e4b2373eda936d6ab8fb4a1e8c47b
SHA1 5dfe17ef2f135c6fe6fcf58b53b0628e776e1f54
SHA512 1a716a864fce6b95f1feb9176544c1cf943db5897e41d0030e0c9ace03815ee6a21880b6a9211f32946768874b0c281da0606c7d4c602fd416ce3f6e05c06a5e
TLSH
T119412FE04C391AD1D4BE0E6EB45729FC94EC9726F89434382858EA98967A65E358083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 5fcc2510f853c70d2a907a27b2cb6af782d81ecaf5cfb4146f87a4a1a7784df8
MD5 326b6eea333fdb9f33eb78f013cdae1c
SHA1 d837019a6af3e1f22886128f60b0bd5efc84a9f5
SHA512 df6d93b739c655b9416fb661ae1c79b4dec598e07181ee912547441bf551751e48534e16023affcae8cbec5d2e86eb13f9f433a6cfb9c90a7e3b523816d67559
TLSH
T1264120E05C392AD1D0BD0E6EB48739FC94EC9726F8A434386898D998957E61D254483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 c588967d7a6416eedcbfa0801806f5137d43ab27f0332710af7b137709088910
MD5 6e4314d23ac9bbe9614361c4c2dc5d04
SHA1 3d7404c1699514585b6dcc32e43886e2a93d28ea
SHA512 af0923e802a16a8e4c7cfa65f5b3bd606658c9a17b58f76112dfce332c51c30cbbf0cb82d3a89400a309a27650a73dc340968b7acd8923e05fb0a69e3101d43c
TLSH
T1D04120D04C392AD1D4BD0E3EB45729FC94EC9726F89434386859EA58967E60D355083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 17d7b0dcac2d20112db1f6fe04c4a946828d0ec4a53d1da5ff39d525ca565ec3
MD5 d748eda12748f82e0651fc8a8a940327
SHA1 272fbf2f9036535341f389af7b9d7454af923654
SHA512 438edad34791b701756d6dbe0bf5ee09c309788d5a2e9382f9977fb69ac9f71b1bf0ee4c031f0c7f47a22fa93276e41b9da616c51d87cc7f6991ceca4d03dd58
TLSH
T10D412FE04C392AD1D0FD0E7EB58739FC94ECD726F8A434786898E95855BA21E258083F
MD5 SHA1 SHA512 TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 3c5c366caa9177511d370451cf28d535a8731dd5966155a7676914dec586be40
MD5 9199050cf2bf6aa8744e8db33914ddc1
SHA1 a17b86dbe2fc0e7ef80cdb8850d9798ec9a63d75
SHA512 4a01bd3fdf1588e8e74050dc0ecf9d78e0f7f62366cdda1faade6c5aff10255dff988bc61fa7e5c076726a89016fea347e721e657d2cf5992fa9a7b70fda2d00
TLSH
T15971E38357ADD5B3C1DE5BF102835644F6FB227C176370240BA55946EB70A7A64B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1156-423-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1216-293-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1400-278-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2044-61-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2336-395-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2544-464-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2544-442-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2948-384-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3032-415-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3484-154-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4280-209-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4280-223-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4652-336-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4700-236-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4716-222-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5108-364-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5132-272-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5196-359-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5372-282-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5576-467-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6188-462-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6256-189-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6776-340-0x0000000000010000-0x00000000000AB000-memory.dmp

Download